Function at 0x4017d0
Capabilities:
Enumerate files on windows
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4ac
movzx ecx, word [edx]
mov dword [ebp - 0x47c], eax
mov ebx, dword [eax + 0x14]
test cx, cx
je 0x401a7a
lea edi, [ebp - 0x470]
mov eax, edx
mov dword [ebp - 0x480], edi
mov edx, edi
lea esi, [esi]
add eax, 2
mov word [edx], cx
add edx, 2
movzx ecx, word [eax]
test cx, cx
jne 0x401808
xor eax, eax
mov dword [edx], 0x2a005c
mov word [edx + 4], ax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x488], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x488]
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x484], eax
je 0x401a6e
lea eax, [ebx + 1]
mov dword [esp + 8], 0x2b0
mov dword [esp + 4], 0
mov dword [ebp - 0x488], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x48c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x490], eax
call eax
mov dword [ebp - 0x494], eax
sub esp, 0xc
mov ebx, eax
mov dword [eax + 0x2a4], 0
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 0
mov eax, dword [ebp - 0x268]
lea edi, [ebx + 0x1c]
lea ecx, [ebx + 0x18]
and edi, 0xfffffffc
lea esi, [ebp - 0x268]
mov dword [ebx + 0x18], eax
sub ecx, edi
mov eax, dword [ebp - 0x1c]
sub esi, ecx
add ecx, 0x250
mov dword [ebx + 0x264], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x47c]
mov edx, dword [ebp - 0x48c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x2a0], 0
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x488]
mov dword [ebx + 0x29c], 0
mov dword [ebx + 0x14], eax
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebx + eax + 0x44]
mov word [edx + eax + 2], cx
add eax, 2
test cx, cx
jne 0x401938
mov eax, dword [ebp - 0x480]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x4019c3
lea eax, [ebx + 0x268]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetFileInformationByHandle]
sub esp, 8
test eax, eax
je 0x4019b7
mov dword [ebx + 0x29c], 1
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x401a38
mov dword [esp + 8], 0x2b0
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x490]
call eax
mov dword [eax + 0x2a4], 0
sub esp, 0xc
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 0
mov dword [ebx], eax
mov ebx, eax
jmp 0x4018c0
mov eax, dword [ebp - 0x484]
mov dword [ebx], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x47c]
mov edi, dword [ebp - 0x494]
mov dword [eax + 0x10], 1
mov dword [eax + 4], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x494], 0
jmp 0x401a50
lea eax, [ebp - 0x470]
mov dword [ebp - 0x480], eax
mov edx, eax
jmp 0x401819