Function at 0x4049c0
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push ebx
mov dword [ebp - 0x674], edi
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x678], ecx
call fcn.0041bfc8
add esp, 4
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.00422210
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00422210
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
lea eax, [ebp - 0x418]
push str._s.
push eax
mov dword [ebp - 0x66c], 0
call esi
add esp, 0xc
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x67c], eax
cmp eax, 0xffffffff
je 0x404d46
jmp 0x404aa2
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [ebp - 0x680]
mov edi, dword [ebp - 0x674]
lea eax, [ebp - 0x63c]
push eax
push edi
lea ecx, [ebp - 0x418]
push str._s_s
push ecx
call esi
lea edx, [ebp - 0x63c]
push edx
push ebx
lea eax, [ebp - 0x210]
push str._s_s
push eax
call esi
add esp, 0x20
mov ecx, 0x42f8d4
lea eax, [ebp - 0x63c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404b06
test dx, dx
je 0x404b02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404b06
add eax, 4
add ecx, 4
test dx, dx
jne 0x404ae0
xor esi, esi
jmp 0x404b0b
sbb esi, esi
sbb esi, 0xffffffff
test esi, esi
je 0x404d22
mov ecx, 0x433858
lea eax, [ebp - 0x63c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404b46
test dx, dx
je 0x404b42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404b46
add eax, 4
add ecx, 4
test dx, dx
jne 0x404b20
xor eax, eax
jmp 0x404b4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404ca6
test byte [ebp - 0x668], 0x10
jne 0x404ca6
mov edi, 1
xor esi, esi
cmp dword [0xb5689c], edi
jne 0x404b89
lea ecx, [ebp - 0x63c]
push str.PolicyContainer.opt
push ecx
call fcn.0041a8a7
add esp, 8
test eax, eax
jne 0x404b89
mov esi, edi
cmp dword [0xb568a0], edi
jne 0x404bab
lea edx, [ebp - 0x63c]
push str.RemoteService.opt
push edx
call fcn.0041a8a7
add esp, 8
test eax, eax
jne 0x404bab
mov esi, edi
push 0x80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0x80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test ebx, ebx
jne 0x404d22
push edi
lea ecx, [ebp - 0x63c]
push ecx
push 0x433870
push 0xb543d0
call dword [sym.imp.USER32.dll_wsprintfW]
push 0xb543d0
call fcn.00403790
lea edx, [ebp - 0x63c]
add esp, 0x14
push edx
call fcn.00413a80
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x80
lea edx, [ebp - 0x210]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
jne 0x404d22
mov eax, dword [ebp - 0x66c]
inc eax
push eax
mov dword [ebp - 0x66c], eax
push edi
lea eax, [ebp - 0x63c]
push eax
push 0x4338c0
push 0xb543d0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0xb543d0
call fcn.00403790
add esp, 4
jmp 0x404d22
test esi, esi
je 0x404d22
mov ecx, 0x433858
lea eax, [ebp - 0x63c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404cdb
test dx, dx
je 0x404cd7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404cdb
add eax, 4
add ecx, 4
test dx, dx
jne 0x404cb5
xor eax, eax
jmp 0x404ce0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404d22
push 0x80
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0x670]
push eax
push ecx
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.004049c0
add esp, 0x18
mov esi, dword [ebp - 0x67c]
lea edx, [ebp - 0x668]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x404a90
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x66c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret