Function at 0x404790
Capabilities:
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x150], ebx
test ebx, ebx
je 0x4049c7
push edi
push 0x435f14
lea eax, [ebx + 0x400]
mov byte [ebx], 0
push 0x80000002
mov dword [ebp - 0x154], eax
call fcn.00413e50
mov esi, eax
test esi, esi
je 0x404808
push 0x104
push ebx
push str.DirProductBase
push esi
call fcn.004141c0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebx - 1]
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x404810
mov eax, dword [str.K7TrustedRoots]
lea esi, [ebx + 0x400]
mov dword [ecx], eax
mov eax, dword [0x436af8]
push str..der
mov dword [ecx + 4], eax
mov eax, dword [0x436afc]
push ebx
mov dword [ecx + 8], eax
mov eax, dword [0x436b00]
push 0x436114
push esi
mov dword [ecx + 0xc], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp eax, 0xffffffff
je 0x4049b7
mov edi, eax
cmp byte [ebp - 0x11c], 0x2e
je 0x404992
test byte [ebp - 0x148], 0x10
jne 0x404992
lea eax, [ebp - 0x11c]
push eax
push ebx
push 0x436114
push esi
call fcn.004014f0
lea eax, [ebx + 0x400]
mov dword [ebp - 0x15c], 0
add esp, 0x10
xor esi, esi
xor edi, edi
test eax, eax
je 0x404986
push edi
push edi
push 3
push edi
push 3
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404978
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x158], eax
test eax, eax
je 0x404950
inc eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x404950
push edi
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x158]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404950
push str.ROOT
push 0x20000
push edi
push edi
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov edi, eax
test edi, edi
je 0x404950
push 0
push 3
push dword [ebp - 0x158]
push esi
push 0x10001
push edi
call dword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40496b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x404978
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x154]
jmp 0x40498c
lea esi, [ebx + 0x400]
mov edi, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404873
push dword [ebp - 0x14c]
lea edi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041559f
mov esp, ebp
pop ebp
ret