Function at 0x10013a80
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100176fc
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x1001c060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x214], ecx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x174]
call fcn.10001e20
mov dword [ebp - 4], 0
push str.drivers.
lea ecx, [ebp - 0x174]
call fcn.10001020
mov dword [ebp - 0x158], 0
push 0x1001a064
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f758], eax
cmp dword [0x1001f758], 0
jne 0x10013b33
mov cl, byte [ebp - 0xd]
mov byte [ebp - 0x1e9], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001680
mov al, byte [ebp - 0x1e9]
jmp 0x10013f18
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x174]
call fcn.10001e90
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffff
jne 0x10013b84
mov byte [ebp - 0x1ea], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001680
mov al, byte [ebp - 0x1ea]
jmp 0x10013f18
mov byte [ebp - 0x1a8], 0x79
mov byte [ebp - 0x1ae], 0x6c
mov byte [ebp - 0x1ab], 0x68
mov byte [ebp - 0x1aa], 0x2e
mov byte [ebp - 0x1a7], 0x73
mov byte [ebp - 0x1b0], 0x70
mov byte [ebp - 0x1af], 0x72
mov byte [ebp - 0x1a9], 0x73
mov byte [ebp - 0x1ad], 0x65
mov byte [ebp - 0x1ac], 0x74
mov byte [ebp - 0x1a6], 0
mov byte [ebp - 0x1c6], 0x73
mov byte [ebp - 0x1c3], 0
mov byte [ebp - 0x1c5], 0x79
mov byte [ebp - 0x1c4], 0x73
mov byte [ebp - 0x1cb], 0x72
mov byte [ebp - 0x1c8], 0x73
mov byte [ebp - 0x1c9], 0x66
mov byte [ebp - 0x1c7], 0x2e
mov byte [ebp - 0x1ca], 0x6c
mov byte [ebp - 0x1cc], 0x70
mov byte [ebp - 0x1bd], 0x6d
mov byte [ebp - 0x1ba], 0x73
mov byte [ebp - 0x1c0], 0x70
mov byte [ebp - 0x1b7], 0x73
mov byte [ebp - 0x1be], 0x6c
mov byte [ebp - 0x1bc], 0x6f
mov byte [ebp - 0x1b8], 0x2e
mov byte [ebp - 0x1b9], 0x65
mov byte [ebp - 0x1b5], 0x73
mov byte [ebp - 0x1bf], 0x72
mov byte [ebp - 0x1b4], 0
mov byte [ebp - 0x1bb], 0x75
mov byte [ebp - 0x1b6], 0x79
mov byte [ebp - 0x199], 0x73
mov byte [ebp - 0x1a1], 0x5f
mov byte [ebp - 0x19e], 0x33
mov byte [ebp - 0x1a3], 0x72
mov byte [ebp - 0x1a4], 0x70
mov byte [ebp - 0x1a0], 0x70
mov byte [ebp - 0x198], 0
mov byte [ebp - 0x19f], 0x76
mov byte [ebp - 0x19a], 0x79
mov byte [ebp - 0x19b], 0x73
mov byte [ebp - 0x1a2], 0x6c
mov byte [ebp - 0x19c], 0x2e
mov byte [ebp - 0x19d], 0x32
mov byte [ebp - 0x193], 0x72
mov byte [ebp - 0x18f], 0x64
mov byte [ebp - 0x188], 0
mov byte [ebp - 0x190], 0x69
mov byte [ebp - 0x18c], 0x2e
mov byte [ebp - 0x192], 0x6c
mov byte [ebp - 0x18a], 0x79
mov byte [ebp - 0x194], 0x70
mov byte [ebp - 0x18b], 0x73
mov byte [ebp - 0x18e], 0x65
mov byte [ebp - 0x189], 0x73
mov byte [ebp - 0x18d], 0x6f
mov byte [ebp - 0x191], 0x76
mov byte [ebp - 0x17d], 0x73
mov byte [ebp - 0x182], 0x63
mov byte [ebp - 0x183], 0x70
mov byte [ebp - 0x184], 0x76
mov byte [ebp - 0x17b], 0x73
mov byte [ebp - 0x180], 0x73
mov byte [ebp - 0x17a], 0
mov byte [ebp - 0x17e], 0x2e
mov byte [ebp - 0x181], 0x2d
mov byte [ebp - 0x17f], 0x33
mov byte [ebp - 0x17c], 0x79
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10013ec2
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x1e8]
call fcn.10001e20
mov byte [ebp - 4], 1
push fcn.1000646f
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10003600
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1fc]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10003630
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10003600
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.100036e0
add esp, 0x20
push 0
lea ecx, [ebp - 0x1b0]
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.10003590
test eax, eax
jne 0x10013e22
mov byte [ebp - 0xd], 1
push 0
lea edx, [ebp - 0x1cc]
push edx
lea ecx, [ebp - 0x1e8]
call fcn.10003590
test eax, eax
jne 0x10013e3e
mov byte [ebp - 0xd], 1
push 0
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10003590
test eax, eax
jne 0x10013e5a
mov byte [ebp - 0xd], 1
push 0
lea ecx, [ebp - 0x194]
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.10003590
test eax, eax
jne 0x10013e76
mov byte [ebp - 0xd], 1
push 0
lea edx, [ebp - 0x1a4]
push edx
lea ecx, [ebp - 0x1e8]
call fcn.10003590
test eax, eax
jne 0x10013e92
mov byte [ebp - 0xd], 1
push 0
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10003590
test eax, eax
jne 0x10013eae
mov byte [ebp - 0xd], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1e8]
call fcn.10001680
jmp 0x10013d75
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
movzx edx, byte [ebp - 0xd]
cmp edx, 1
jne 0x10013ef9
mov byte [ebp - 0x20d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001680
mov al, byte [ebp - 0x20d]
jmp 0x10013f18
mov byte [ebp - 0x20e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001680
mov al, byte [ebp - 0x20e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10003f16
mov esp, ebp
pop ebp
ret