Function at 0x100176b0
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c24e2
mov eax, dword fs:[0]
push eax
sub esp, 0x914
push ebx
push esi
push edi
lea edi, [ebp - 0x920]
mov ecx, 0x245
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100f405c
call fcn.10003373
push 0x1c
call fcn.10003c38
add esp, 4
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
je 0x10017726
mov ecx, dword [ebp - 0x81c]
call fcn.10001357
mov dword [ebp - 0x920], eax
jmp 0x10017730
mov dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x18], eax
push 0x100c60ac
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x840]
push ecx
call fcn.100031c5
add esp, 0xc
mov dword [ebp - 0x920], eax
mov edx, dword [ebp - 0x920]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.100044c6
lea ecx, [ebp - 0x840]
call fcn.10003e9a
push 0xc
call fcn.10003c38
add esp, 4
mov dword [ebp - 0x858], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x858], 0
je 0x100177b1
push 0xc
mov ecx, dword [ebp - 0x858]
call fcn.100041fb
mov ecx, dword [ebp - 0x858]
call fcn.1000182a
mov dword [ebp - 0x920], eax
jmp 0x100177bb
mov dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x84c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x84c]
mov dword [ebp - 0x27c], ecx
mov esi, esp
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp esi, esp
call fcn.10003440
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x10017872
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0
je 0x1001782f
push 1
mov ecx, dword [ebp - 0x864]
call fcn.10003067
mov dword [ebp - 0x920], eax
jmp 0x10017839
mov dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 0
je 0x10017863
push 1
mov ecx, dword [ebp - 0x870]
call fcn.10002af4
mov dword [ebp - 0x920], eax
jmp 0x1001786d
mov dword [ebp - 0x920], 0
jmp 0x10017b63
push 0x1c
call fcn.10003c38
add esp, 4
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 0
je 0x1001789e
mov ecx, dword [ebp - 0x87c]
call fcn.10001357
mov dword [ebp - 0x920], eax
jmp 0x100178a8
mov dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x270]
push eax
call fcn.10015870
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100178cc
jmp 0x100178de
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.1000443a
mov esi, esp
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp esi, esp
call fcn.10003440
test eax, eax
jne 0x100178b4
mov esi, esp
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10003440
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x2a0], eax
push 4
lea ecx, [ebp - 0x2ac]
call fcn.10001d70
lea eax, [ebp - 0x2ac]
push eax
mov ecx, dword [ebp - 0x2a0]
call fcn.10002518
push 4
lea ecx, [ebp - 0x2b8]
call fcn.10001d70
lea eax, [ebp - 0x2b8]
push eax
mov ecx, dword [ebp - 0x2a0]
call fcn.100033af
jmp 0x1001796c
lea ecx, [ebp - 0x2ac]
call fcn.10003f0d
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.100026c1
movzx ecx, al
test ecx, ecx
je 0x10017aca
lea ecx, [ebp - 0x2ac]
call fcn.10002608
mov ecx, 0x94
mov esi, eax
lea edi, [ebp - 0x510]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4e4]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x8a0]
push edx
call fcn.100031c5
add esp, 0xc
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.100044c6
lea ecx, [ebp - 0x8a0]
call fcn.10003e9a
mov eax, dword [ebp - 0x510]
and eax, 0x10
je 0x10017a62
push 0x100c6240
mov ecx, dword [ebp - 0x18]
call fcn.10001eba
lea eax, [ebp - 0x4e4]
push eax
lea ecx, [ebp - 0x8d0]
call fcn.10001744
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x8d0]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.10001730
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x10017a38
mov dword [ebp - 0x920], 1
jmp 0x10017a42
mov dword [ebp - 0x920], 0
mov dl, byte [ebp - 0x920]
mov byte [ebp - 0x8a9], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d0]
call fcn.10003e9a
jmp 0x10017ac5
lea eax, [ebp - 0x4e4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x8f4]
push edx
call fcn.100031c5
add esp, 0xc
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
push eax
mov ecx, dword [ebp - 0x294]
call fcn.100044c6
lea ecx, [ebp - 0x8f4]
call fcn.10003e9a
mov esi, esp
push 3
mov ecx, dword [ebp - 0x294]
call fcn.10001e83
push eax
mov ecx, dword [ebp - 0x18]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp esi, esp
call fcn.10003440
jmp 0x10017961
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 0
je 0x10017af1
push 1
mov ecx, dword [ebp - 0x900]
call fcn.10003067
mov dword [ebp - 0x920], eax
jmp 0x10017afb
mov dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 0
je 0x10017b25
push 1
mov ecx, dword [ebp - 0x90c]
call fcn.10002af4
mov dword [ebp - 0x920], eax
jmp 0x10017b2f
mov dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 0
je 0x10017b59
push 1
mov ecx, dword [ebp - 0x918]
call fcn.10003067
mov dword [ebp - 0x920], eax
jmp 0x10017b63
mov dword [ebp - 0x920], 0
push edx
mov ecx, ebp
push eax
lea edx, [0x10017ba0]
call fcn.100035f8
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003012
add esp, 0x920
cmp ebp, esp
call fcn.10003440
mov esp, ebp
pop ebp
ret