Function at 0x418320
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ebae
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x469644]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x320], eax
push 0x45f02c
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x4c]
push edx
mov dword [ebp - 4], 1
call fcn.00412f20
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x4c]
mov ebx, 8
cmp dword [ebp - 0x38], ebx
jae 0x41838d
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x31c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor esi, esi
mov dword [ebp - 0x328], eax
cmp eax, esi
jne 0x4183fe
cmp dword [ebp - 0x38], ebx
jb 0x4183b8
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00426e9f
add esp, 4
xor eax, eax
mov edi, 7
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x4c], ax
cmp dword [ebp + 0x1c], ebx
jb 0x4183da
mov ecx, dword [ebp + 8]
push ecx
call fcn.00426e9f
add esp, 4
xor edx, edx
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], esi
mov word [ebp + 8], dx
cmp dword [ebp + 0x38], ebx
jb 0x4183f7
mov eax, dword [ebp + 0x24]
push eax
call fcn.00426e9f
add esp, 4
xor al, al
jmp 0x418b4d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x324], esp
push esi
lea eax, [ebp + 0x24]
xor edx, edx
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], esi
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403a30
call fcn.00405f20
add esp, 0x1c
test al, al
jne 0x418502
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x38], ebx
jae 0x418440
lea eax, [ebp + 0x24]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x418502
lea ecx, [ebp - 0xbc]
push 0x45f030
push ecx
lea ebx, [ebp + 0x24]
call fcn.00404920
sub esp, 0x14
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x324], esp
push eax
mov eax, 0x45d75c
call fcn.0040f880
add esp, 4
call fcn.00410b20
mov esi, 8
add esp, 0x1c
cmp dword [ebp - 0xa8], esi
jb 0x4184a5
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00426e9f
add esp, 4
cmp dword [ebp - 0x38], esi
jb 0x4184b6
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00426e9f
add esp, 4
xor ebx, ebx
xor ecx, ecx
mov edi, 7
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], cx
cmp dword [ebp + 0x1c], esi
jb 0x4184da
mov edx, dword [ebp + 8]
push edx
call fcn.00426e9f
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], ebx
mov word [ebp + 8], ax
cmp dword [ebp + 0x38], esi
jb 0x4183f7
mov ecx, dword [ebp + 0x24]
push ecx
call fcn.00426e9f
add esp, 4
xor al, al
jmp 0x418b4d
lea edx, [ebp - 0x374]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp - 0x320]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x33c], edx
mov edx, dword [ebp - 0x370]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x340], ecx
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x360], edx
lea edx, [ebp - 0x354]
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x364], ecx
mov ecx, dword [ebp - 0x368]
push edx
lea eax, [ebp - 0x364]
push eax
mov dword [ebp - 0x358], ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [ebp - 0x340]
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x338]
mov esi, dword [ebp - 0x354]
mov edi, dword [ebp - 0x350]
mov dword [ebp - 0x390], ecx
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x38c], edx
push ecx
lea edx, [ebp - 0x394]
push edx
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x388], eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
sub esi, dword [ebp - 0x34c]
push 0
sbb edi, dword [ebp - 0x348]
push 0x989680
push edi
push esi
call fcn.00430bd0
mov dword [ebp - 0x330], edx
cmp eax, 5
jle 0x41866c
lea eax, [ebp - 0x384]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp - 0x37c]
mov ecx, dword [ebp - 0x384]
mov edx, dword [ebp - 0x380]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xc4], eax
xor eax, eax
mov edi, 7
xor ebx, ebx
mov dword [ebp - 0xcc], ecx
mov ecx, dword [ebp - 0x378]
mov dword [ebp - 0xc8], edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x324], esp
mov word [esi], ax
push 6
mov eax, str.ONCOPY
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x320], edx
call fcn.00404210
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0x74]
push edx
call fcn.0041bf00
jmp 0x418673
mov edi, 7
xor ebx, ebx
test byte [ebp - 0x31c], 0x10
je 0x4188a9
xor eax, eax
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x418695
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x2f0]
lea esi, [ebp - 0x30]
call fcn.00404210
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
mov esi, eax
cmp eax, 1
jb 0x4186c6
mov esi, 1
cmp dword [ebp - 0x1c], 8
mov edx, dword [ebp - 0x30]
jae 0x4186d2
lea edx, [ebp - 0x30]
mov ecx, 0x45de4c
cmp esi, ebx
jbe 0x4186fd
jmp 0x4186e0
mov di, word [edx]
cmp di, word [ecx]
jne 0x4186f3
add edx, 2
add ecx, 2
dec esi
jne 0x4186e0
jmp 0x4186fd
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
cmp ecx, ebx
jne 0x418711
cmp eax, 1
jae 0x418707
or ecx, 0xffffffff
jmp 0x41870f
xor ecx, ecx
cmp eax, 1
setne cl
cmp ecx, ebx
sete cl
test cl, cl
sete cl
test cl, cl
je 0x418893
push 0x45f08c
mov edi, 2
lea ecx, [ebp - 0x30]
call fcn.00404da0
test eax, eax
je 0x418893
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea ebx, [ebp - 0x30]
call fcn.00412e70
push eax
mov eax, 0x45d134
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.0040f880
add esp, 0xc
mov ebx, 7
mov byte [ebp - 4], bl
cmp dword [ebp - 0x70], 8
jb 0x418783
mov edx, dword [ebp - 0x84]
push edx
call fcn.00426e9f
add esp, 4
lea ecx, [ebp + 0x24]
push ecx
lea edx, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
xor eax, eax
push edx
lea ebx, [ebp - 0x30]
mov dword [ebp - 0x74], 0
mov word [ebp - 0x84], ax
call fcn.00412e70
push eax
mov ebx, 8
mov eax, 0x45d134
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], bl
call fcn.0040f880
add esp, 0xc
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x54], ebx
jb 0x4187d7
mov eax, dword [ebp - 0x68]
push eax
call fcn.00426e9f
add esp, 4
mov edx, dword [ebp - 0x320]
push edx
sub esp, 0x1c
xor ecx, ecx
xor edi, edi
mov word [ebp - 0x68], cx
mov ecx, esp
mov esi, 7
mov dword [ebp - 0x324], esp
xor eax, eax
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push edi
lea edx, [ebp - 0xa0]
mov word [ecx], ax
push edx
or eax, 0xffffffff
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], edi
call fcn.00403a30
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x330], esp
xor eax, eax
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push edi
lea edx, [ebp - 0xbc]
mov word [ecx], ax
push edx
or eax, 0xffffffff
call fcn.00403a30
mov ecx, dword [ebp - 0x32c]
mov byte [ebp - 4], 0xa
call fcn.00418320
cmp dword [ebp - 0x8c], ebx
jb 0x418867
mov eax, dword [ebp - 0xa0]
push eax
call fcn.00426e9f
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], edi
mov word [ebp - 0xa0], cx
cmp dword [ebp - 0xa8], ebx
jb 0x418893
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00426e9f
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 8
jb 0x418acb
mov eax, dword [ebp - 0x30]
jmp 0x418ac2
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0xa0]
push eax
call fcn.00412f20
add esp, 0xc
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp + 0x24]
push edx
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0xc
call fcn.00412f20
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x330], esp
mov byte [ebp - 4], 0xd
push ebx
lea eax, [ebp - 0x30]
xor edx, edx
push eax
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403a30
call fcn.00405dd0
add esp, 0x1c
test al, al
je 0x418983
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x330], esp
push ebx
lea eax, [ebp - 0x30]
xor edx, edx
push eax
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403a30
call fcn.004060d0
add esp, 0x1c
test al, al
jne 0x418983
lea ecx, [ebp - 0xbc]
push str.Datei_konnte_nicht
push ecx
lea ebx, [ebp - 0xa0]
call fcn.00404920
push eax
mov eax, str.___
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xe
call fcn.0040f880
add esp, 0xc
mov ecx, eax
lea eax, [ebp - 0x30]
lea ebx, [ebp - 0x68]
mov byte [ebp - 4], 0xf
call fcn.00413010
mov byte [ebp - 4], 0x10
jmp 0x418a02
mov ecx, dword [ebp - 0x30]
mov eax, 8
cmp dword [ebp - 0x1c], eax
jae 0x418993
lea ecx, [ebp - 0x30]
cmp dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xa0]
jae 0x4189a7
lea eax, [ebp - 0xa0]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
test al, al
jne 0x418a86
lea ecx, [ebp - 0xbc]
push str.Datei_konnte_nicht_kopiert_werden__
push ecx
lea ebx, [ebp - 0xa0]
call fcn.00404920
push eax
mov eax, str.___
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x11
call fcn.0040f880
add esp, 0xc
mov ecx, eax
lea eax, [ebp - 0x30]
lea ebx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.00413010
mov byte [ebp - 4], 0x13
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x330], esp
push eax
mov eax, 0x45d75c
call fcn.0040f880
add esp, 4
call fcn.00410b20
mov esi, 8
add esp, 0x1c
cmp dword [ebp - 0x54], esi
jb 0x418a39
mov edx, dword [ebp - 0x68]
push edx
call fcn.00426e9f
add esp, 4
xor ebx, ebx
xor eax, eax
mov edi, 7
mov word [ebp - 0x68], ax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], edi
cmp dword [ebp - 0x70], esi
jb 0x418a60
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.00426e9f
add esp, 4
xor edx, edx
mov word [ebp - 0x84], dx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], edi
cmp dword [ebp - 0xa8], esi
jb 0x418a86
mov eax, dword [ebp - 0xbc]
push eax
call fcn.00426e9f
add esp, 4
mov esi, 8
cmp dword [ebp - 0x1c], esi
jb 0x418a9c
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00426e9f
add esp, 4
xor edx, edx
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], dx
cmp dword [ebp - 0x8c], esi
jb 0x418acb
mov eax, dword [ebp - 0xa0]
push eax
call fcn.00426e9f
add esp, 4
mov edx, dword [ebp - 0x328]
lea ecx, [ebp - 0x31c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x418502
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 8
cmp dword [ebp - 0x38], esi
jb 0x418b0a
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.00426e9f
add esp, 4
xor ebx, ebx
xor edx, edx
mov edi, 7
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], dx
cmp dword [ebp + 0x1c], esi
jb 0x418b2e
mov eax, dword [ebp + 8]
push eax
call fcn.00426e9f
add esp, 4
xor ecx, ecx
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], ebx
mov word [ebp + 8], cx
cmp dword [ebp + 0x38], esi
jb 0x418b4b
mov edx, dword [ebp + 0x24]
push edx
call fcn.00426e9f
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042575d
mov esp, ebp
pop ebp
ret 0x3c