Function at 0x10026984
Capabilities:
Check if file exists
Enumerate files on windows
Move file

Disassembly:
mov eax, 0x10038225
call fcn.10001a8f
sub esp, 0x8b4
mov eax, dword [0x1003b164]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x8b4], esi
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 0x88c], edi
mov dword [ebp - 0x884], edi
mov dword [ebp - 0x888], edi
xor ebx, ebx
cmp word [esi], di
mov dword [ebp - 4], edi
mov dword [ebp - 0x880], edi
mov dword [ebp - 0x898], edi
mov dword [ebp - 0x894], edi
jne 0x100269f8
push 0x22e
push 0x10004cc0
push 0x10026a3c
call fcn.100280bc
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
add eax, 0x13
cmp eax, 0x104
pop ecx
jbe 0x10026a50
push 0x233
push 0x10004cc0
push 0x10004d40
call fcn.100280bc
mov eax, 0x8007006f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.10023cf0
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x62c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x62c]
push 0x10026aa4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x89c], eax
jne 0x10026afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10026acc
xor eax, eax
jmp 0x10026a23
test eax, eax
jle 0x10026ada
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x880], eax
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10026aef
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x880]
jmp 0x10026a23
xor esi, esi
lea eax, [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x850]
push 0x10026c64
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
cmp dword [ebp - 0x8b8], esi
jl 0x10026b41
jg 0x10026b2a
cmp dword [ebp - 0x8bc], esi
jbe 0x10026b41
cmp dword [ebp - 0x8b8], 0xffff
jl 0x10026b55
jg 0x10026b41
cmp dword [ebp - 0x8bc], 0xffffffff
jb 0x10026b55
push 0x251
push 0x10004cc0
push 0x10026c08
call fcn.100280bc
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 1
call fcn.100268c7
lea eax, [ebp - 0x87c]
push eax
push dword [ebp - 0x89c]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10026afc
mov esi, dword [ebp - 0x888]
mov edi, dword [ebp - 0x88c]
push esi
push edi
lea ecx, [ebp - 0x8b0]
call fcn.10026728
mov eax, dword [ebp - 0x8a8]
dec eax
push eax
push 0
lea ecx, [ebp - 0x8b0]
call fcn.100268f8
lea edx, [esi - 1]
cmp ebx, edx
jb 0x10026c80
xor eax, eax
cmp ebx, eax
jbe 0x10026d53
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 0x8a8], eax
mov byte [ebp - 4], 4
mov esi, ebx
cmp esi, dword [ebp - 0x888]
jae 0x10026cab
lea eax, [edi + esi*8]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.100268c7
inc esi
jmp 0x10026be4
mov ecx, dword [edi + ebx*8]
sub ecx, dword [edi + esi*8 - 8]
mov eax, dword [edi + ebx*8 + 4]
sbb eax, dword [edi + esi*8 - 4]
cmp eax, 0x7fff
jl 0x10026bc2
jg 0x10026ca5
cmp ecx, 0xffffffff
jbe 0x10026bc2
inc ebx
jmp 0x10026bba
xor esi, esi
cmp esi, ebx
jae 0x10026d15
lea eax, [edi + esi*8]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.100268c7
inc esi
jmp 0x10026cad
cmp dword [ebp - 0x89c], 0xffffffff
je 0x10026ae0
push dword [ebp - 0x89c]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10026ae0
lea eax, [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x88c]
mov dword [ebp - 4], 3
call fcn.1002659e
cmp dword [ebp - 0x8ac], 0
mov byte [ebp - 4], 0
je 0x10026d47
push dword [ebp - 0x8ac]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [ebp - 0x88c]
mov esi, dword [ebp - 0x888]
and dword [ebp - 0x890], 0
test esi, esi
jbe 0x10026e17
mov eax, dword [ebp - 0x890]
and dword [ebp - 0x8a0], 0
lea esi, [edi + eax*8]
push dword [esi + 4]
mov ebx, 0x104
push dword [esi]
lea eax, [ebp - 0x21c]
push dword [ebp - 0x8b4]
push ebx
push eax
call fcn.10024162
lea eax, [ebp - 0x8a0]
push eax
push 1
lea eax, [ebp - 0x21c]
push eax
call sym.catsrv.dll_OpenComponentLibraryTS
test eax, eax
mov dword [ebp - 0x880], eax
jl 0x10026e7d
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x898]
or eax, dword [ebp - 0x894]
jne 0x10026ddd
mov eax, dword [esi]
mov dword [ebp - 0x898], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0x898]
sub ecx, dword [esi]
mov eax, dword [ebp - 0x894]
sbb eax, dword [esi + 4]
mov edx, dword [0x1003beec]
xor ebx, ebx
cmp eax, ebx
jg 0x10026e08
jl 0x10026f0f
cmp ecx, edx
jb 0x10026f0f
mov eax, dword [ebp - 0x890]
or dword [edi + eax*8], 0xffffffff
or dword [edi + eax*8 + 4], 0xffffffff
xor esi, esi
cmp dword [ebp - 0x888], esi
jbe 0x10026cf7
mov eax, dword [edi + esi*8]
mov ecx, dword [edi + esi*8 + 4]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x10026e6e
push ecx
push eax
push dword [ebp - 0x8b4]
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.10024162
lea eax, [ebp - 0x21c]
push eax
call fcn.1002646b
test eax, eax
je 0x100270a4
mov ecx, dword [ebp - 0x8c0]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
inc esi
cmp esi, dword [ebp - 0x888]
jae 0x10026cf7
jmp 0x10026e25
cmp eax, 0x80041015
jne 0x10026ffd
cmp dword [ebp - 0x8a0], 0
je 0x10026ea5
push 0x295
push 0x10004cc0
push 0x10026fc0
call fcn.100280bc
push 0x296
push 0x10004cc0
push 0x10026f48
call fcn.100280bc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add eax, 9
cmp eax, ebx
pop ecx
ja 0x10026fda
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x424]
push 0x10026f34
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
inc dword [ebp - 0x890]
mov eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0x888]
jb 0x10026d62
jmp 0x10026e17
push 0x29e
push 0x10004cc0
mov dword [ebp - 0x880], 0x8007006f
push 0x10004d40
call fcn.100280bc
jmp 0x10026cf7
push 0x2ae
push 0x10004cc0
push 0x10027010
jmp 0x10026ff3
mov dword [ebp - 0x880], 0x8007000e
jmp 0x10026cf7