Function at 0x402cbe
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41824c
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x42b028]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov eax, dword [0x42b028]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
cmp byte [0x42be1d], 0
mov edi, ecx
jne 0x402d12
cmp byte [0x42be1e], 0
je 0x402d1a
mov eax, dword [sym.imp.K9PCUhelper.dll_bool_CDlgMainWnd::m_bRunHiddenly]
mov byte [eax], 1
call dword [sym.imp.K9PCUhelper.dll_public_virtual:_int___thiscall_CDlgBaseAppDlg::OnInitDialog_void_]
push 0xfff9f3
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea ecx, [edi + 0x14fc]
mov dword [0x42bbf4], eax
lea eax, [edi + 0x1500]
push ecx
xor ebx, ebx
push eax
mov dword [eax], ebx
call fcn.0040101a
mov esi, edi
call fcn.004037ad
push edi
call fcn.004039a4
push edi
call fcn.00403bd1
push edi
call fcn.00403de2
push edi
call fcn.00403fd4
push edi
call fcn.004041c6
mov ecx, dword [edi + 0x14bc]
mov esi, 0x208
add ecx, esi
mov eax, dword [ecx + 8]
lea edx, [edi + 0x14d4]
push edx
push eax
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
mov ecx, dword [edi + 0x14bc]
add ecx, esi
mov eax, dword [ecx + 8]
lea edx, [edi + 0x14d8]
push edx
push eax
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
mov ecx, dword [edi + 0x14bc]
add ecx, esi
mov eax, dword [ecx + 8]
lea edx, [edi + 0x14dc]
push edx
push eax
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
mov ecx, dword [edi + 0x14bc]
add ecx, esi
mov eax, dword [ecx + 8]
lea edx, [edi + 0x14e0]
push edx
push eax
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
cmp byte [0x42be1d], bl
je 0x402e17
push ebx
mov ecx, edi
call sub.mfc90u.dll_CWnd::ShowWindow
mov esi, edi
call fcn.004051c1
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x80
push 0x466
push dword [edi + 0x20]
call esi
push ebx
push 0x1000
push 0x496
push dword [edi + 0x20]
call esi
jmp 0x4030e7
lea ecx, [esp + 0x14]
call dword [0x419844]
mov dword [esp + 0x298], ebx
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.K9PCUhelper.dll_wchar_t_const____cdecl_GetAppPath_struct_HINSTANCE_____class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____]
pop ecx
pop ecx
push str.DefragReport
lea ecx, [esp + 0x14]
call dword [0x419724]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x29c], 1
mov ebx, dword [sym.imp.K9PCUhelper.dll_enum_PCO_ERROR_CODES___cdecl_STPathAppend_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
push eax
call ebx
pop ecx
pop ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x298], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov esi, 0x42bdb0
push esi
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push str.DefragReport_footer_left.jpg
lea ecx, [esp + 0x14]
mov byte [esp + 0x29c], 2
call dword [0x419724]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2a0], 3
call ebx
pop ecx
pop ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x298], 2
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.K9PCUhelper.dll_enum_PCO_ERROR_CODES___cdecl_DoesPathExists_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
pop ecx
test eax, eax
jne 0x4030d1
lea ecx, [esp + 0x18]
call dword [0x419844]
lea ecx, [esp + 0x18]
mov byte [esp + 0x298], 4
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push ecx
mov byte [esp + 0x2a0], 5
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.DefragReport
call dword [0x419724]
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2a4], 4
call fcn.00402a95
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x29c], 6
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x298], 4
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0x250
lea eax, [esp + 0x38]
push 0
push eax
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x38]
push str..jpg
push eax
lea esi, [esp + 0x28]
call fcn.004063b3
mov eax, dword [eax]
add esp, 0x14
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x2c]
mov esi, eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
cmp esi, 0xffffffff
je 0x4030c7
push 0x41a714
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4030ac
push 0x41a718
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4030ac
test byte [esp + 0x34], 4
jne 0x4030ac
test dword [esp + 0x34], 0x400
jne 0x4030ac
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x29c], 7
call dword [0x419724]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2a0], 8
call ebx
pop ecx
pop ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x298], 7
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x29c], 9
call dword [0x419724]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x2a0], 0xa
call ebx
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0
push dword [esp + 0x14]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x10]
mov byte [esp + 0x298], 4
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402fa3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor ebx, ebx
cmp byte [0x42be1f], 0
je 0x403101
push ebx
push 0x20
push 0x465
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00414918
mov esp, ebp
pop ebp
ret