Function at 0x436880
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x454], eax
mov dword [eax], 0
call fcn.004365f0
add esp, 4
test eax, eax
jne 0x4368d5
mov eax, dword [ebp - 0x454]
pop edi
mov dword [eax], 1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
push edi
call fcn.004365f0
add esp, 4
test eax, eax
jne 0x43690a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x43690a
mov ecx, dword [ebp - 0x454]
pop edi
mov dword [ecx], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.00461e74
add esp, 8
test eax, eax
jne 0x436934
mov edx, dword [ebp - 0x454]
pop edi
mov dword [edx], 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [ebp - 0x30f]
push 0
push eax
mov byte [ebp - 0x310], 0
call fcn.00440de0
push esi
lea ecx, [ebp - 0x310]
push str._s.
push ecx
call fcn.00440e5a
add esp, 0x18
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x458], eax
cmp eax, 0xffffffff
jne 0x4369a0
mov ecx, dword [ebp - 0x454]
pop edi
mov dword [ecx], 5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.00440de0
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.00440de0
add esp, 0x18
jmp 0x4369e0
test byte [ebp - 0x450], 0x10
jne 0x436a80
push 0
lea ecx, [ebp - 0x108]
push ecx
push str.UtlFile
call fcn.0042a600
lea edx, [ebp - 0x424]
push edx
push esi
lea eax, [ebp - 0x108]
push 0x46c9e8
push eax
call fcn.00440e5a
lea ecx, [ebp - 0x424]
push ecx
push edi
lea edx, [ebp - 0x20c]
push 0x46c9e8
push edx
call fcn.00440e5a
mov eax, dword [ebp + 0x10]
add esp, 0x2c
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x436b44
mov edx, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x454]
push edx
mov dword [ecx], 4
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
mov ecx, 0x46c43c
lea eax, [ebp - 0x424]
jmp 0x436a90
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x436ab0
test dl, dl
je 0x436aac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x436ab0
add eax, 2
add ecx, 2
test dl, dl
jne 0x436a90
xor eax, eax
jmp 0x436ab5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x436b44
mov ecx, 0x46f380
lea eax, [ebp - 0x424]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x436ae8
test dl, dl
je 0x436ae4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x436ae8
add eax, 2
add ecx, 2
test dl, dl
jne 0x436ac8
xor eax, eax
jmp 0x436aed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x436b44
lea eax, [ebp - 0x424]
push eax
push esi
lea ecx, [ebp - 0x108]
push 0x46c9e8
push ecx
call fcn.00440e5a
lea edx, [ebp - 0x424]
push edx
push edi
lea eax, [ebp - 0x20c]
push 0x46c9e8
push eax
call fcn.00440e5a
mov ecx, dword [ebp - 0x454]
mov edx, dword [ebp + 0x10]
push ecx
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00436880
add esp, 0x30
mov eax, dword [ebp - 0x458]
lea edx, [ebp - 0x450]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4369e0
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret