Function at 0x10280c7
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x1033f70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor edi, edi
lea eax, [ebp - 0x20a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x464], edi
cmp esi, edi
je 0x102840d
cmp dword [esi + 4], edi
je 0x102840d
mov ebx, dword [esi + 0x28]
cmp ebx, edi
je 0x102840d
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x46c], eax
mov eax, dword [esi + 0xc]
cmp eax, edi
jl 0x102815d
cmp dword [ebp + 0x10], edi
je 0x1028169
or dword [esi + 0xc], 0xffffffff
mov dword [ebp - 0x460], eax
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x1028170
push eax
call fcn.01024d5e
test eax, eax
je 0x1028415
mov dword [esi + 0x24], edi
jmp 0x1028170
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
jl 0x102840d
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp + 0xc], 0
mov edi, 0x104
jne 0x10281d6
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x501
push dword [esi + 4]
call fcn.0101e8c1
test eax, eax
je 0x1028415
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x468], eax
cmp eax, 0xffffffff
jne 0x102835e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1028415
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x460], eax
je 0x10283ee
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x460]
push 0x101
push dword [esi + 4]
call fcn.0101ec5e
test eax, eax
je 0x1028415
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x102822b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1028249
mov eax, dword [ebp - 0x460]
inc eax
xor edx, edx
mov ecx, 0x2710
div ecx
mov dword [ebp - 0x460], edx
cmp edx, dword [ebp - 0x464]
jne 0x10281eb
mov edi, dword [ebp - 0x460]
cmp edi, dword [ebp - 0x464]
je 0x10283ee
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + 0xc], edi
mov eax, dword [ebx + 0x14]
cmp dword [eax + 0x20], 0
jne 0x1028273
push ebx
call fcn.01025124
mov edx, dword [ebp - 0x46c]
test edx, edx
je 0x10282e3
mov eax, dword [edx + 0x14]
test eax, eax
je 0x10282e3
mov eax, dword [eax + 0x20]
test eax, eax
je 0x10282e3
cmp dword [eax + 0xc], 0
je 0x10282e3
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x10282e3
cmp dword [eax + 0xc], 0
je 0x10282e3
mov eax, dword [edx + 0x14]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x18]
mov ecx, dword [ebx + 0x14]
mov ecx, dword [ecx + 0x20]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + 0x18], edi
mov eax, dword [eax + 0x1c]
mov edi, dword [ebp - 0x460]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 0x14]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebx + 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [ecx + 0x20]
mov edx, dword [eax + 0x20]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + 0x20], edx
mov eax, dword [eax + 0x24]
mov dword [ecx + 0x24], eax
push ebx
call fcn.010251c1
test eax, eax
je 0x1028415
mov eax, dword [esi + 0x24]
mov dword [esi + 0xc], edi
test eax, eax
je 0x102830d
push eax
call fcn.01024d5e
test eax, eax
je 0x1028415
and dword [esi + 0x24], 0
push dword [ebx + 8]
call fcn.0101e529
mov edi, eax
test edi, edi
je 0x1028415
push ebx
call fcn.01024d5e
test eax, eax
je 0x1028415
push 8
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
push edi
mov dword [esi + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push ebx
test eax, eax
jne 0x10283f2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1028415
test byte [ebp - 0x45c], 0x10
je 0x10283c6
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x430]
push 0x1011ab4
push eax
call sub.msvcrt.dll_swscanf
add esp, 0xc
cmp eax, 1
jne 0x10283c6
mov eax, dword [ebp - 0x464]
cmp eax, dword [esi + 0x10]
je 0x10283c6
cmp eax, dword [esi + 0xc]
je 0x10283c6
lea eax, [ebp - 0x430]
push eax
push dword [esi + 4]
lea eax, [ebp - 0x20c]
push 0x1011ac0
push edi
push eax
call fcn.01018ea1
add esp, 0x14
test eax, eax
jl 0x10283e2
lea eax, [ebp - 0x20c]
push eax
call fcn.0101e5b8
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102835e
jmp 0x10281ca
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x32
jmp 0x102840f
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call fcn.01020d5e
neg eax
sbb eax, eax
neg eax
jmp 0x1028417
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101c23d
leave
ret 0xc