Function at 0x41da10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x250
push eax
mov dword [ebp - 0x26c], eax
mov esi, edx
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x268], esi
xorps xmm0, xmm0
mov dword [ebp - 0x264], ecx
push eax
mov dword [ebp - 0x270], 0xf
movq qword [ebp - 0x284], xmm0
call fcn.0042a4e0
mov dword [0x457638], 0
add esp, 0xc
mov dword [0x45771c], 0
mov eax, dword [esi + 0x28]
mov byte [ebp - 0x25d], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
test ebx, ebx
jne 0x41daac
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x28]
movzx eax, word [ecx + 4]
cmp word [ebx + eax*2 - 2], 0x2a
jne 0x41dad6
mov edx, 0xffff
mov eax, dword [esi + 0x28]
add word [eax + 4], dx
mov ecx, dword [esi + 0x28]
movzx eax, word [ecx + 4]
cmp word [ebx + eax*2 - 2], 0x2a
je 0x41dac0
movzx edx, word [ecx + 4]
cmp word [ebx + edx*2 - 2], 0x5c
jne 0x41daec
lea eax, [edx - 1]
mov word [ecx + 4], ax
mov ecx, dword [esi + 0x28]
movzx eax, word [ecx + 4]
push 0x78
push 0
push dword [0x45764c]
lea ecx, [ebx + eax*2]
mov eax, dword [0x4441fc]
mov dword [ecx], eax
mov ax, word [0x444200]
mov word [ecx + 4], ax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x41de2e
push dword [0x457708]
xorps xmm0, xmm0
movq qword [edi], xmm0
mov eax, dword [esi + 0x28]
push 0
push 0
mov ax, word [eax + 4]
add ax, 2
mov word [edi + 0xc], ax
mov word [edi + 4], ax
lea eax, [ebp - 0x25c]
push eax
push dword [0x457704]
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
je 0x41de2e
mov esi, 1
mov edx, 0x104
nop dword [eax]
mov ecx, dword [ebp - 0x25c]
mov eax, ecx
shr eax, 4
and al, 1
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x27c], eax
je 0x41dbc5
cmp word [ebp - 0x230], 0x2e
jne 0x41dbb9
mov ax, word [ebp - 0x22e]
test ax, ax
je 0x41dd64
cmp ax, 0x2e
jne 0x41dbb9
cmp word [ebp - 0x22c], 0
je 0x41dd64
test ecx, 0x400
jne 0x41dd64
push 0x457630
lea ecx, [ebp - 0x230]
call fcn.00402470
test eax, eax
jns 0x41dbf6
xor edx, edx
mov dword [0x457630], 0
cmp word [ebp - 0x230], dx
mov eax, 0x104
cmovne edx, eax
jmp 0x41dbfd
movzx edx, word [0x457630]
lea eax, [esi*8]
movzx ecx, word [eax + edi + 4]
mov dword [ebp - 0x280], eax
lea eax, [ecx + edx]
dec ecx
movzx eax, ax
mov dword [ebp - 0x274], eax
lea eax, [edx + 1]
movzx eax, ax
add eax, eax
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebx + ecx*2]
push eax
call fcn.0043c9e0
add esp, 0xc
cmp byte [ebp - 0x27c], 0
jne 0x41dcdd
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x23c]
inc dword [ebp - 0x26c]
mov edx, dword [ebp - 0x240]
add dword [eax + 0x50], ecx
adc dword [eax + 0x54], edx
mov eax, dword [ebp - 0x268]
mov eax, dword [eax + 0x28]
add dword [eax + 8], ecx
mov ecx, dword [ebp - 0x264]
adc dword [eax + 0xc], edx
mov edx, dword [ebp - 0x268]
mov eax, dword [ecx + 0x54]
cmp eax, dword [edx + 0x14]
ja 0x41ddf8
jb 0x41dc98
mov eax, dword [ecx + 0x50]
cmp eax, dword [edx + 0x10]
ja 0x41ddf8
mov eax, dword [ebp - 0x268]
mov edx, ebx
push 0x120089
mov ecx, dword [eax + 0x1c]
call fcn.00403f10
add esp, 4
test al, al
jne 0x41dcd0
cmp dword [0x4574d4], 0
je 0x41ddec
mov ecx, ebx
call fcn.00404090
test al, al
je 0x41ddd6
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41dd64
mov eax, dword [ebp - 0x274]
inc esi
movzx eax, ax
lea ecx, [ebx + eax*2]
mov eax, dword [0x4441fc]
mov dword [ecx - 2], eax
mov ax, word [0x444200]
mov word [ecx + 2], ax
mov eax, dword [ebp - 0x270]
cmp esi, eax
jne 0x41dd2b
add eax, eax
mov dword [ebp - 0x270], eax
shl eax, 3
push eax
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
test edi, edi
je 0x41de04
push dword [0x457708]
lea eax, [ebp - 0x25c]
push 0
push 0
push eax
push dword [0x457704]
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [edi + esi*8], eax
cmp eax, 0xffffffff
jne 0x41ddc5
mov eax, dword [ebp - 0x280]
movzx eax, word [eax + edi + 4]
mov dword [ebx + eax*2 - 2], 0x2a
mov esi, dword [ebp - 0x278]
nop word [eax + eax]
test esi, esi
je 0x41de0a
mov eax, dword [ebp - 0x264]
mov eax, dword [eax + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41de54
lea eax, [ebp - 0x25c]
push eax
push dword [edi + esi*8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, 0x104
test eax, eax
jne 0x41db70
push dword [edi + esi*8]
call dword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, word [edi + esi*8 - 4]
dec esi
mov dword [ebx + eax*2 - 2], 0x2a
jmp 0x41dd70
mov eax, dword [ebp - 0x274]
inc eax
mov word [edi + esi*8 + 4], ax
jmp 0x41db67
mov dword [0x45771c], 5
mov dword [0x457638], 5
jmp 0x41de18
mov dword [0x45771c], 5
jmp 0x41de18
mov dword [0x45771c], 1
jmp 0x41de18
mov esi, dword [ebp - 0x278]
cmp dword [ebp - 0x26c], 0
setne byte [ebp - 0x25d]
test esi, esi
je 0x41de2e
nop dword [eax]
push dword [edi + esi*8]
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esi, 1
jne 0x41de20
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x25d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00428cd6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x264]
call fcn.004036e0
mov dword [0x45771c], 0x4c7
jmp 0x41de18