Function at 0x4861f0
Capabilities:
Check if file exists
Copy file
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c1f0
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x486234
test al, 0x10
jne 0x486245
push esi
call fcn.00487540
add esp, 4
test eax, eax
je 0x486b1b
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x486b37
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x26c], eax
push ebx
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 0
call fcn.0044f2b0
test al, al
jne 0x4862a2
test ebx, ebx
jne 0x486281
xor ecx, ecx
jmp 0x486295
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x486286
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x26c]
call fcn.0044f440
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x26c]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4862e9
lea edx, [ecx - 1]
test edx, edx
js 0x486b4b
cmp edx, ecx
jg 0x486b4b
movzx eax, word [eax + edx*2]
cmp eax, 0x5c
je 0x4862e9
cmp eax, 0x2f
je 0x4862e9
push 1
push 0x5329c0
lea ecx, [ebp - 0x26c]
call fcn.0048c350
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x486b41
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x268], eax
push esi
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
call fcn.0044f2b0
test al, al
jne 0x486343
test esi, esi
jne 0x486322
xor ecx, ecx
jmp 0x486336
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x486327
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x268]
call fcn.0044f440
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x486387
lea edx, [ecx - 1]
test edx, edx
js 0x486b4b
cmp edx, ecx
jg 0x486b4b
movzx eax, word [eax + edx*2]
cmp eax, 0x5c
je 0x486387
cmp eax, 0x2f
je 0x486387
push 1
push 0x5329c0
lea ecx, [ebp - 0x268]
call fcn.0048c350
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x486b55
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x280], edi
mov byte [ebp - 4], 4
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x486b5f
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x284], esi
mov byte [ebp - 4], 5
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x486b69
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x278], eax
push ebx
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 6
call fcn.0044f2b0
test al, al
jne 0x486423
test ebx, ebx
jne 0x486402
xor ecx, ecx
jmp 0x486416
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x486407
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x278]
call fcn.0044f440
push 0x533ad4
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0048bbf0
add esp, 0xc
mov byte [ebp - 4], 8
or ebx, 0xffffffff
mov edx, dword [eax]
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
mov dword [ebp - 0x274], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x27c], eax
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x4864d4
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x270], eax
jl 0x4864c5
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x4864c5
mov eax, dword [ebp - 0x27c]
push eax
call fcn.0048ce30
mov dword [ebp - 0x27c], eax
add esp, 4
mov eax, dword [ebp - 0x270]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4864b4
mov eax, dword [ebp - 0x274]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x27c]
add eax, 0x10
mov dword [ebp - 0x278], eax
jmp 0x4864d4
push dword [edx - 0xc]
lea ecx, [ebp - 0x278]
push edx
call fcn.0044f440
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x264]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4864f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x27c], eax
cmp eax, 0xffffffff
je 0x486a7c
test byte [ebp - 0x260], 0x10
je 0x48663b
mov edx, 0x53183c
lea ecx, [ebp - 0x234]
nop
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x486556
test ax, ax
je 0x486552
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x486556
add ecx, 4
add edx, 4
test ax, ax
jne 0x486530
xor eax, eax
jmp 0x48655b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4867bd
mov ecx, 0x531840
lea eax, [ebp - 0x234]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x486596
test dx, dx
je 0x486592
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x486596
add eax, 4
add ecx, 4
test dx, dx
jne 0x486570
xor eax, eax
jmp 0x48659b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4867bd
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0048bbf0
mov ebx, eax
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0048bbf0
mov byte [ebp - 4], 0xa
push dword [ebx]
push dword [eax]
call fcn.004861f0
mov byte [ebp - 4], 9
or ebx, 0xffffffff
mov edx, dword [ebp - 0x264]
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486611
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x274]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4867bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4867bd
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0048bbf0
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [edi - 0x10]
mov edx, dword [eax]
mov dword [ebp - 0x274], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x264], eax
cmp eax, ecx
je 0x4866d6
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x4866c1
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x4866c1
push dword [ebp - 0x264]
call fcn.0048ce30
add esp, 4
mov dword [ebp - 0x264], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4866b6
mov edi, dword [ebp - 0x274]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x264]
lea edi, [eax + 0x10]
mov dword [ebp - 0x280], edi
jmp 0x4866d6
push dword [edx - 0xc]
lea ecx, [ebp - 0x280]
push edx
call fcn.0044f440
mov edi, dword [ebp - 0x280]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4866f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0048bbf0
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [esi - 0x10]
mov edx, dword [eax]
mov dword [ebp - 0x274], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x264], eax
cmp eax, ecx
je 0x486792
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x48677d
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x48677d
push dword [ebp - 0x264]
call fcn.0048ce30
add esp, 4
mov dword [ebp - 0x264], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x486772
mov esi, dword [ebp - 0x274]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x264]
lea esi, [eax + 0x10]
mov dword [ebp - 0x284], esi
jmp 0x486792
push dword [edx - 0xc]
lea ecx, [ebp - 0x284]
push edx
call fcn.0044f440
mov esi, dword [ebp - 0x284]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4867b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x486a70
nop dword [eax + eax]
test byte [ebp - 0x260], 0x10
lea eax, [ebp - 0x234]
je 0x486901
mov ecx, 0x53183c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48681e
test dx, dx
je 0x48681a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48681e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4867f8
xor eax, eax
jmp 0x486823
sbb eax, eax
or eax, 1
test eax, eax
je 0x486a55
mov ecx, 0x531840
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48685c
test dx, dx
je 0x486858
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48685c
add eax, 4
add ecx, 4
test dx, dx
jne 0x486836
xor eax, eax
jmp 0x486861
sbb eax, eax
or eax, 1
test eax, eax
je 0x486a55
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0048bbf0
mov ebx, eax
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0048bbf0
mov byte [ebp - 4], 0xe
push dword [ebx]
push dword [eax]
call fcn.004861f0
mov byte [ebp - 4], 0xd
or ebx, 0xffffffff
mov edx, dword [ebp - 0x264]
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4868d7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x274]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486a55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x486a55
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0048bbf0
add esp, 0xc
mov byte [ebp - 4], 0xf
lea ebx, [edi - 0x10]
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x486980
cmp dword [ebx + 0xc], 0
lea edi, [ebx + 0xc]
jl 0x48696b
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x48696b
push edx
call fcn.0048ce30
add esp, 4
mov dword [ebp - 0x270], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x486960
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x270]
lea edi, [eax + 0x10]
mov dword [ebp - 0x280], edi
jmp 0x486980
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x280]
call fcn.0044f440
mov edi, dword [ebp - 0x280]
mov byte [ebp - 4], 7
or eax, 0xffffffff
mov edx, dword [ebp - 0x288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4869a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x28c]
push eax
call fcn.0048bbf0
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ebx, [esi - 0x10]
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x486a27
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x486a12
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x486a12
push edx
call fcn.0048ce30
add esp, 4
mov dword [ebp - 0x270], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x486a07
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x270]
lea esi, [eax + 0x10]
mov dword [ebp - 0x284], esi
jmp 0x486a27
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x284]
call fcn.0044f440
mov esi, dword [ebp - 0x284]
mov byte [ebp - 4], 7
or ebx, 0xffffffff
mov edx, dword [ebp - 0x28c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486a4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4867e0
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x278]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486a9d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x486ab8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x486ad3
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486af4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x486b16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00450130
push 0x80004005
call fcn.00450130
push 0x80070057
call fcn.00450130
push 0x80004005
call fcn.00450130
push 0x80004005
call fcn.00450130
push 0x80004005
call fcn.00450130
int3