Function at 0x4368d0
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x454], eax
mov dword [eax], 0
call fcn.00436640
add esp, 4
test eax, eax
jne 0x436925
mov eax, dword [ebp - 0x454]
pop edi
mov dword [eax], 1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
push edi
call fcn.00436640
add esp, 4
test eax, eax
jne 0x43695a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x43695a
mov ecx, dword [ebp - 0x454]
pop edi
mov dword [ecx], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.00461ee4
add esp, 8
test eax, eax
jne 0x436984
mov edx, dword [ebp - 0x454]
pop edi
mov dword [edx], 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [ebp - 0x30f]
push 0
push eax
mov byte [ebp - 0x310], 0
call fcn.00440e30
push esi
lea ecx, [ebp - 0x310]
push str._s.
push ecx
call fcn.00440eaa
add esp, 0x18
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x458], eax
cmp eax, 0xffffffff
jne 0x4369f0
mov ecx, dword [ebp - 0x454]
pop edi
mov dword [ecx], 5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.00440e30
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.00440e30
add esp, 0x18
jmp 0x436a30
test byte [ebp - 0x450], 0x10
jne 0x436ad0
push 0
lea ecx, [ebp - 0x108]
push ecx
push str.UtlFile
call fcn.0042a650
lea edx, [ebp - 0x424]
push edx
push esi
lea eax, [ebp - 0x108]
push 0x46c9fc
push eax
call fcn.00440eaa
lea ecx, [ebp - 0x424]
push ecx
push edi
lea edx, [ebp - 0x20c]
push 0x46c9fc
push edx
call fcn.00440eaa
mov eax, dword [ebp + 0x10]
add esp, 0x2c
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x436b94
mov edx, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x454]
push edx
mov dword [ecx], 4
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
mov ecx, 0x46c450
lea eax, [ebp - 0x424]
jmp 0x436ae0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x436b00
test dl, dl
je 0x436afc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x436b00
add eax, 2
add ecx, 2
test dl, dl
jne 0x436ae0
xor eax, eax
jmp 0x436b05
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x436b94
mov ecx, 0x46f390
lea eax, [ebp - 0x424]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x436b38
test dl, dl
je 0x436b34
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x436b38
add eax, 2
add ecx, 2
test dl, dl
jne 0x436b18
xor eax, eax
jmp 0x436b3d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x436b94
lea eax, [ebp - 0x424]
push eax
push esi
lea ecx, [ebp - 0x108]
push 0x46c9fc
push ecx
call fcn.00440eaa
lea edx, [ebp - 0x424]
push edx
push edi
lea eax, [ebp - 0x20c]
push 0x46c9fc
push eax
call fcn.00440eaa
mov ecx, dword [ebp - 0x454]
mov edx, dword [ebp + 0x10]
push ecx
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.004368d0
add esp, 0x30
mov eax, dword [ebp - 0x458]
lea edx, [ebp - 0x450]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x436a30
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret