Function at 0x1003ae50
Capabilities:
Delete directory
Encode data using xor
Enumerate files on windows
Set file attributes

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x1022486b
push eax
mov eax, 0x22c8
mov dword fs:[0], esp
call fcn.102244a0
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.10012770
mov edi, dword [esp + 0x22e8]
mov dword [esp + 0x22e0], 0
push edi
call fcn.1003ad30
add esp, 4
test eax, eax
jne 0x1003aeab
mov dword [esp + 0x22e0], 0xffffffff
jmp 0x1003b67d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x9d8]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x9d8]
or ecx, 0xffffffff
mov byte [esp + 0x9db], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10232584
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x98]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1003af60
mov dword [esp + 0x22e0], 0xffffffff
jmp 0x1003b67d
mov edi, 1
mov esi, 0x10232580
lea ecx, [esp + 0xc4]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x1003af95
test dl, dl
je 0x1003af91
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x1003af95
add ecx, 2
add esi, 2
test dl, dl
jne 0x1003af71
xor ecx, ecx
jmp 0x1003af9a
sbb ecx, ecx
sbb ecx, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test ecx, ecx
je 0x1003b01b
mov esi, 0x1023257c
lea ecx, [esp + 0xc4]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x1003afd4
test dl, dl
je 0x1003afd0
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x1003afd4
add ecx, 2
add esi, 2
test dl, dl
jne 0x1003afb0
xor ecx, ecx
jmp 0x1003afd9
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x1003b01b
mov eax, dword [esp + 0x98]
mov ecx, eax
and ecx, 0x10
cmp cl, 0x10
jne 0x1003b00a
and eax, 2
cmp al, 2
jne 0x1003b00a
cmp byte [esp + 0xc4], 0x7f
jbe 0x1003b00a
mov al, byte [esp + 0xc5]
test al, al
je 0x1003b029
lea edx, [esp + 0x98]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
cmp edi, 1
je 0x1003af65
jmp 0x1003b121
lea edi, [esp + 0x9d8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [0x107ab964]
and ecx, 3
lea eax, [esp + 0x9d8]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5d8]
push eax
push ecx
push edx
call fcn.1002bcc0
lea edi, [esp + 0x9e4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x5d8]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x5dc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
lea ecx, [esp + 0x5d8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x9d8]
push str.Thumbs.db
push edx
lea eax, [esp + 0x1e0]
push str._s_s
push eax
call esi
mov ecx, dword [0x107ab964]
add esp, 0x10
lea eax, [esp + 0x1d8]
mov edx, dword [ecx]
push 0
push eax
call dword [edx]
or edi, 0xffffffff
cmp eax, edi
je 0x1003b18a
lea ecx, [esp + 0x1d8]
push 0x80
push ecx
call ebp
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x1d8]
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
lea ecx, [esp + 0x9d8]
push 0x10232570
push ecx
lea edx, [esp + 0x1e0]
push str._s_s
push edx
call esi
mov ecx, dword [0x107ab964]
add esp, 0x10
lea edx, [esp + 0x1d8]
mov eax, dword [ecx]
push 0
push edx
call dword [eax]
cmp eax, edi
je 0x1003b1e3
lea eax, [esp + 0x1d8]
push 0x80
push eax
call ebp
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x1d8]
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
lea ecx, [esp + 0x9d8]
push str.desktop.ini
push ecx
lea edx, [esp + 0x1e0]
push str._s_s
push edx
call esi
mov ecx, dword [0x107ab964]
add esp, 0x10
lea edx, [esp + 0x1d8]
mov eax, dword [ecx]
push 0
push edx
call dword [eax]
cmp eax, edi
je 0x1003b676
lea eax, [esp + 0x1d8]
push 0x80
push eax
call ebp
mov ecx, dword [0x107ab964]
push 0
lea eax, [esp + 0x1dc]
push 0x8000
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, eax
cmp esi, edi
je 0x1003b676
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ebp, eax
cmp ebp, 0x700
jl 0x1003b66a
cmp ebp, 0x1500
ja 0x1003b66a
mov edx, dword [0x107ab964]
lea eax, [esp + 0x30]
push 1
lea ecx, [esp + 0xddc]
push eax
lea ebx, [ebp - 1]
push ecx
push 0x1500
push ebx
push 1
push ebp
push esi
push edx
call fcn.100253e0
mov ecx, dword [0x107ab964]
add esp, 0x24
mov edi, eax
mov eax, dword [ecx]
push esi
call dword [eax + 0x18]
test edi, edi
je 0x1003af50
cmp dword [esp + 0x30], ebx
jne 0x1003af50
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x38]
push 0x60
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ebp
lea edx, [esp + 0xde0]
push ecx
push edx
call fcn.1003adc0
add esp, 0x10
test eax, eax
jne 0x1003b466
test ebx, ebx
jle 0x1003af50
mov cl, byte [esp + eax + 0xdd8]
mov dl, byte [esp + eax + 0xdd9]
cmp cl, dl
jne 0x1003b31e
inc eax
cmp eax, ebx
jl 0x1003b2f7
mov dword [esp + 0x22e0], 0xffffffff
jmp 0x1003b67d
test eax, eax
mov esi, eax
je 0x1003af50
add eax, 6
cmp eax, ebp
jg 0x1003af50
xor edx, edx
mov dword [esp + 0x10], 0
mov dl, byte [esp + esi + 0xdd8]
mov edi, edx
mov cl, byte [esp + 0x10]
xor dl, dl
mov eax, ecx
xor ebx, ebx
and eax, 0xff
mov byte [esp + 0x2c], dl
xor eax, edi
jmp 0x1003b361
mov ebx, dword [esp + 0x34]
cmp eax, 0x90
je 0x1003b378
inc ebx
inc eax
cmp ebx, 0x100
mov dword [esp + 0x34], ebx
jl 0x1003b35d
jmp 0x1003b37e
mov dl, bl
mov byte [esp + 0x2c], dl
mov al, byte [esp + esi + 0xdd9]
xor al, cl
add al, dl
cmp al, 0xe8
jne 0x1003b3b6
mov al, byte [esp + esi + 0xddc]
xor al, cl
add al, dl
jne 0x1003b3b6
mov al, byte [esp + esi + 0xddd]
xor al, cl
add al, dl
jne 0x1003b3b6
mov al, byte [esp + esi + 0xdde]
xor al, cl
add al, dl
cmp al, 0xc3
je 0x1003b3d6
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x100
mov dword [esp + 0x10], eax
jl 0x1003b346
mov dword [esp + 0x22e0], 0xffffffff
jmp 0x1003b67d
test dl, dl
je 0x1003af50
mov eax, dword [esp + 0x10]
test al, al
je 0x1003af50
and eax, 0xff
cmp eax, 0x100
je 0x1003af50
mov eax, dword [esp + 0x2c]
and eax, 0xff
cmp eax, 0x100
je 0x1003af50
xor esi, esi
test ebp, ebp
jle 0x1003b42d
mov bl, byte [esp + esi + 0xdd8]
mov al, cl
xor al, bl
add al, dl
mov byte [esp + esi + 0xdd8], al
inc esi
cmp esi, ebp
jl 0x1003b414
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x38]
push 0x60
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ebp
lea edx, [esp + 0xde0]
push ecx
push edx
call fcn.1003adc0
add esp, 0x10
test eax, eax
jne 0x1003b466
mov dword [esp + 0x22e0], 0xffffffff
jmp 0x1003b67d
push 1
push 0x16
push str._WuxvwhgLqvwdoohu1hh
lea eax, [esp + 0x44]
push 0x60
push eax
call fcn.10024240
or ebp, 0xffffffff
add esp, 0x14
cmp eax, ebp
jne 0x1003b491
mov dword [esp + 0x22e0], ebp
jmp 0x1003b67d
test eax, eax
mov edx, eax
jle 0x1003b485
mov cl, byte [esp + edx + 0x38]
test cl, cl
je 0x1003b4b0
dec edx
test edx, edx
jg 0x1003b497
mov dword [esp + 0x22e0], ebp
jmp 0x1003b67d
inc edx
sub eax, edx
add eax, 0x16
mov esi, eax
cmp esi, 0x400
jae 0x1003b485
test esi, esi
jl 0x1003b485
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x1d8]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
rep stosd dword es:[edi], eax
mov ecx, esi
lea esi, [esp + edx + 0x38]
mov edx, ecx
lea edi, [esp + 0x1d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x80
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x22ec]
push edi
call ebx
push 0x10227334
lea ecx, [esp + 0x18]
call fcn.100127a0
mov esi, dword [esp + 0x22ec]
test eax, eax
je 0x1003b54e
mov eax, dword [0x107ab964]
push 0
push 0
push edi
push 0x13a2
push esi
push str.Trojan.Agent.WL
push 6
push 0x37e
push 0x28
push eax
lea ecx, [esp + 0x3c]
call fcn.10012b00
lea ecx, [esp + 0x14]
call fcn.10013450
push 0x80
push edi
call ebx
mov ecx, dword [0x107ab964]
push edi
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov ecx, dword [0x107ab964]
lea edx, [esp + 0x1d8]
push 0
push edx
mov eax, dword [ecx]
call dword [eax]
cmp eax, ebp
je 0x1003b5f6
lea eax, [esp + 0x1d8]
push 0x80
push eax
call ebx
push 0x10227334
lea ecx, [esp + 0x18]
call fcn.100127a0
test eax, eax
je 0x1003b5d4
mov edx, dword [0x107ab964]
push 0
lea ecx, [esp + 0x1dc]
push 0
push ecx
push 0x13a3
push esi
push str.Worm.Gamarue.B
push 6
push 0x37e
push 0x28
push edx
lea ecx, [esp + 0x3c]
call fcn.10012b00
lea ecx, [esp + 0x14]
call fcn.10013450
lea eax, [esp + 0x1d8]
push 0x80
push eax
call ebx
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x1d8]
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
lea ecx, [esp + 0x9d8]
push str.desktop.ini
push ecx
lea edx, [esp + 0x1e0]
push str._s_s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [0x107ab964]
add esp, 0x10
lea edx, [esp + 0x1d8]
mov eax, dword [ecx]
push 0
push edx
call dword [eax]
cmp eax, ebp
je 0x1003b653
lea eax, [esp + 0x1d8]
push 0x80
push eax
call ebx
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x1d8]
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x22e0], ebp
call fcn.10012790
mov eax, 1
jmp 0x1003b688
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x18]
mov dword [esp + 0x22e0], edi
lea ecx, [esp + 0x14]
call fcn.10012790
xor eax, eax
mov ecx, dword [esp + 0x22d8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x22d4
ret