Function at 0x41e29d
Capabilities:
Enumerate files on windows
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402ba8
push 0x45c1d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb7c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 4]
test edx, edx
jne 0x41e2d4
xor eax, eax
jmp 0x41e2dc
mov eax, dword [ebx + 8]
sub eax, edx
sar eax, 2
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jge 0x41e3c9
mov esi, ecx
shl esi, 2
cmp dword [esi + edx], 0
je 0x41e3c9
mov edi, dword [esi + edx]
mov dword [ebp - 0x820], edi
cmp byte [edi], 0x2a
jne 0x41e315
inc edi
push edi
mov ecx, 0x474b78
call fcn.00418c1f
jmp 0x41e5d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, dword [ebp - 0x820]
cmp byte [ecx + edi - 1], 0x5c
jne 0x41e55e
cmp dword [0x4727ec], eax
je 0x41e372
push eax
push eax
push 0xbb
call fcn.0042487e
pop ecx
push eax
mov esi, 0x45e2c0
mov ecx, esi
call fcn.00411868
push dword [0x531674]
mov ecx, esi
call fcn.004118d8
mov ebx, eax
mov ecx, esi
call fcn.004118c4
mov dword [0x4727ec], eax
cmp ebx, 1
jne 0x41e3c9
or dword [ebp - 0xa68], 0xffffffff
push 0x40aaf8
push edi
push 0x40aa38
mov ebx, 0x104
push ebx
lea eax, [ebp - 0xa64]
push eax
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
call edi
add esp, 0x14
and byte [ebp - 0x961], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0xa64]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xa68], eax
cmp eax, 0xffffffff
jne 0x41e3da
or dword [ebp - 4], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
mov esi, 0x40aaf4
lea eax, [ebp - 0x934]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41e407
test cl, cl
je 0x41e403
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41e407
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x41e3e5
xor eax, eax
jmp 0x41e40c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41e509
mov esi, 0x40aaf0
lea eax, [ebp - 0x934]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41e441
test cl, cl
je 0x41e43d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41e441
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x41e41f
xor eax, eax
jmp 0x41e446
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41e509
test byte [ebp - 0x960], 0x10
jne 0x41e509
lea eax, [ebp - 0x934]
push eax
push dword [ebp - 0x820]
push 0x40aa38
push ebx
lea eax, [ebp - 0xb70]
push eax
call edi
add esp, 0x14
and byte [ebp - 0xa6d], 0
lea eax, [ebp - 0xb70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x41e509
and byte [ebp - 0x818], 0
lea eax, [ebp - 0xb70]
push eax
call fcn.004267c1
pop ecx
test eax, eax
lea eax, [ebp - 0xb70]
push eax
je 0x41e4d4
push 0x800
lea eax, [ebp - 0x818]
push eax
push 0x45e298
push 0x40aa8c
push 0x40aa78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x41e4f9
call fcn.00426762
pop ecx
test eax, eax
je 0x41e4f9
push 0x800
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0xb70]
push eax
call fcn.00426c55
add esp, 0xc
push 1
lea eax, [ebp - 0x818]
push eax
call fcn.00420650
pop ecx
pop ecx
lea eax, [ebp - 0x960]
push eax
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41e3da
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0xa68], 0xffffffff
or dword [ebp - 4], 0xffffffff
jmp 0x41e5d5
cmp dword [esi + edx], 0
je 0x41e5d5
and byte [ebp - 0x818], 0
push dword [esi + edx]
call fcn.004267c1
pop ecx
test eax, eax
mov eax, dword [ebx + 4]
push dword [esi + eax]
je 0x41e5a1
push 0x800
lea eax, [ebp - 0x818]
push eax
push 0x45e298
push 0x40aa8c
push 0x40aa78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x41e5c5
call fcn.00426762
pop ecx
test eax, eax
je 0x41e5c5
push 0x800
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ebx + 4]
push dword [esi + eax]
call fcn.00426c55
add esp, 0xc
push 0
lea eax, [ebp - 0x818]
push eax
call fcn.00420650
pop ecx
pop ecx
push 1
pop eax
jmp 0x41e3cb