Function at 0x4012a0
Capabilities:
Accept command line arguments
Enumerate files on windows
Move file
Terminate process

Disassembly:
sub esp, 0x20260
push ebx
push esi
push edi
mov edi, 1
push 0xfffffffffffffff4
mov dword [esp + 0x10], edi
mov esi, 0xa0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4012d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40161d
push ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call main
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x401302
call ebp
mov esi, eax
push esi
push 0x402324
jmp 0x4015ed
cmp dword [esp + 0x18], 2
jae 0x401324
push 0x402288
push ebx
call section..code
add esp, 8
jmp 0x4015d6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + edi*4]
lea edx, [esp + 0x270]
mov edi, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x401330
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x401374
call ebp
mov esi, eax
lea eax, [esp + 0x270]
push eax
push esi
push 0x402048
jmp 0x4015b5
xor eax, eax
jmp 0x401380
movzx ecx, word [esp + eax + 0x270]
mov word [esp + eax + 0x10270], cx
add eax, 2
test cx, cx
jne 0x401380
xor edx, edx
xor esi, esi
lea eax, [esp + 0x270]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x4013ad
mov esi, eax
inc edx
add eax, 2
test cx, cx
jne 0x4013a3
cmp edx, 0x104
jbe 0x4013d4
lea ecx, [esp + 0x270]
push ecx
push 0x402240
push ebx
call section..code
add esp, 0xc
test esi, esi
je 0x4013dd
add esi, 2
jmp 0x4013f2
xor edx, edx
cmp word [esp + 0x272], 0x3a
sete dl
lea esi, [esp + edx*4 + 0x270]
xor edi, edi
cmp word [esp + 0x4c], 0x2e
jne 0x40141c
mov ax, word [esp + 0x4e]
test ax, ax
je 0x40152f
cmp ax, 0x2e
jne 0x40141c
cmp word [esp + 0x50], 0
je 0x40152f
lea eax, [esp + 0x4c]
mov edx, esi
mov ecx, eax
inc edi
sub edx, ecx
jmp 0x401430
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401430
lea ecx, [esp + 0x254]
lea eax, [esp + 0x4c]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401476
test dx, dx
je 0x401472
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401476
add eax, 4
add ecx, 4
test dx, dx
jne 0x401450
xor eax, eax
jmp 0x40147b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40150a
lea edx, [esp + 0x254]
push edx
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40150a
lea edx, [esp + 0x270]
mov ecx, esi
sub ecx, edx
sar ecx, 1
lea eax, [esp + 0x254]
lea edx, [ecx + ecx]
mov ecx, eax
sub edx, ecx
lea edx, [esp + edx + 0x10270]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4014c0
lea edx, [esp + 0x10270]
push edx
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40150a
call ebp
push eax
lea ecx, [esp + 0x10274]
push ecx
lea edx, [esp + 0x278]
push edx
push 0x4020e8
push ebx
call section..code
add esp, 0x14
mov eax, dword [esp + 0x20]
test al, 0x10
je 0x40152f
test eax, 0x400
jne 0x40152f
lea eax, [esp + 0x10270]
push eax
lea ecx, [esp + 0x274]
push ecx
push ebx
call fcn.00401060
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4013f4
call ebp
mov esi, eax
cmp esi, 0x12
jne 0x401554
xor esi, esi
jmp 0x401574
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + edx*4]
push eax
push esi
push 0x4020cc
push 0x4021e0
push ebx
call section..code
add esp, 0x14
test edi, edi
jne 0x401592
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + edx*4]
push eax
push 0x4021a0
push ebx
call section..code
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x4015c3
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + eax*4]
push ecx
call ebp
push eax
push 0x402064
push 0x4021e0
push ebx
call section..code
add esp, 0x14
mov edi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x10], edi
cmp edi, dword [esp + 0x18]
jb 0x401320
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x4015fb
call ebp
push eax
push 0x40218c
push 0x402158
push ebx
call section..code
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40161c
call ebp
push eax
push 0x402140
push 0x402158
push ebx
call section..code
add esp, 0x10
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]