Function at 0x4a3700
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f2971
mov eax, dword fs:[0]
push eax
sub esp, 0x55c
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x558], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x570]
mov dword fs:[0], eax
mov dword [esp + 0x578], 0
lea eax, [esp + 0x584]
push eax
lea ecx, [esp + 0x18]
push str.Restore_Dir:
push ecx
call fcn.00410070
mov byte [esp + 0x584], 1
push str._n___
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0x578], 2
push eax
mov ecx, 0x10dd2f4
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x578], 1
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x578], 0
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push ecx
lea eax, [esp + 0x588]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x57c], 3
mov byte [esp + 0x57c], 0
call fcn.004a3470
push 0x1ff
lea ecx, [esp + 0x375]
push 0
push ecx
mov byte [esp + 0x37c], 0
call sub.MSVCR90.dll_memset
push 0x1ff
lea edx, [esp + 0x181]
push 0
push edx
mov byte [esp + 0x188], 0
call sub.MSVCR90.dll_memset
add esp, 0x1c
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x578], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x578], 5
mov eax, dword [esp + 0x580]
cmp eax, 0x18
jne 0x4a387d
push 0x10dd270
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov bl, 6
mov byte [esp + 0x578], bl
push str.CSIDL_COMMON_STARTUP
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x578], 7
jmp 0x4a392d
cmp eax, 7
jne 0x4a38b7
push 0x10dd270
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov bl, 8
mov byte [esp + 0x578], bl
push str.CSIDL_STARTUP
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x578], 9
jmp 0x4a392d
cmp eax, 0x8888
jne 0x4a38f3
push 0x10dd270
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov bl, 0xa
mov byte [esp + 0x578], bl
push str.0x8888
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x578], 0xb
jmp 0x4a392d
cmp eax, 0x9999
jne 0x4a395b
push 0x10dd270
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov bl, 0xc
mov byte [esp + 0x578], bl
push str.0x9999
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x578], 0xd
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x578], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x578], 5
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], 0x200
jae 0x4a397b
lea edx, [esp + 0x16c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4a3971
lea eax, [esp + 0x16c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4a3983
mov ecx, dword [0x5027e0]
mov dl, byte [0x5027e4]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4a3b1e
push 0x10dd270
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x578], 0xe
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x578], 0x10
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x578], 0x11
mov esi, dword [sym.imp.MSVCR90.dll_sprintf]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov bl, 0x12
jmp 0x4a3a20
test byte [esp + 0x2c], 0x10
jne 0x4a3adf
push str.desktop.ini
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4a3adf
cmp byte [esp + 0x58], 0x2e
je 0x4a3adf
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x58]
push edx
push eax
lea ecx, [esp + 0x374]
push 0x5027d8
push ecx
call esi
push 0x4ff418
lea edx, [esp + 0x598]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00402a60
mov byte [esp + 0x594], bl
lea ecx, [esp + 0x74]
push ecx
push eax
lea edx, [esp + 0x38]
push edx
call fcn.00402a60
add esp, 0x28
mov byte [esp + 0x578], 0x13
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x578], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x578], 0x11
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x374]
push ecx
call edi
lea edx, [esp + 0x2c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4a3a20
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0x578], 0x10
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x578], 5
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x578], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x578], 0
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x578], 0xffffffff
lea ecx, [esp + 0x584]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x570]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x558]
xor ecx, esp
call fcn.004e0148
add esp, 0x568
ret