Function at 0x419020
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x457125
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
mov eax, dword [0x471df4]
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x180], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x148]
mov byte [esp + 0x180], 2
cmp eax, ecx
je 0x4190cb
push str.OEM.INF
lea ecx, [esp + 0x1c]
call fcn.0044a442
mov ebp, dword [esp + 0x188]
push eax
lea eax, [esp + 0x18]
mov bl, 3
push ebp
push eax
mov byte [esp + 0x18c], bl
call fcn.0044a691
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x184], 4
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x180], bl
call fcn.0044a3d4
mov byte [esp + 0x180], 2
lea ecx, [esp + 0x18]
jmp 0x419123
push 0x46ae0c
lea ecx, [esp + 0x18]
call fcn.0044a442
mov ebp, dword [esp + 0x188]
push eax
lea ecx, [esp + 0x1c]
mov bl, 5
push ebp
push ecx
mov byte [esp + 0x18c], bl
call fcn.0044a691
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x184], 6
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x180], bl
call fcn.0044a3d4
mov byte [esp + 0x180], 2
lea ecx, [esp + 0x14]
call fcn.0044a3d4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [esp + 0x194]
mov esi, eax
cmp esi, 0xffffffff
je 0x419231
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x24]
call fcn.0044a511
lea ecx, [esp + 0x20]
call fcn.0044a88a
push ebp
lea ecx, [esp + 0x18]
call fcn.0044a442
lea edx, [esp + 0x20]
mov byte [esp + 0x180], 7
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x184], 8
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x180], 7
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x180], 2
call fcn.0044a3d4
lea ecx, [esp + 0x10]
call fcn.0044a88a
mov ecx, dword [esp + 0x190]
mov edx, dword [esp + 0x18c]
mov eax, dword [esp + 0x10]
push ebx
push ecx
push edx
push eax
mov ecx, edi
call fcn.00414160
test eax, eax
je 0x419216
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0044a149
mov ecx, edi
call fcn.00414a30
test eax, eax
jne 0x419216
mov ecx, dword [esp + 0x198]
lea eax, [esp + 0x10]
push eax
call fcn.00449c44
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x38]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41914a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.OTHER.INF
lea ecx, [esp + 0x18]
call fcn.0044a442
push eax
lea edx, [esp + 0x1c]
push ebp
push edx
mov byte [esp + 0x18c], 9
call fcn.0044a691
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x184], 0xa
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x180], 9
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x180], 2
call fcn.0044a3d4
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x4193cf
lea edx, [esp + 0x64]
lea ecx, [esp + 0x20]
push edx
call fcn.0044a511
push str.OTHER_
lea ecx, [esp + 0x2c]
call fcn.0044a442
mov esi, eax
push ebp
lea ecx, [esp + 0x34]
mov byte [esp + 0x184], 0xb
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x188], 0xc
push eax
call fcn.0044a5b7
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x18c], 0xd
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x184], 0xe
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x180], 0xd
call fcn.0044a3d4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x180], 0xc
call fcn.0044a3d4
lea ecx, [esp + 0x30]
mov byte [esp + 0x180], 0xb
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x180], 2
call fcn.0044a3d4
mov eax, dword [esp + 0x190]
mov ecx, dword [esp + 0x18c]
mov edx, dword [esp + 0x10]
push ebx
push eax
push ecx
push edx
mov ecx, edi
call fcn.00414160
test eax, eax
je 0x4193ac
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0044a149
mov ecx, edi
call fcn.00414a30
test eax, eax
jne 0x4193ac
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x19c]
call fcn.00449c44
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4192a4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x180], 1
call fcn.0044a3d4
lea ecx, [esp + 0x10]
mov byte [esp + 0x180], 0
call fcn.0044a3d4
lea ecx, [esp + 0x20]
mov dword [esp + 0x180], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x178]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x174
ret 0x14