Function at 0x401000
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov ebx, ecx
push eax
mov edi, edx
mov dword [esp + 0x18], ebx
push ebx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp ecx, 0xffffffff
je 0x40128b
mov edx, 0x2e2e
mov esi, eax
nop dword [eax + eax]
mov cx, word [esp + 0x44]
cmp cx, 0x2e
je 0x401254
cmp cx, dx
je 0x401254
mov al, byte [ebx]
xor esi, esi
test byte [esp + 0x18], 0x10
je 0x401195
cmp al, 0x2a
je 0x401097
lea edi, [esp + 0x370]
mov edx, ebx
sub edi, ebx
mov byte [edi + edx], al
lea edx, [edx + 1]
mov al, byte [edx]
inc esi
cmp al, 0x2a
jne 0x401086
mov edi, dword [esp + 0xc]
xor eax, eax
test cl, cl
je 0x4010ba
lea edx, [esp + 0x370]
mov bl, cl
add edx, esi
inc eax
mov byte [edx], bl
lea edx, [edx + 1]
mov bl, byte [esp + eax + 0x44]
test bl, bl
jne 0x4010a8
mov ebx, dword [esp + 0x14]
mov dl, byte [edi]
add eax, esi
xor esi, esi
mov byte [esp + eax + 0x370], 0
cmp dl, 0x2a
je 0x4010f2
mov eax, edi
lea edi, [esp + 0x268]
sub edi, dword [esp + 0xc]
nop word [eax + eax]
mov byte [edi + eax], dl
lea eax, [eax + 1]
mov dl, byte [eax]
inc esi
cmp dl, 0x2a
jne 0x4010e0
mov edi, dword [esp + 0xc]
xor eax, eax
test cl, cl
je 0x40110f
lea edx, [esp + 0x268]
add edx, esi
inc eax
mov byte [edx], cl
lea edx, [edx + 1]
mov cl, byte [esp + eax + 0x44]
test cl, cl
jne 0x401101
add eax, esi
push 0
mov byte [esp + eax + 0x26c], 0
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
cmp byte [esp + 0x370], al
je 0x40113f
inc eax
cmp byte [esp + eax + 0x370], 0
jne 0x401134
mov word [esp + eax + 0x370], 0x2a5c
mov byte [esp + eax + 0x372], 0
xor eax, eax
cmp byte [esp + 0x268], al
je 0x40116b
nop dword [eax]
inc eax
cmp byte [esp + eax + 0x268], 0
jne 0x401160
lea edx, [esp + 0x268]
mov word [esp + eax + 0x268], 0x2a5c
lea ecx, [esp + 0x370]
mov byte [esp + eax + 0x26a], 0
call section..text
jmp 0x401250
cmp al, 0x2a
je 0x4011b5
lea edi, [esp + 0x268]
mov edx, ebx
sub edi, ebx
mov byte [edi + edx], al
lea edx, [edx + 1]
mov al, byte [edx]
inc esi
cmp al, 0x2a
jne 0x4011a4
mov edi, dword [esp + 0xc]
xor eax, eax
test cl, cl
je 0x4011d8
lea edx, [esp + 0x268]
mov bl, cl
add edx, esi
inc eax
mov byte [edx], bl
lea edx, [edx + 1]
mov bl, byte [esp + eax + 0x44]
test bl, bl
jne 0x4011c6
mov ebx, dword [esp + 0x14]
mov dl, byte [edi]
add eax, esi
xor esi, esi
mov byte [esp + eax + 0x268], 0
cmp dl, 0x2a
je 0x40120a
mov eax, edi
lea edi, [esp + 0x370]
sub edi, dword [esp + 0xc]
mov byte [edi + eax], dl
lea eax, [eax + 1]
mov dl, byte [eax]
inc esi
cmp dl, 0x2a
jne 0x4011f8
mov edi, dword [esp + 0xc]
xor eax, eax
test cl, cl
je 0x40122e
lea edx, [esp + 0x370]
add edx, esi
nop dword [eax]
inc eax
mov byte [edx], cl
lea edx, [edx + 1]
mov cl, byte [esp + eax + 0x44]
test cl, cl
jne 0x401220
add eax, esi
push 1
mov byte [esp + eax + 0x374], 0
lea eax, [esp + 0x374]
push eax
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edx, 0x2e2e
test eax, eax
jne 0x401050
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0040135c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x47c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040135c
mov esp, ebp
pop ebp
ret