Function at 0x4581d0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Delete file
Enumerate files on windows
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20cc4
call fcn.004b5cc0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
lea eax, [esp + 0xccc]
push edi
push 0
push eax
mov edi, ecx
mov ebx, edx
push 0x8000
push edi
call esi
lea ecx, [esp + 0xcd0]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458210
sub ecx, edx
sar ecx, 1
je 0x458236
cmp word [esp + ecx*2 + 0xcce], 0x5c
jne 0x458236
xor eax, eax
mov word [esp + ecx*2 + 0xcce], ax
push 0
lea eax, [esp + 0x10cd4]
push eax
push 0x8000
push ebx
call esi
lea ecx, [esp + 0x10cd0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458252
sub ecx, edx
sar ecx, 1
je 0x458278
cmp word [esp + ecx*2 + 0x10cce], 0x5c
jne 0x458278
xor eax, eax
mov word [esp + ecx*2 + 0x10cce], ax
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
lea eax, [esp + 0xcd0]
push eax
call esi
cmp eax, 0xffffffff
je 0x4582c5
test al, 0x10
je 0x4582c5
lea ecx, [esp + 0xcd0]
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4582a0
mov eax, dword [0x4d9fb0]
mov dword [ecx], eax
mov eax, dword [0x4d9fb4]
mov dword [ecx + 4], eax
mov ax, word [0x4d9fb8]
mov word [ecx + 8], ax
lea eax, [esp + 0x10cd0]
push eax
call esi
cmp eax, 0xffffffff
je 0x458307
test al, 0x10
je 0x458307
lea ecx, [esp + 0x10cd0]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4582e2
mov eax, dword [0x4d9fb0]
mov dword [ecx], eax
mov eax, dword [0x4d9fb4]
mov dword [ecx + 4], eax
mov ax, word [0x4d9fb8]
mov word [ecx + 8], ax
lea eax, [esp + 0x450]
push eax
lea eax, [esp + 0xcd4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x458381
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test edi, edi
je 0x458371
movzx eax, word [edi]
test ax, ax
je 0x458371
mov esi, eax
nop
mov eax, 0x4d4e30
mov edx, 0x3f
nop word [eax + eax]
cmp si, dx
je 0x458373
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x458350
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x458340
xor edi, edi
xor eax, eax
test edi, edi
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0xcd0]
push 0x5c
push eax
mov dword [esi], 0
call fcn.0049ce8e
push 0x5c
lea ebx, [eax + 2]
lea eax, [esp + 0x10cdc]
mov dword [esp + 0x24], ebx
push eax
call fcn.0049ce8e
mov ecx, ebx
push 0x103
lea edi, [eax + 2]
lea eax, [esp + 0xce4]
mov dword [esp + 0x20], edi
sub ecx, eax
mov eax, 0x7fff
sar ecx, 1
sub eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x25c]
push edi
push eax
call fcn.004aa9a4
xor eax, eax
add esp, 0x1c
mov word [esp + 0x44e], ax
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x4e4788]
sub eax, dword [0x4ea5ac]
cmp eax, dword [ecx + 0x5c]
jbe 0x458436
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x45842b
mov edx, 1
or ecx, 0xffffffff
call fcn.004015e0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4ea5ac], eax
test byte [esp + 0x450], 0x10
jne 0x45863c
lea ecx, [esp + 0x47c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458450
sub ecx, edx
sar ecx, 1
cmp ecx, dword [esp + 0x14]
jbe 0x458470
mov dword [esi], 0x6f
jmp 0x45863b
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x47c]
mov eax, ecx
sub edx, eax
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x458480
lea eax, [esp + 0x248]
push 0x2a
push eax
call fcn.0049cf2f
add esp, 8
test eax, eax
jne 0x4584c8
lea ecx, [esp + 0x248]
mov edx, edi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4584b3
jmp 0x4585c2
lea eax, [esp + 0x6a0]
push eax
lea eax, [esp + 0xac4]
push eax
push 0
lea eax, [esp + 0x488]
push 0
push eax
call fcn.004aa80c
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x8c8]
push eax
push 0
lea eax, [esp + 0x268]
push 0
push eax
call fcn.004aa80c
add esp, 0x28
cmp word [esp + 0x6a0], 0x2e
jne 0x45852f
lea ecx, [esp + 0x6a2]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx - 4], ax
test ax, ax
jne 0x458520
cmp word [esp + 0x38], 0x2e
jne 0x45854f
lea ecx, [esp + 0x3a]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx - 4], ax
test ax, ax
jne 0x458540
push edi
lea edx, [esp + 0x8b4]
lea ecx, [esp + 0xac4]
call fcn.00458670
add esp, 4
cmp word [esp + 0x6a0], 0
jne 0x458579
cmp word [esp + 0x38], 0
je 0x4585c2
push 0
push edi
call fcn.0049cf2f
add esp, 8
mov edi, eax
cmp word [esp + 0x38], 0
jne 0x458596
mov dword [esp + 0x38], 0x2a
lea esi, [edi + 2]
push esi
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x6a4]
call fcn.00458670
add esp, 4
cmp word [esi], 0
mov esi, dword [ebp + 0x10]
je 0x4585be
mov eax, 0x2e
mov word [edi], ax
mov edi, dword [esp + 0xc]
cmp byte [ebp + 0xc], 0
je 0x458611
lea eax, [esp + 0x10cd0]
push eax
lea eax, [esp + 0xcd4]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x45863c
cmp byte [ebp + 8], al
je 0x458633
lea eax, [esp + 0x10cd0]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x458633
lea eax, [esp + 0x10cd0]
push eax
lea eax, [esp + 0xcd4]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x45862f
movzx eax, byte [ebp + 8]
xor eax, 1
push eax
lea eax, [esp + 0x10cd4]
push eax
lea eax, [esp + 0xcd8]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
jne 0x45863c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi], eax
inc ebx
lea eax, [esp + 0x450]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4583f0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret