Function at 0x10038910
Capabilities:
Encode data using xor
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x1008b38a
call fcn.1008a92c
sub esp, 0x378
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
jne 0x10038986
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x30]
cmp esi, edi
je 0x1003894a
mov ecx, esi
call fcn.10006f19
add esi, 0x18
cmp esi, edi
jne 0x10038936
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x30], eax
push 0x100e24f0
mov esi, 0x100e23e8
push esi
call dword [sym.imp.msvcrt.dll_strcpy]
mov byte [ebp + 9], 0x68
mov byte [ebp + 0xa], 0x36
mov byte [ebp + 0xb], 0
mov al, byte [ebp + 9]
pop ecx
pop ecx
xor eax, eax
sub byte [ebp + eax + 9], 0xc
inc eax
cmp eax, 2
jb 0x1003896e
lea eax, [ebp + 9]
push eax
push esi
call dword [sym.imp.msvcrt.dll_strcat]
pop ecx
pop ecx
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10038bb8
test byte [ebp - 0x280], 0x10
je 0x10038a44
lea eax, [ebp - 0x254]
push 0x100a1ff4
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x10038b9b
lea eax, [ebp - 0x254]
push 0x100a1ff0
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x10038b9b
lea eax, [ebp - 0x384]
push esi
push eax
call dword [sym.imp.msvcrt.dll_strcpy]
lea eax, [ebp - 0x384]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strrchr]
mov byte [eax + 1], 0
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x384]
push eax
call dword [sym.imp.msvcrt.dll_strcat]
lea eax, [ebp - 0x384]
push 0x100a1fe4
push eax
call dword [sym.imp.msvcrt.dll_strcat]
add esp, 0x20
lea eax, [ebp - 0x384]
mov ecx, ebx
push eax
call fcn.10038910
jmp 0x10038b9b
test byte [ebp - 0x280], 0x20
je 0x10038b9b
push 0x100e24f0
call dword [sym.imp.msvcrt.dll_strlen]
pop ecx
cmp byte [eax + esi + 1], 0x2a
je 0x10038a9c
push 0x100e24f0
call dword [sym.imp.msvcrt.dll_strlen]
inc eax
add eax, esi
push eax
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.msvcrt.dll_strcpy]
lea eax, [ebp - 0x140]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strrchr]
add esp, 0x14
test eax, eax
je 0x10038aa3
mov byte [eax + 1], 0
jmp 0x10038aa3
mov byte [ebp - 0x140], 0
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.msvcrt.dll_strcat]
lea eax, [ebp - 0x140]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strchr]
add esp, 0x10
jmp 0x10038adf
mov byte [eax], 0x2f
lea eax, [ebp - 0x140]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
jne 0x10038acb
mov dword [ebp - 0x20], 0x70
xor edx, edx
mov byte [ebp - 0x1c], 5
mov byte [ebp - 0x1b], 3
mov byte [ebp - 0x1a], 0x15
mov byte [ebp - 0x19], 2
mov byte [ebp - 0x18], 0x2f
mov byte [ebp - 0x17], 3
mov byte [ebp - 0x16], 4
mov byte [ebp - 0x15], 0x11
mov byte [ebp - 0x14], 4
mov byte [ebp - 0x13], 3
mov byte [ebp - 0x12], 0x5e
mov byte [ebp - 0x11], 0x19
mov byte [ebp - 0x10], 0x1e
mov byte [ebp - 0xf], 0x19
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x1c]
mov al, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x20]
xor cl, al
mov byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 0xe
jb 0x10038b2a
lea eax, [ebp - 0x1c]
mov byte [ebp - 0xe], 0
push eax
lea eax, [ebp - 0x140]
push eax
call sub.msvcrt.dll__stricmp
pop ecx
pop ecx
test eax, eax
je 0x10038b9b
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x3c]
call fcn.10006b70
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
mov eax, dword [ebx + 0x30]
push ecx
cmp eax, dword [ebx + 0x34]
je 0x10038b83
mov ecx, eax
call fcn.10006b49
add dword [ebx + 0x30], 0x18
jmp 0x10038b8c
push eax
lea ecx, [ebx + 0x2c]
call fcn.10039be1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10006f19
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x280]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100389a2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4