Function at 0x401000
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x150]
mov dword [ebp - 0xc], 0x2a2f3a43
push eax
lea eax, [ebp - 0xc]
mov byte [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40106d
push 0x401790
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.error____0xC000005
call fcn.00401570
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c4c
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.VCRUNTIME140.dll_strstr]
xor esi, esi
nop word [eax + eax]
push 0x401790
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x124]
call fcn.00401570
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, str.Boot
lea eax, [ebp - 0x124]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4010d0
test dl, dl
je 0x4010cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4010d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4010b0
xor eax, eax
jmp 0x4010d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.BOOTNXT
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401108
test dl, dl
je 0x401104
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401108
add eax, 2
add ecx, 2
test dl, dl
jne 0x4010e8
xor eax, eax
jmp 0x40110d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.autoexec.bat
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401140
test dl, dl
je 0x40113c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401140
add eax, 2
add ecx, 2
test dl, dl
jne 0x401120
xor eax, eax
jmp 0x401145
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.Python27
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401178
test dl, dl
je 0x401174
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401178
add eax, 2
add ecx, 2
test dl, dl
jne 0x401158
xor eax, eax
jmp 0x40117d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.admin_data
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4011b0
test dl, dl
je 0x4011ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4011b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401190
xor eax, eax
jmp 0x4011b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
lea eax, [ebp - 0x124]
push str.found
push eax
call edi
add esp, 8
test eax, eax
jne 0x40138a
lea eax, [ebp - 0x124]
push str.boot
push eax
call edi
add esp, 8
test eax, eax
jne 0x40138a
mov ecx, str.config.sys
lea eax, [ebp - 0x124]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401220
test dl, dl
je 0x40121c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401220
add eax, 2
add ecx, 2
test dl, dl
jne 0x401200
xor eax, eax
jmp 0x401225
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.mydownload
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401258
test dl, dl
je 0x401254
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401258
add eax, 2
add ecx, 2
test dl, dl
jne 0x401238
xor eax, eax
jmp 0x40125d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.event_stream.dll
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401290
test dl, dl
je 0x40128c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401290
add eax, 2
add ecx, 2
test dl, dl
jne 0x401270
xor eax, eax
jmp 0x401295
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.ps.xml
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4012c8
test dl, dl
je 0x4012c4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4012c8
add eax, 2
add ecx, 2
test dl, dl
jne 0x4012a8
xor eax, eax
jmp 0x4012cd
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.sysmon.xml
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401300
test dl, dl
je 0x4012fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401300
add eax, 2
add ecx, 2
test dl, dl
jne 0x4012e0
xor eax, eax
jmp 0x401305
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
mov ecx, str.security.xml
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401338
test dl, dl
je 0x401334
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401338
add eax, 2
add ecx, 2
test dl, dl
jne 0x401318
xor eax, eax
jmp 0x40133d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138a
lea eax, [ebp - 0x124]
push str..log.
push eax
call edi
add esp, 8
test eax, eax
jne 0x40138a
mov ecx, str.startup.bat
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401381
test dl, dl
je 0x40137d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401381
add eax, 2
add ecx, 2
test dl, dl
jne 0x401361
xor eax, eax
jmp 0x401386
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40138b
inc esi
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401080
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
setg al
xor ecx, ebp
pop esi
pop ebx
call fcn.00401c4c
mov esp, ebp
pop ebp
ret