Function at 0x442fc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480ead
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x4bc00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x678], ebx
mov dword [ebp - 4], ebx
xor ecx, ecx
nop
movzx eax, word [ecx + str.C:Users_]
mov word [ebp + ecx - 0x424], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x443000
lea ecx, [ebp - 0x424]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x443020
mov eax, dword [0x496ffc]
mov dword [ecx], eax
mov ax, word [0x497000]
mov word [ecx + 4], ax
xor ecx, ecx
nop
movzx eax, word [ecx + str.C:Users_]
mov word [ebp + ecx - 0x21c], ax
add ecx, 2
test ax, ax
jne 0x443040
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x443060
mov eax, dword [0x49a8d0]
mov dword [edi], eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x67c], edx
cmp edx, 0xffffffff
je 0x4434ae
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x21c]
mov word [ebp + ecx - 0x424], ax
add ecx, 2
test ax, ax
jne 0x4430a0
lea eax, [ebp - 0x674]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x443441
lea ecx, [ebp - 0x648]
call fcn.004640f0
test eax, eax
je 0x4430e5
mov edx, dword [ebp - 0x67c]
jmp 0x4430b8
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ecx + str.C:Users_]
mov word [ebp + ecx - 0x21c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4430f0
lea edx, [ebp - 0x648]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x443110
sub edx, esi
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x443126
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebp - 0x674], 0x10
je 0x4434ae
push 0x48fb30
lea ecx, [ebp - 0x680]
call fcn.0045fcf0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x690]
call fcn.004686b0
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x680]
lea ecx, [ebp - 0x684]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x690]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4431ab
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x680]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4431d1
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, str.C:UsersManageLocal
lea eax, [ebp - 0x21c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x443206
test dx, dx
je 0x443202
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x443206
add eax, 4
add ecx, 4
test dx, dx
jne 0x4431e0
xor eax, eax
jmp 0x44320b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44338a
mov ecx, str.C:UsersDefault_User
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x443246
test dx, dx
je 0x443242
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x443246
add eax, 4
add ecx, 4
test dx, dx
jne 0x443220
xor eax, eax
jmp 0x44324b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44338a
mov ecx, str.C:UsersDefault
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x443286
test dx, dx
je 0x443282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x443286
add eax, 4
add ecx, 4
test dx, dx
jne 0x443260
xor eax, eax
jmp 0x44328b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44338a
mov ecx, str.C:UsersAll_Users
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4432c6
test dx, dx
je 0x4432c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4432c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4432a0
xor eax, eax
jmp 0x4432cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x44338a
mov ecx, str.C:UsersPublic
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x443306
test dx, dx
je 0x443302
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x443306
add eax, 4
add ecx, 4
test dx, dx
jne 0x4432e0
xor eax, eax
jmp 0x44330b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44338a
lea ecx, [ebp - 0x68c]
call fcn.004686b0
mov byte [ebp - 4], 8
or ebx, 1
mov dword [ebp - 0x678], ebx
push eax
mov edx, str.C:Users_
lea ecx, [ebp - 0x688]
call fcn.0045f210
add esp, 4
mov dword [ebp - 4], 9
or ebx, 2
mov dword [ebp - 0x678], ebx
mov eax, dword [eax]
lea ecx, [ebp - 0x21c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x44337d
test dx, dx
je 0x443379
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x44337d
add ecx, 4
add eax, 4
test dx, dx
jne 0x443357
xor eax, eax
jmp 0x443382
sbb eax, eax
or eax, 1
test eax, eax
je 0x44338a
xor bl, bl
jmp 0x44338c
mov bl, 1
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x678]
test cl, 2
je 0x4433d6
and ecx, 0xfffffffd
mov dword [ebp - 0x678], ecx
mov dword [ebp - 4], 0xa
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x688]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4433d6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x678]
mov dword [ebp - 4], 6
test cl, 1
je 0x443411
and ecx, 0xfffffffe
mov dword [ebp - 0x678], ecx
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x68c]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x443411
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
test bl, bl
je 0x44344c
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x684]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44343b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, dword [ebp - 0x678]
mov edx, dword [ebp - 0x67c]
jmp 0x4430b8
lea ecx, [ebp - 0x21c]
call fcn.00463b00
mov byte [ebp - 4], 0xd
jmp 0x443419
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00471083
mov esp, ebp
pop ebp
ret