Function at 0x404880
Capabilities:
Enumerate files on windows
Move file

Disassembly:
mov eax, 0x14f0
call fcn.00405ec0
push ebx
push ebp
push esi
lea eax, [esp + 0x458]
push edi
push eax
call fcn.00403640
add esp, 4
xor ebx, ebx
call fcn.00403750
test eax, eax
jne 0x403b0d
lea ecx, [esp + 0x358]
push ecx
call fcn.00402a90
mov edi, str.Documents.prs
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x35c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e244
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x360]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0040598d
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x403b0d
test byte [ebp + 0xc], 0x10
jne 0x40393c
lea esi, [esp + 0x560]
push 0x104
call fcn.00405a92
mov edi, eax
mov ecx, 0x41
xor eax, eax
mov dword [esi], edi
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
push ebp
push 1
push 0x104
push ecx
call fcn.00405833
mov al, byte [ebp + 0xc]
add esp, 0x14
inc ebx
add esi, 4
test al, 0x10
je 0x403907
push ebp
call fcn.00405500
mov eax, dword [esp + ebx*4 + 0x55c]
sub ebx, 2
push str.:end
push eax
call fcn.004059a0
add esp, 0xc
test eax, eax
jne 0x403b0d
lea edi, [esp + 0x45c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x254]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x254]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40e044
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x403aee
test byte [esp + 0x114], 0x10
je 0x403ad0
lea edx, [esp + 0x140]
push 0x40e040
push edx
call fcn.004059a0
add esp, 8
test eax, eax
je 0x403ad0
lea eax, [esp + 0x140]
push 0x40e03c
push eax
call fcn.004059a0
add esp, 8
test eax, eax
je 0x403ad0
or ecx, 0xffffffff
lea edi, [esp + 0x45c]
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40e080
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x144]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x568]
push ecx
call fcn.004036b0
add esp, 0xc
test eax, eax
jne 0x403ad0
lea edx, [esp + 0x10]
push edx
call fcn.00403290
add esp, 4
lea eax, [esp + 0x114]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4039dd
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jl 0x403b0d
lea esi, [esp + 0x560]
lea edi, [ebx + 1]
mov ecx, dword [esi]
push ecx
call fcn.00405a87
add esp, 4
add esi, 4
dec edi
jne 0x403afc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14f0
ret
push 0x4f
push 0x411054
call fcn.00404cc0
push 0x411054
call fcn.00404d20
push 0x40e210
call fcn.00404b30
add esp, 0x10
call fcn.00402880
call fcn.00404930
test eax, eax
jne 0x404926
push 0x40e244
push 0x410f50
call fcn.0040598d
add esp, 8
test eax, eax
je 0x4048e2
push eax
call fcn.00405500
add esp, 4
push 1
push 0x410e4c
push 0x410f50
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.00404a20
test eax, eax
je 0x4048f0
call fcn.00401170
call fcn.00403d90
call fcn.00403f80
call fcn.004041c0
call fcn.004043d0
call fcn.004019e0
call fcn.00401970
call fcn.004026f0
call fcn.004020a0
call fcn.00404a20
test eax, eax
je 0x404926
jmp 0x403870
ret