Function at 0x851e73
Capabilities:
Copy file
Create directory
Delete file
Enumerate files on windows
Move file

Disassembly:
cmp dword [str.0010], 0x30303030
jne 0x851e80
ret
cmp byte [0x4653b4], 0
jne 0x851ea2
push 0
push str._Ctrl__K__BackUp_aborted:
push str.You_have_to__Compile__or_to__Run__before_a_PE_BackUp
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
mov esi, 0x5098a4
mov edi, 0x50a350
cmp byte [esi], 0
je 0x851eb4
movsb byte es:[edi], byte [esi]
jmp 0x851eac
cmp byte [esi], 0x5c
je 0x851ebd
dec esi
dec edi
jmp 0x851eb4
push esi
cmp byte [esi], 0
je 0x851ec6
movsb byte es:[edi], byte [esi]
jmp 0x851ebe
mov byte [edi], 0x5c
inc esi
mov dword [edi], 0x6b636142
mov dword [edi + 4], 0x205c7055
add edi, 7
pop esi
inc esi
cmp byte [esi], 0
je 0x851ee4
movsb byte es:[edi], byte [esi]
jmp 0x851edc
mov byte [edi], 0x2a
inc edi
mov eax, dword [str..EXE.EXE.SCR.DLL.SYSTest.a]
stosd dword es:[edi], eax
mov byte [edi], 0
push edi
push 0x432714
push 0x50a350
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x50a558], eax
pop edi
cmp eax, 0xffffffff
jne 0x851f7d
cmp byte [edi], 0x5c
je 0x851f19
dec edi
jmp 0x851f11
mov byte [edi], 0
push edi
push 0
push 0x50a350
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
mov byte [edi], 0x5c
cmp byte [edi], 0x2a
je 0x851f36
inc edi
jmp 0x851f2e
mov dword [edi], 0x30303030
add edi, 4
mov eax, dword [str..EXE.EXE.SCR.DLL.SYSTest.a]
stosd dword es:[edi], eax
mov byte [edi], 0
mov esi, 0x5098a4
cmp byte [esi], 0
je 0x851f55
inc esi
jmp 0x851f4d
push dword [str..EXE.EXE.SCR.DLL.SYSTest.a]
pop dword [esi]
mov byte [esi + 4], 0
push esi
push 0
push 0x50a350
push 0x5098a4
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop esi
mov byte [esi], 0
jmp 0x851fdc
push 0x432714
push dword [0x50a558]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x851f7d
push dword [0x50a558]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x432740
cmp byte [esi], 0
je 0x851fac
inc esi
jmp 0x851fa4
cmp byte [esi], 0x2e
je 0x851fb4
dec esi
jmp 0x851fac
call fcn.008520b3
mov edi, 0x50a350
cmp byte [edi], 0
je 0x851fc6
inc edi
jmp 0x851fbe
cmp byte [edi], 0x2a
je 0x851fce
dec edi
jmp 0x851fc6
mov eax, dword [esi - 4]
mov dword [0x50a55c], eax
stosd dword es:[edi], eax
jmp 0x851f3f
mov eax, dword [str.0010]
mov ebx, dword [0x50a55c]
bswap eax
bswap ebx
cmp ebx, eax
jb 0x85209a
mov esi, 0x50a350
cmp byte [esi], 0
je 0x852000
inc esi
jmp 0x851ff8
cmp byte [esi], 0x2e
je 0x852008
dec esi
jmp 0x852000
sub esi, 4
mov dword [esi], 0x30303030
mov ebx, esi
sub ebx, 0x50a350
push ebx
push 0x50a350
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x50a350
mov edi, 0x50a454
cmp byte [esi], 0
je 0x852037
movsb byte es:[edi], byte [esi]
jmp 0x85202f
mov byte [edi], 0
pop ebx
lea esi, [ebx + 0x50a354]
call fcn.008520b3
mov eax, dword [str.0010]
mov edx, dword [esi - 4]
bswap eax
bswap edx
cmp edx, eax
ja 0x85207a
push ebx
push 0x50a454
push 0x50a350
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop ebx
cmp eax, 1
jne 0x852078
lea esi, [ebx + 0x50a458]
call fcn.008520b3
jmp 0x85203b
mov esi, 0x50a454
mov edi, 0x50a350
cmp byte [esi], 0
je 0x85208c
movsb byte es:[edi], byte [esi]
jmp 0x852084
mov byte [edi], 0
lea esi, [ebx + 0x50a354]
call fcn.008520e6
push 0
push str.Backup_done_to:
push 0x50a350
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret