Function at 0x4231b8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x26c
mov ebx, dword [esp + 0x280]
sub esp, 0xc
push pe_nt_image_headers32
call fcn.006e864c
add esp, 0x10
mov ebp, eax
test ebx, ebx
je 0x4233fe
mov esi, dword [esp + 0x284]
test esi, esi
je 0x4233fe
cmp dword [esp + 0x288], 0
je 0x4233fe
mov eax, dword [esp + 0x28c]
test eax, eax
jle 0x4233fe
lea eax, [eax*4]
sub esp, 4
push eax
push 0
push dword [esp + 0x294]
call fcn.006f003b
add esp, 0x10
sub esp, 0xc
push ebx
call fcn.006f01a0
add esp, 0x10
mov edi, eax
sub esp, 0xc
push esi
call fcn.006f01a0
add esp, 0x10
lea eax, [edi + eax + 0x10]
sub esp, 0xc
push eax
call fcn.006e864c
add esp, 0x10
mov edi, eax
sub esp, 8
push ebx
push edi
call fcn.006f0154
add esp, 0x10
sub esp, 8
push 0
push edi
call fcn.0041e298
add esp, 0x10
test eax, eax
je 0x423641
sub esp, 8
push esi
push edi
call fcn.006f0054
add esp, 0x10
sub esp, 0xc
push edi
call fcn.0042103c
add esp, 0x10
sub esp, 8
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], eax
push eax
call sub.KERNEL32.DLL_FindFirstFileW
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
je 0x423884
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebp
xor edi, edi
lea ebp, [esp + 0x48]
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x28c]
nop word cs:[eax + eax]
test byte [esp + 0x1c], 0x10
jne 0x423348
cmp byte [esp + 0x290], 0
jne 0x4233d6
sub esp, 8
push str..1251
push 0xff
call fcn.006fb8f0
add esp, 0x10
sub esp, 0xc
push ebp
call fcn.006efc40
add esp, 0x10
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.006e864c
add esp, 0x10
mov ebx, eax
sub esp, 4
push esi
mov esi, dword [esp + 0x1c]
push ebp
push ebx
call fcn.006fb500
add esp, 0x10
mov eax, dword [esp + 0x288]
mov dword [eax + edi*4], ebx
mov ebx, dword [esp + 0x28c]
jmp 0x4233d5
cmp byte [esp + 0x290], 0
je 0x4233d6
sub esp, 8
push 0x718134
push ebp
call fcn.006f02d8
add esp, 0x10
test eax, eax
je 0x4233d6
sub esp, 8
push 0x718138
push ebp
call fcn.006f02d8
add esp, 0x10
test eax, eax
je 0x4233d6
sub esp, 8
push str..1251
push 0xff
call fcn.006fb8f0
add esp, 0x10
sub esp, 0xc
push ebp
call fcn.006efc40
add esp, 0x10
mov ebx, eax
inc ebx
sub esp, 0xc
push ebx
call fcn.006e864c
add esp, 0x10
mov esi, eax
sub esp, 4
push ebx
mov ebx, dword [esp + 0x294]
push ebp
push esi
call fcn.006fb500
add esp, 0x10
mov eax, dword [esp + 0x288]
mov dword [eax + edi*4], esi
mov esi, dword [esp + 0x14]
inc edi
cmp edi, ebx
jge 0x423aa0
sub esp, 8
lea eax, [esp + 0x24]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileW
add esp, 8
test eax, eax
jne 0x4232d8
mov bl, 1
jmp 0x423aa2
mov ebx, 0xffffffff
cmp byte [esp + 0x294], 0
je 0x423d10
call fcn.0041fbec
cmp byte [0x7285a8], 0
je 0x42342c
mov al, byte [0x71675f]
test al, al
je 0x423611
sub esp, 4
push 1
push str.VRBS
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423611
sub esp, 4
push 0
push 0x716b75
push str.KiUseful.cpp
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423611
mov dword [0x7286c5], 0x217372
mov dword [0x7286c1], 0x6574656d
mov dword [0x7286bd], 0x61726170
mov dword [0x7286b9], 0x20747570
mov dword [0x7286b5], 0x6e692074
mov dword [0x7286b1], 0x63657272
mov dword [0x7286ad], 0x6f636e49
sub esp, 4
push 0x7286ad
push str.KiFindFilesByMask
push 0x2a3b
push str.KiUseful.cpp
push str.ERRO
push str.__s___s__d__s__:_t_s
push 0x7285a9
call fcn.006f490c
add esp, 0x20
sub esp, 4
push 0x716bc0
push 0x7287b1
push str.KiUseful.cpp
call fcn.0041fe9c
add esp, 0x10
sub esp, 8
push 0x716760
push 0x7288b5
call fcn.006f0154
add esp, 0x10
sub esp, 0xc
push 0x7288b5
call fcn.006f01a0
add esp, 0x10
cmp byte [eax + 0x7288b4], 0x5c
je 0x42352f
mov word [eax + 0x7288b5], 0x5c
sub esp, 8
push 0x7287b1
push 0x7288b5
call fcn.006f0054
add esp, 0x10
sub esp, 8
push 0x716864
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 0
push str.USFL_PROG
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x4235b5
sub esp, 8
push 0x716864
push 0x7289b9
call fcn.006f0154
add esp, 0x10
sub esp, 4
push 1
push str.ERRO
push 0x7289b9
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7289b9
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 1
push 0x716b75
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x423611
sub esp, 4
push 1
push str.ERRO
push 0x7288b5
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
mov dword [0x728ac0], 0
mov dword [0x728ac4], 0
mov dword [0x728ac8], 0
mov ebx, 0xffffffff
test ebp, ebp
jne 0x423d14
jmp 0x423d20
mov ebx, 0xfffffffe
cmp byte [esp + 0x294], 0
je 0x423d00
call fcn.0041fbec
cmp byte [0x7285a8], 0
je 0x42366f
mov al, byte [0x71675f]
test al, al
je 0x423854
sub esp, 4
push 1
push str.VRBS
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423854
sub esp, 4
push 0
push 0x716b75
push str.KiUseful.cpp
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423854
mov dword [0x7286c5], 0x2e6c69
mov dword [0x7286c1], 0x61662029
mov dword [0x7286bd], 0x28687461
mov dword [0x7286b9], 0x50726944
mov dword [0x7286b5], 0x657a696c
mov dword [0x7286b1], 0x616d726f
mov dword [0x7286ad], 0x4e5f694b
sub esp, 4
push 0x7286ad
push str.KiFindFilesByMask
push 0x2a34
push str.KiUseful.cpp
push str.ERRO
push str.__s___s__d__s__:_t_s
push 0x7285a9
call fcn.006f490c
add esp, 0x20
sub esp, 4
push 0x716bc0
push 0x7287b1
push str.KiUseful.cpp
call fcn.0041fe9c
add esp, 0x10
sub esp, 8
push 0x716760
push 0x7288b5
call fcn.006f0154
add esp, 0x10
sub esp, 0xc
push 0x7288b5
call fcn.006f01a0
add esp, 0x10
cmp byte [eax + 0x7288b4], 0x5c
je 0x423772
mov word [eax + 0x7288b5], 0x5c
sub esp, 8
push 0x7287b1
push 0x7288b5
call fcn.006f0054
add esp, 0x10
sub esp, 8
push 0x716864
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 0
push str.USFL_PROG
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x4237f8
sub esp, 8
push 0x716864
push 0x7289b9
call fcn.006f0154
add esp, 0x10
sub esp, 4
push 1
push str.ERRO
push 0x7289b9
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7289b9
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 1
push 0x716b75
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x423854
sub esp, 4
push 1
push str.ERRO
push 0x7288b5
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
mov dword [0x728ac0], 0
mov dword [0x728ac4], 0
mov dword [0x728ac8], 0
mov ebx, 0xfffffffe
test edi, edi
jne 0x423d04
jmp 0x423d10
mov ebx, 0xfffffffd
cmp byte [esp + 0x294], 0
je 0x423cec
sub esp, 4
push pe_nt_image_headers32
push ebp
push str.FindFirstFile
call fcn.0042405c
add esp, 0x10
call fcn.0041fbec
cmp byte [0x7285a8], 0
je 0x4238c8
mov al, byte [0x71675f]
test al, al
je 0x423a78
sub esp, 4
push 1
push str.VRBS
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423a78
sub esp, 4
push 0
push 0x716b75
push str.KiUseful.cpp
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423a78
sub esp, 8
push ebp
push 0x7286ad
call fcn.006f490c
add esp, 0x10
sub esp, 4
push 0x7286ad
push str.KiFindFilesByMask
push 0x2a2d
push str.KiUseful.cpp
push str.ERRO
push str.__s___s__d__s__:_t_s
push 0x7285a9
call fcn.006f490c
add esp, 0x20
sub esp, 4
push 0x716bc0
push 0x7287b1
push str.KiUseful.cpp
call fcn.0041fe9c
add esp, 0x10
sub esp, 8
push 0x716760
push 0x7288b5
call fcn.006f0154
add esp, 0x10
sub esp, 0xc
push 0x7288b5
call fcn.006f01a0
add esp, 0x10
cmp byte [eax + 0x7288b4], 0x5c
je 0x423996
mov word [eax + 0x7288b5], 0x5c
sub esp, 8
push 0x7287b1
push 0x7288b5
call fcn.006f0054
add esp, 0x10
sub esp, 8
push 0x716864
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 0
push str.USFL_PROG
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x423a1c
sub esp, 8
push 0x716864
push 0x7289b9
call fcn.006f0154
add esp, 0x10
sub esp, 4
push 1
push str.ERRO
push 0x7289b9
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7289b9
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 1
push 0x716b75
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x423a78
sub esp, 4
push 1
push str.ERRO
push 0x7288b5
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
mov dword [0x728ac0], 0
mov dword [0x728ac4], 0
mov dword [0x728ac8], 0
mov ebx, 0xfffffffd
jmp 0x423cec
xor ebx, ebx
mov ebp, dword [esp + 0x10]
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x12
setne al
and al, bl
mov ebx, 0xfffffffc
jne 0x423abc
mov ebx, edi
cmp al, 1
jne 0x423cdc
cmp byte [esp + 0x294], 0
mov edi, dword [esp + 0xc]
je 0x423ce0
sub esp, 4
push pe_nt_image_headers32
push ebp
push str.FindNextFile
call fcn.0042405c
add esp, 0x10
call fcn.0041fbec
cmp byte [0x7285a8], 0
je 0x423b07
mov al, byte [0x71675f]
test al, al
je 0x423cb7
sub esp, 4
push 1
push str.VRBS
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423cb7
sub esp, 4
push 0
push 0x716b75
push str.KiUseful.cpp
call fcn.0041fda4
add esp, 0x10
test al, al
jne 0x423cb7
sub esp, 8
push ebp
push 0x7286ad
call fcn.006f490c
add esp, 0x10
sub esp, 4
push 0x7286ad
push str.KiFindFilesByMask
push 0x2a21
push str.KiUseful.cpp
push str.ERRO
push str.__s___s__d__s__:_t_s
push 0x7285a9
call fcn.006f490c
add esp, 0x20
sub esp, 4
push 0x716bc0
push 0x7287b1
push str.KiUseful.cpp
call fcn.0041fe9c
add esp, 0x10
sub esp, 8
push 0x716760
push 0x7288b5
call fcn.006f0154
add esp, 0x10
sub esp, 0xc
push 0x7288b5
call fcn.006f01a0
add esp, 0x10
cmp byte [eax + 0x7288b4], 0x5c
je 0x423bd5
mov word [eax + 0x7288b5], 0x5c
sub esp, 8
push 0x7287b1
push 0x7288b5
call fcn.006f0054
add esp, 0x10
sub esp, 8
push 0x716864
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 0
push str.USFL_PROG
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x423c5b
sub esp, 8
push 0x716864
push 0x7289b9
call fcn.006f0154
add esp, 0x10
sub esp, 4
push 1
push str.ERRO
push 0x7289b9
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7289b9
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
sub esp, 4
push 1
push 0x716b75
push str.ERRO
call fcn.0041fda4
add esp, 0x10
test al, al
je 0x423cb7
sub esp, 4
push 1
push str.ERRO
push 0x7288b5
call fcn.0041ff7c
add esp, 0x10
sub esp, 8
push 0x7288b5
push 0x7285a9
call fcn.0041e0a4
add esp, 0x10
mov dword [0x728ac0], 0
mov dword [0x728ac4], 0
mov dword [0x728ac8], 0
mov ebx, 0xfffffffc
jmp 0x423ce0
mov edi, dword [esp + 0xc]
sub esp, 0xc
push esi
call sub.KERNEL32.DLL_FindClose
add esp, 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x423d00
sub esp, 0xc
push eax
call fcn.006e2f5c
add esp, 0x10
test edi, edi
je 0x423d10
sub esp, 0xc
push edi
call fcn.006e2f5c
add esp, 0x10
test ebp, ebp
je 0x423d20
sub esp, 0xc
push ebp
call fcn.006e2f5c
add esp, 0x10
mov eax, ebx
add esp, 0x26c
pop esi
pop edi
pop ebx
pop ebp
ret