Function at 0x40e780
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x1b8]
sub esp, 0x1dc
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004305e0
mov ebx, dword [ebp - 0x1b4]
test ebx, ebx
jne 0x40e7d2
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1b0]
cmp eax, edx
je 0x40e7c4
mov dword [esp], eax
call fcn.004ed8c0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov esi, dword [ebp - 0x1b8]
lea eax, [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
mov eax, esi
add eax, ebx
je 0x40e7f2
test esi, esi
je 0x40ef37
cmp ebx, 0xf
ja 0x40ed12
cmp ebx, 1
lea eax, [ebp - 0x198]
je 0x40ea63
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x19c], ebx
mov byte [eax + ebx], 0
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x19c]
cmp eax, 0xc
jbe 0x40ef79
lea ecx, [ebp - 0x1a0]
mov dword [esp + 4], 0xd
mov dword [esp], str.infoem.inf
call fcn.004cde40
lea eax, [ebp - 0x158]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x168]
je 0x40edd2
mov edi, dword [ebp - 0x1b8]
mov esi, dword [ebp - 0x1b4]
mov dword [ebp - 0x170], ebx
mov eax, edi
add eax, esi
je 0x40e8ac
test edi, edi
je 0x40ef43
cmp esi, 0xf
ja 0x40ea80
cmp esi, 1
je 0x40ec20
test esi, esi
mov eax, ebx
jne 0x40ea9f
mov dword [ebp - 0x16c], esi
mov byte [eax + esi], 0
mov eax, 0x7fffffff
mov esi, dword [ebp - 0x16c]
sub eax, esi
cmp eax, 4
jbe 0x40eee0
mov eax, dword [ebp - 0x170]
mov edx, 0xf
lea edi, [esi + 5]
cmp eax, ebx
cmovne edx, dword [ebp - 0x168]
cmp edi, edx
ja 0x40eac0
add eax, esi
mov dword [eax], 0x666e495c
mov byte [eax + 4], 0x5c
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x16c], edi
mov byte [eax + esi + 5], 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x1bc], eax
mov esi, dword [eax]
add eax, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x40e930
mov esi, edx
mov edi, dword [ebp - 0x16c]
shr esi, 0x10
test edx, 0x8080
cmove edx, esi
lea esi, [eax + 2]
mov ecx, edx
cmove eax, esi
add cl, dl
mov edx, 0x7fffffff
sbb eax, 3
sub eax, dword [ebp - 0x1bc]
sub edx, edi
cmp edx, eax
jb 0x40ee82
mov edx, dword [ebp - 0x170]
mov ecx, 0xf
lea esi, [edi + eax]
cmp edx, ebx
cmovne ecx, dword [ebp - 0x168]
cmp esi, ecx
ja 0x40eaf0
test eax, eax
je 0x40e9c0
add edx, edi
cmp eax, 1
jne 0x40ec30
movzx eax, byte [ebp - 0x12c]
mov byte [edx], al
mov edx, dword [ebp - 0x170]
lea esi, [esi]
mov dword [ebp - 0x16c], esi
mov byte [edx + esi], 0
lea edi, [ebp - 0x180]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x188], edi
cmp eax, ebx
je 0x40ec51
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x188]
mov dword [esp], eax
call fcn.004092c0
cmp eax, 1
mov esi, eax
je 0x40ec90
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
sub esp, 8
test eax, eax
mov esi, eax
je 0x40eb22
mov eax, dword [ebp - 0x188]
cmp eax, edi
je 0x40e88c
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x40e88c
movzx eax, byte [esi]
mov byte [ebp - 0x198], al
lea eax, [ebp - 0x198]
jmp 0x40e820
test esi, esi
js 0x40ef12
lea eax, [esi + 1]
mov dword [esp], eax
call fcn.004ed900
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x168], esi
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x170]
jmp 0x40e8c8
lea ecx, [ebp - 0x170]
mov dword [esp + 0xc], 5
mov dword [esp + 8], str.Inf_
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004ce110
sub esp, 0x10
jmp 0x40e913
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1bc]
lea ecx, [ebp - 0x170]
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.004ce110
sub esp, 0x10
mov edx, dword [ebp - 0x170]
jmp 0x40e9c0
call fcn.0042c430
lea ecx, [ebp - 0x170]
mov edx, 0x6576
mov dword [esp + 0x10], str.IsInstallDriver_find_file_failed
mov dword [esp + 0xc], 0x23d
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], 0x6e497349
mov dword [ebp - 0x164], 0x6c617473
mov dword [ebp - 0x160], 0x6972446c
mov word [ebp - 0x15c], dx
mov byte [ebp - 0x15a], 0x72
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x159], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x170]
cmp eax, ebx
je 0x40ebb1
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x188]
cmp eax, edi
je 0x40ebc3
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x1c0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
test eax, eax
je 0x40ed40
mov eax, dword [ebp - 0x1a0]
lea ebx, [ebp - 0x198]
cmp eax, ebx
je 0x40ebf5
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1b0]
cmp eax, edx
je 0x40e7c6
mov dword [esp], eax
call fcn.004ed8c0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
movzx eax, byte [edi]
mov byte [ebp - 0x168], al
mov eax, ebx
jmp 0x40e8c8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1bc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x170]
jmp 0x40e9c0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x174], eax
jmp 0x40e9f6
call fcn.0042c430
lea ecx, [ebp - 0x170]
mov edx, 0x6576
mov dword [esp + 0x10], str.IsDriverInfFiles_return_true
mov dword [esp + 0xc], 0x237
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], 0x6e497349
mov dword [ebp - 0x164], 0x6c617473
mov dword [ebp - 0x160], 0x6972446c
mov word [ebp - 0x15c], dx
mov byte [ebp - 0x15a], 0x72
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x159], 0
call fcn.0042ce70
jmp 0x40eb9f
test ebx, ebx
js 0x40ef26
lea eax, [ebx + 1]
mov dword [esp], eax
call fcn.004ed900
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x198], ebx
jmp 0x40e80a
call fcn.0042c430
mov edi, dword [ebp - 0x1bc]
mov edx, 0x6576
mov dword [esp + 0x10], str.FindClose_failed
mov dword [esp + 0xc], 0x242
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x170], ebx
mov dword [esp + 8], edi
mov dword [ebp - 0x168], 0x6e497349
mov dword [ebp - 0x164], 0x6c617473
mov dword [ebp - 0x160], 0x6972446c
mov word [ebp - 0x15c], dx
mov byte [ebp - 0x15a], 0x72
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x159], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x170]
cmp eax, ebx
je 0x40ebdd
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x40ebdd
call fcn.0042c430
lea edx, [ebp - 0x170]
lea ebx, [ebp - 0x168]
mov ecx, 0x6576
mov dword [esp + 0x10], str.IsInstallDriver_findHandle_is_INVALID_HANDLE_VALUE
mov dword [esp + 0xc], 0x22e
mov dword [esp + 8], edx
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], 0x6e497349
mov dword [ebp - 0x164], 0x6c617473
mov dword [ebp - 0x160], 0x6972446c
mov word [ebp - 0x15c], cx
mov byte [ebp - 0x15a], 0x72
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x159], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x170]
cmp eax, ebx
je 0x40ee61
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x1a0]
lea ebx, [ebp - 0x198]
cmp eax, ebx
je 0x40e7ac
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x40e7ac
mov dword [esp], 0x4fb61a
call fcn.004e7d10
mov esi, eax
mov eax, dword [ebp - 0x170]
cmp eax, ebx
je 0x40eea2
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x1a0]
lea ebx, [ebp - 0x198]
cmp eax, ebx
je 0x40eeba
mov dword [esp], eax
call fcn.004ed8c0
mov ebx, esi
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1b0]
cmp eax, edx
je 0x40eed4
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call fcn.0043f8d0
lea esi, [esi]
mov dword [esp], 0x4fb61a
call fcn.004e7d10
jmp 0x40ee8e
mov eax, dword [ebp - 0x188]
cmp eax, edi
jne 0x40ee9a
jmp 0x40eea2
mov dword [esp], 0x4fb392
call fcn.004e7d10
mov esi, eax
jmp 0x40ef04
mov dword [esp], 0x4fb392
call fcn.004e7d10
jmp 0x40ee8e
mov dword [esp], 0x4fb368
call fcn.004e7b80
mov dword [esp], 0x4fb368
call fcn.004e7b80
mov esi, eax
jmp 0x40eea2
mov dword [esp], 0x4fb61a
call fcn.004e7d10
nop
lea esi, [esi]
lea edi, [edi]