Function at 0x491580
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4ec35b
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x670f1c]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0x196b6], 0xc
call fcn.00436d30
mov edi, 8
cmp dword [esi + 0x19802], edi
jb 0x4915e1
mov eax, dword [esi + 0x197ee]
jmp 0x4915e7
lea eax, [esi + 0x197ee]
push eax
lea ecx, [esp + 0x20]
call fcn.00406e40
cmp dword [esi + 0x19802], edi
mov dword [esp + 0x280], 0
jb 0x49160c
mov eax, dword [esi + 0x197ee]
jmp 0x491612
lea eax, [esi + 0x197ee]
push eax
lea ecx, [esp + 0x1c]
call fcn.00406e40
push 3
push 0x507d24
lea ecx, [esp + 0x24]
mov byte [esp + 0x288], 1
call fcn.00410bd0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x1f], 0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x49173a
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
test bl, bl
jne 0x491698
lea edx, [esp + 0x24]
push edx
push edi
call ebp
test eax, eax
je 0x49173a
test byte [esp + 0x24], 0x10
jne 0x491660
mov eax, dword [esp + 0x44]
mov ecx, dword [esi + 0x1970e]
cdq
cmp ecx, eax
jne 0x491660
mov eax, dword [esi + 0x19712]
cmp eax, edx
jne 0x491660
mov bl, 1
jmp 0x491660
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x24]
call fcn.00406e40
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x288], 2
call fcn.00410bd0
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x196ca]
push edx
push eax
mov ecx, esi
call fcn.004912c0
test eax, eax
je 0x49170c
cmp dword [esi + 0x198c6], 8
jb 0x4916f6
mov eax, dword [esi + 0x198b2]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
jmp 0x491710
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0x198b2]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
jmp 0x491710
mov bl, byte [esp + 0x17]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x280], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x49173e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x49173e
mov bl, byte [esp + 0x17]
push 9
mov ecx, esi
call fcn.00482e40
test al, al
je 0x491751
mov byte [esi + 0x19508], bl
mov ecx, esi
mov dword [esi + 0x196b6], 1
call fcn.00436d30
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x280], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49178a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x280], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4917b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x270
ret