Function at 0x411e10
Capabilities:
Copy file
Create directory
Create process on windows
Enumerate files on windows
Get common file path
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e8]
sub esp, 0x768
mov eax, dword [0x449748]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push edi
push CreateStatusWindowA
mov dword [ebp + 0x6e4], eax
call esi
push connect
call esi
xor ebx, ebx
cmp word [0x44c958], bx
je 0x411ef5
cmp word [0x44c960], 0x1f4
mov eax, 0x4418a0
ja 0x411e64
mov eax, str.Windows_2000
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
mov esi, 0x4419dc
push esi
push eax
push dword [ebp + 0x6f0]
call edi
cmp eax, 6
jne 0x41262f
push 0x104
lea eax, [ebp + 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.NTBACKUP.EXE
lea eax, [ebp + 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push ebx
push ebx
lea eax, [ebp + 0x3d8]
push eax
push str.open
push dword [ebp + 0x6f0]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x41262f
cmp word [0x44c960], 0x1f4
mov eax, 0x4415b8
ja 0x411ee2
mov eax, 0x441548
push 0x10
push esi
push eax
push dword [ebp + 0x6f0]
call edi
xor al, al
jmp 0x412631
cmp word [0x44c960], 0x19a
push 0x24
jb 0x411f5c
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x44152c
push str.Windows_98_Me
push dword [ebp + 0x6f0]
call esi
cmp eax, 6
jne 0x41262f
push 1
push ebx
push ebx
push str.SCANREGW.EXE
push str.open
push dword [ebp + 0x6f0]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x41262f
push 0x10
push 0x4419dc
push 0x4413bc
push dword [ebp + 0x6f0]
call esi
jmp 0x411eee
push 0x4413a4
push 0x441248
push dword [ebp + 0x6f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x41262f
mov edi, 0x104
push edi
lea eax, [ebp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0x2d4]
push eax
lea eax, [ebp + 0x3d8]
push eax
call esi
push str.RNBACKUP
lea eax, [ebp + 0x3db]
push eax
call esi
push ebx
lea eax, [ebp + 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
lea eax, [ebp + 0x2d4]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp + 0x3d8]
push eax
lea eax, [ebp - 0x74]
push eax
call esi
push str..BAT
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
jne 0x412029
push 0x30
push 0x4419dc
push 0x4411c0
push dword [ebp + 0x6f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x411eee
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea eax, [ebp - 0x7c]
push eax
mov esi, str._ECHO_OFF_r_nECHO
push esi
call edi
push eax
push esi
push dword [ebp - 0x78]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
lea eax, [ebp + 0x2d4]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SYSTEM.DAT
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x3d8]
push eax
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SYSTEM.DAT
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x80
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp + 0x4dc]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x412199
push 0x80
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x16
push str.ATTRIB__R__S__H___NUL
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 7
push str._r_nCOPY
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x4dc]
push eax
call edi
push eax
lea eax, [ebp + 0x4dc]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 1
push 0x43ce3c
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x12
push str._r_nATTRIB_R_H__A
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
push 0x43e2e4
push dword [ebp - 0x78]
call esi
jmp 0x4121b1
push 0x10
push 0x4419dc
push 0x441090
push dword [ebp + 0x6f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp + 0x2d4]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.USER.DAT
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x3d8]
push eax
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.USER.DAT
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x80
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp + 0x4dc]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x412301
push 0x80
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x16
push str.ATTRIB__R__S__H___NUL
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 7
push str._r_nCOPY
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x4dc]
push eax
call edi
push eax
lea eax, [ebp + 0x4dc]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 1
push 0x43ce3c
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x12
push str._r_nATTRIB_R_H__A
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
push 0x43e2e4
push dword [ebp - 0x78]
call esi
jmp 0x412319
push 0x10
push 0x4419dc
push 0x441040
push dword [ebp + 0x6f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.PROFILES
lea eax, [ebp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4125fa
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp + 0x194], 0x10
je 0x4125fa
push str.PROFILES
lea eax, [ebp + 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea eax, [ebp + 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp + 0x2d4]
push eax
lea eax, [ebp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..
lea eax, [ebp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x80], eax
je 0x4125fa
test byte [ebp + 0x194], 0x10
je 0x4125d9
push 0x441024
lea eax, [ebp + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4125d9
push 0x441020
lea eax, [ebp + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4125d9
lea eax, [ebp + 0x2d4]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x43dc48
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x1c0]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.USER.DAT
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x3d8]
push eax
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x43dc48
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x1c0]
push eax
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4125d9
push str.USER.DAT
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x80
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp + 0x4dc]
push eax
lea eax, [ebp + 0x5e0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4125d9
push 0x80
lea eax, [ebp + 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x104
lea eax, [ebp + 0x5e0]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea eax, [ebp + 0x4dc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x16
push str.ATTRIB__R__S__H___NUL
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 7
push str._r_nCOPY
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x4dc]
push eax
call edi
push eax
lea eax, [ebp + 0x4dc]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 1
push 0x43ce3c
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x12
push str._r_nATTRIB_R_H__A
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5e0]
push eax
call edi
push eax
lea eax, [ebp + 0x5e0]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
push 0x43e2e4
push dword [ebp - 0x78]
call esi
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4123c2
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea eax, [ebp - 0x7c]
push eax
mov ebx, str.ECHO
push ebx
call edi
push eax
push ebx
push dword [ebp - 0x78]
call esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0x4419dc
push 0x440f38
push dword [ebp + 0x6f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, 1
mov ecx, dword [ebp + 0x6e4]
pop edi
pop esi
pop ebx
call fcn.00428306
add ebp, 0x6e8
leave
ret