Function at 0x410aa0
Capabilities:
Enumerate files on windows
Get common file path
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5954b7
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x616738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x298], 0
call fcn.0049aaf0
test eax, eax
je 0x410b3f
call fcn.00499760
cmp eax, 5
jge 0x410b3f
push 0x5a36b4
lea eax, [ebp - 0x284]
push eax
call fcn.00499350
add esp, 4
mov dword [ebp - 0x29c], eax
mov ecx, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x298]
or edx, 1
mov dword [ebp - 0x298], edx
mov ecx, dword [ebp - 0x2a0]
call fcn.00407fe0
test eax, eax
jne 0x410b3f
mov dword [ebp - 0x2a4], 1
jmp 0x410b49
mov dword [ebp - 0x2a4], 0
mov al, byte [ebp - 0x2a4]
mov byte [ebp - 0x27d], al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x298]
and ecx, 1
je 0x410b79
and dword [ebp - 0x298], 0xfffffffe
lea ecx, [ebp - 0x284]
call fcn.00408330
movzx edx, byte [ebp - 0x27d]
test edx, edx
je 0x410e5a
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.0056f420
add esp, 0xc
lea ecx, [ebp - 0x11c]
push ecx
push 1
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x410e5a
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x268]
call fcn.00408ff0
mov dword [ebp - 4], 1
push 0x5a36bc
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00411670
add esp, 0xc
mov byte [ebp - 4], 2
push str..lnk
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x124]
push eax
call fcn.00411670
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x124]
call fcn.004090f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xffffffff
je 0x410e1d
lea ecx, [ebp - 0x270]
call fcn.004a2910
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x278]
call fcn.004a2910
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x274]
call fcn.004a2910
mov byte [ebp - 4], 6
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
push 0x5a36cc
lea ecx, [ebp - 0x270]
push ecx
call fcn.004098b0
add esp, 0x10
lea edx, [ebp - 0x278]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x288], esp
lea eax, [ebp - 0x270]
push eax
call fcn.00408fd0
mov dword [ebp - 0x2a8], eax
call fcn.004a15c0
add esp, 8
lea ecx, [ebp - 0x278]
call fcn.004090f0
push eax
lea ecx, [ebp - 0x27c]
push ecx
call fcn.0049ea80
add esp, 8
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x28c], esp
lea edx, [ebp - 0x27c]
push edx
call fcn.00408fd0
mov dword [ebp - 0x2ac], eax
call fcn.004a0c40
add esp, 4
mov byte [ebp - 0x2ad], al
movzx eax, byte [ebp - 0x2ad]
test eax, eax
je 0x410d31
push 0
push 0
lea ecx, [ebp - 0x278]
call fcn.004090f0
push eax
call fcn.004a0960
add esp, 0xc
test eax, eax
jne 0x410dc5
push ecx
mov ecx, esp
mov dword [ebp - 0x290], esp
lea edx, [ebp - 0x268]
push edx
call fcn.00408fd0
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x294], esp
lea edx, [ebp - 0x270]
push edx
call fcn.00408fd0
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 4], 7
call fcn.004a17a0
add esp, 8
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
push 0x5a36d4
lea edx, [ebp - 0x274]
push edx
call fcn.004098b0
add esp, 0x10
push 0
lea ecx, [ebp - 0x274]
call fcn.004090f0
push eax
lea ecx, [ebp - 0x270]
call fcn.004090f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x27c]
call fcn.00408330
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410c72
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x274]
call fcn.00408330
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x278]
call fcn.00408330
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x270]
call fcn.00408330
mov edx, dword [ebp - 0x26c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x124]
call fcn.00408330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00408330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056edd3
mov esp, ebp
pop ebp
ret