Function at 0x434e40
Capabilities:
Enumerate files on windows
Enumerate files recursively
Map section object

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push esi
push edi
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x828
lea eax, [ebp - 0x4c]
push eax
call fcn.00403940
push 0x820
lea eax, [ebp - 0x50]
push eax
call fcn.00403940
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
call sub.ntdll.dll_NtOpenDirectoryObject
or eax, eax
jne 0x435150
mov esi, 0x1000
push esi
lea eax, [ebp - 8]
push eax
call fcn.00403940
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push esi
push dword [ebp - 8]
push dword [ebp - 0x20]
call sub.ntdll.dll_NtQueryDirectoryObject
cmp eax, 0x105
je 0x434edf
cmp eax, 0xc0000023
jne 0x434ef7
push dword [ebp - 8]
call fcn.0040398e
add esi, esi
and dword [ebp - 4], 0
cmp esi, 0x100000
jb 0x434eaf
jmp 0x434f0d
cmp eax, 0x8000001a
je 0x435148
cmp eax, 0xc0000022
je 0x435148
cmp dword [ebp - 4], 0
je 0x435148
mov esi, dword [ebp - 8]
jmp 0x43513e
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
cmp eax, 0x690044
jne 0x434f8e
cmp edx, 0x650072
jne 0x434f8e
cmp dword [ecx + 8], 0x740063
jne 0x434f8e
cmp dword [ecx + 0xc], 0x72006f
jne 0x434f8e
cmp dword [ecx + 0x10], 0x79
jne 0x434f8e
movzx eax, word [esi]
mov ebx, eax
mov edx, dword [ebp + 0xc]
add ebx, edx
add edx, dword [ebp + 8]
cmp word [edx - 2], 0x5c
je 0x434f6d
mov word [edx], 0x5c
add edx, 2
add ebx, 2
mov word [eax + edx], 0
push eax
push dword [esi + 4]
push edx
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.00434e40
jmp 0x43513b
cmp eax, 0x650053
jne 0x43513b
cmp edx, 0x740063
jne 0x43513b
cmp dword [ecx + 8], 0x6f0069
jne 0x43513b
cmp dword [ecx + 0xc], 0x6e
jne 0x43513b
lea eax, [esi]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 5
lea eax, [ebp - 0x34]
push eax
call sub.ntdll.dll_NtOpenSection
or eax, eax
jne 0x43513b
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x34]
call sub.ntdll.dll_NtQuerySection
or eax, eax
jne 0x435133
test dword [ebp - 0x40], 0x1000000
je 0x435133
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ebx
push 2
push 0
push 2
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x34]
call sub.ntdll.dll_NtMapViewOfSection
or eax, eax
je 0x435032
cmp eax, 0x40000003
jne 0x43506e
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x828
push dword [ebp - 0x4c]
push 2
push dword [ebp - 0x48]
push 0xffffffffffffffff
call sub.ntdll.dll_NtQueryVirtualMemory
or eax, eax
jne 0x435064
push 0x820
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
call fcn.004069f9
mov ebx, eax
push dword [ebp - 0x48]
push 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
xor ecx, ecx
cmp ecx, dword [ebp - 4]
je 0x435085
or ebx, ebx
cmovne ecx, ebx
jne 0x435085
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
add ecx, 2
movzx eax, word [esi]
add eax, ecx
add eax, dword [ebp + 0xc]
add eax, 0x1c
push eax
push 0
call fcn.00403940
push eax
push dword [ebp + 0x10]
call fcn.00403460
mov edi, eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [edi], eax
mov dword [edi + 4], edx
movzx eax, word [esi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add edx, ecx
cmp word [edx - 2], 0x5c
je 0x4350cb
mov word [edx], 0x5c
add edx, 2
add ecx, 2
add ecx, eax
add ecx, 2
mov dword [edi + 8], ecx
mov word [eax + edx], 0
push eax
push dword [esi + 4]
push edx
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, edi
add eax, 0x18
mov dword [edi + 0xc], eax
push dword [edi + 8]
push dword [ebp + 8]
push eax
call sub.KERNEL32.dll_RtlMoveMemory
cmp dword [ebp - 4], 0
je 0x435133
mov edx, edi
add edx, 0x18
add edx, dword [edi + 8]
mov dword [edi + 0x14], edx
or ebx, ebx
je 0x43511d
mov dword [edi + 0x10], ebx
push ebx
push dword [ebp - 0x50]
push dword [edi + 0x14]
call sub.KERNEL32.dll_RtlMoveMemory
jmp 0x435133
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
add ecx, 2
mov dword [edi + 0x10], ecx
push ecx
push dword [eax + 4]
push edx
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp - 0x34]
call sub.ntdll.dll_NtClose
add esi, 0x10
cmp dword [esi + 4], 0
jne 0x434f1f
push dword [ebp - 0x20]
call sub.ntdll.dll_NtClose
cmp dword [ebp - 8], 0
je 0x43515e
push dword [ebp - 8]
call fcn.0040398e
push dword [ebp - 0x4c]
call fcn.0040398e
push dword [ebp - 0x50]
call fcn.0040398e
pop ebx
pop edi
pop esi
leave
ret 0xc