Function at 0x404e06
Capabilities:
Copy file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1298
call fcn.004058c0
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp esi, 0x13e6
jne 0x404e2c
mov eax, 0x38d6
add dword [0x440534], eax
cmp dword [0x440534], 0xbd8
jne 0x404e43
push 0x401294
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc esi
cmp esi, 0x31a652
jl 0x404e19
call fcn.00404df2
mov eax, dword [0x440534]
xor esi, esi
cmp eax, ebx
jbe 0x404e85
push esi
call fcn.00404c48
cmp dword [0x440534], 0x29
jne 0x404e7b
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x440534]
inc esi
cmp esi, eax
jb 0x404e5c
xor esi, esi
cmp eax, 0x481
jne 0x404eb0
push ebx
push ebx
push 0x4012bc
push 0x4012c8
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov eax, dword [0x440534]
cmp eax, 0x721
je 0x404ef4
inc esi
cmp esi, 0x962be2
jl 0x404e87
cmp eax, 0x19c
jne 0x404f42
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
jmp 0x404f3b
push 0x4012d8
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0x4012f8
push 0x401318
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitThread]
xor esi, esi
cmp esi, 0xab9d
jne 0x404f5c
push 0x4272e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x440530], eax
inc esi
cmp esi, 0x2594b
jl 0x404f44
mov byte [0x4272e8], bl
xor esi, esi
cmp esi, 0x148
jne 0x404f7a
call fcn.00404cf6
inc esi
cmp esi, 0x427fa7
jl 0x404f6d
push 0x416010
push dword [0x440534]
push dword [0x4400e0]
call fcn.00404bfc
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFlags]
cmp esi, 0x2f7e4
jne 0x404faf
call fcn.00404ce8
inc esi
cmp esi, 0x48122
jl 0x404f9b
call fcn.004043d6
cmp dword [0x440534], 0x58c
jne 0x40503f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalShrink]
push ebx
lea eax, [ebp - 0xa98]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
lea eax, [ebp - 0x17c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push ebx
push ebx
push ebx
push ebx
push 0x401350
push 0x4013b0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1298]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebx
push ebx
push ebx
push 0x401414
push 0x401438
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
call fcn.00404ce1
pop esi
xor eax, eax
pop ebx
leave
ret