Function at 0x402a70
Capabilities:
Enumerate files on windows
Terminate process

Disassembly:
sub esp, 0x154
mov eax, dword [esp + 0x15c]
mov edx, dword [esp + 0x158]
push ebx
push ebp
mov ecx, dword [eax]
push esi
push edi
push 0x403080
push 0x40a434
push 0x40a424
push 0x40a408
xor esi, esi
push eax
push edx
xor ebx, ebx
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x28], esi
mov dword [0x40b614], ecx
call fcn.00401de0
mov eax, dword [esp + 0x184]
mov ecx, dword [esp + 0x180]
push ebp
push 0x409138
push 0x40a404
push eax
push ecx
call fcn.00401db0
add esp, 0x2c
cmp eax, 0xffffffff
je 0x402bde
cmp eax, 0x77
ja case.0x402af0.6
xor edx, edx
mov dl, byte [eax + 0x403008]
jmp dword [edx*4 + 0x402fec]
test edi, edi
jne 0x402b14
mov eax, dword [esp + 0x168]
lea ecx, [eax*4 - 4]
push ecx
call fcn.00403670
add esp, 4
mov edi, eax
mov eax, dword [0x40b43c]
test eax, eax
jne 0x402b27
mov eax, 0x40b444
mov dword [0x40b43c], eax
mov dword [edi + ebp*4], eax
inc ebp
jmp case.0x402af0.0
mov esi, 1
jmp case.0x402af0.0
mov ebx, 1
jmp case.0x402af0.0
mov dword [0x40b44c], 1
mov dword [0x40b450], 0
jmp case.0x402af0.0
mov dword [0x40b44c], 0
mov dword [0x40b450], 1
jmp case.0x402af0.0
push 1
call 0x403080
add esp, 4
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
push 0
push 0x409138
push 0x40a404
push edx
push eax
call fcn.00401db0
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402ae3
test esi, esi
je 0x402bbe
test ebx, ebx
je 0x402bbe
push 0x40a3c8
push 0
push 0
call section..text
push 1
call 0x403080
add esp, 0x10
test ebp, ebp
jbe 0x402bde
test ebx, ebx
je 0x402bde
push 0x40a390
push 0
push 0
call section..text
push 1
call 0x403080
add esp, 0x10
mov eax, dword [0x40b44c]
test eax, eax
je 0x402c01
test ebx, ebx
jne 0x402c01
push 0x40a350
push ebx
push ebx
call section..text
push 1
call 0x403080
add esp, 0x10
mov eax, dword [0x40b450]
test eax, eax
je 0x402c24
test ebx, ebx
jne 0x402c24
push 0x40a310
push ebx
push ebx
call section..text
push 1
call 0x403080
add esp, 0x10
test ebp, ebp
jbe 0x402cb2
mov ecx, dword [esp + 0x168]
mov eax, dword [0x40a058]
cmp eax, ecx
jge 0x402c54
push 0x40a2e0
push 0
push 0
call section..text
push 1
call 0x403080
add esp, 0x10
test ebp, ebp
jbe 0x402f7d
mov ebx, edi
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00402010
add esp, 0xc
xor esi, esi
xor ecx, ecx
mov cl, byte [esp + esi + 0x14]
push ecx
push 0x40a2d8
call fcn.00403e05
add esp, 8
inc esi
cmp esi, 0x10
jb 0x402c7d
mov edx, dword [ebx]
push edx
push 0x40a2d0
call fcn.00403e05
add esp, 8
add ebx, 4
dec ebp
jne 0x402c5e
jmp 0x402f7d
mov eax, dword [0x40a058]
test ebx, ebx
je 0x402d1d
mov esi, dword [esp + 0x168]
lea ecx, [eax + 1]
cmp ecx, esi
jge 0x402ce6
push 0x40a298
push 0
push 0
call section..text
push 1
call 0x403080
mov eax, dword [0x40a058]
add esp, 0x10
cmp eax, esi
jne 0x402d01
mov eax, 0x40a294
push eax
call fcn.004031c0
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x402f7d
mov edx, dword [esp + 0x16c]
mov eax, dword [edx + eax*4]
push eax
call fcn.004031c0
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x402f7d
mov edi, dword [esp + 0x168]
mov ebp, dword [esp + 0x16c]
cmp eax, edi
jne 0x402d44
mov dword [ebp + edi*4], 0x40a294
mov eax, dword [0x40a058]
inc edi
mov dword [esp + 0x168], edi
cmp eax, edi
jge 0x402f7d
mov esi, dword [ebp + eax*4]
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402f4e
lea ecx, [esp + 0x14]
mov eax, 1
push ecx
lea edx, [esp + 0x54]
push eax
push edx
call fcn.004030d0
mov edx, dword [esp + 0x1c]
add esp, 0xc
or edx, eax
test eax, eax
mov dword [esp + 0x10], edx
jne 0x402f39
lea eax, [esp + 0x50]
push 0xa
push eax
call fcn.00404000
add esp, 8
test eax, eax
je 0x402dd6
mov eax, dword [0x40ab1c]
dec eax
mov dword [0x40ab1c], eax
js 0x402dc7
mov ecx, dword [0x40ab18]
mov byte [ecx], 0x5c
mov eax, dword [0x40ab18]
inc eax
mov dword [0x40ab18], eax
jmp 0x402dd6
push 0x40ab18
push 0x5c
call fcn.004037d2
add esp, 8
xor esi, esi
xor edx, edx
mov dl, byte [esp + esi + 0x14]
push edx
push 0x40a2d8
call fcn.00403e05
add esp, 8
inc esi
cmp esi, 0x10
jb 0x402dd8
mov eax, dword [0x40ab1c]
dec eax
mov dword [0x40ab1c], eax
js 0x402e14
mov eax, dword [0x40ab18]
mov byte [eax], 0x20
mov eax, dword [0x40ab18]
inc eax
mov dword [0x40ab18], eax
jmp 0x402e23
push 0x40ab18
push 0x20
call fcn.004037d2
add esp, 8
mov eax, 1
test eax, eax
mov eax, dword [0x40ab1c]
je 0x402e58
dec eax
mov dword [0x40ab1c], eax
js 0x402e4f
mov ecx, dword [0x40ab18]
mov byte [ecx], 0x2a
mov eax, dword [0x40ab18]
inc eax
mov dword [0x40ab18], eax
jmp 0x402e85
push 0x40ab18
push 0x2a
jmp 0x402e7d
dec eax
mov dword [0x40ab1c], eax
js 0x402e76
mov edx, dword [0x40ab18]
mov byte [edx], 0x20
mov eax, dword [0x40ab18]
inc eax
mov dword [0x40ab18], eax
jmp 0x402e85
push 0x40ab18
push 0x20
call fcn.004037d2
add esp, 8
lea edi, [esp + 0x50]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402f08
mov al, byte [esp + esi + 0x50]
cmp al, 0xa
je 0x402ee3
cmp al, 0x5c
je 0x402ed7
mov ecx, dword [0x40ab1c]
dec ecx
mov dword [0x40ab1c], ecx
js 0x402ec7
mov ecx, dword [0x40ab18]
mov byte [ecx], al
mov eax, dword [0x40ab18]
inc eax
mov dword [0x40ab18], eax
jmp 0x402ef5
movsx edx, al
push 0x40ab18
push edx
call fcn.004037d2
jmp 0x402ef2
push 0x40ab18
push 0x40a290
jmp 0x402eed
push 0x40ab18
push 0x40a28c
call fcn.00403fa5
add esp, 8
lea edi, [esp + 0x50]
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x402e97
mov eax, dword [0x40ab1c]
dec eax
mov dword [0x40ab1c], eax
js 0x402f2a
mov eax, dword [0x40ab18]
mov byte [eax], 0xa
mov eax, dword [0x40ab18]
inc eax
mov dword [0x40ab18], eax
jmp 0x402f39
push 0x40ab18
push 0xa
call fcn.004037d2
add esp, 8
lea ecx, [esp + 0x24]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402f63
jmp 0x402d67
push esi
push 0x40a278
push 0x40ab38
call fcn.004038e7
add esp, 0xc
jmp 0x402f6a
mov edi, dword [esp + 0x168]
mov eax, dword [0x40a058]
inc eax
cmp eax, edi
mov dword [0x40a058], eax
jl 0x402d4c
push 0x40ab18
call fcn.00403f4f
add esp, 4
cmp eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
jne 0x402fa9
mov edx, dword [0x40b454]
push 0x40a26c
push edx
push 1
call section..text
add esp, 0xc
mov eax, dword [0x40b448]
test eax, eax
je 0x402fd9
push 0x40aaf8
call fcn.00403f4f
add esp, 4
cmp eax, 0xffffffff
jne 0x402fd9
mov eax, dword [0x40b454]
push 0x40a25c
push eax
push 1
call section..text
add esp, 0xc
mov edx, dword [esp]
xor ecx, ecx
test edx, edx
setne cl
push ecx
call fcn.004036fd
mov edi, edi
jno 0x403019
inc eax
add bh, dh
sub al, byte [eax]
cmp ebp, dword [ebx]
inc eax
add byte [0x3400402b], ch
sub eax, dword [eax]
push ecx
sub eax, dword [eax]
sub eax, dword [bx + si]
add byte [ecx], al
add al, byte [esi]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add eax, dword [esi + eax]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add eax, 0x40b614a1
add byte [esi - 0x75], dl
je 0x4030ad
or byte [eax - 0x7b], dl
div byte [esp + edx + 0x68]
test byte [ecx + 0x38680040], ch
stosd dword es:[edi], eax
inc eax
add al, ch
dec ecx
or byte [eax], al
add byte [ebx + 0x19eb0cc4], al
push eax
push eax
push 0x40a460
call fcn.00403e05
add byte [eax], al
push 0x40a43c
call fcn.004040bc
add esp, 0x14
xor ecx, ecx
test esi, esi
setne cl
push ecx
call fcn.004036fd
pop esi
nop
nop
nop
nop
nop
nop