Function at 0x401500
Capabilities:
Enumerate files on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412f6b
mov eax, dword fs:[0]
push eax
mov eax, 0x2780
call fcn.00410460
mov eax, dword [0x41c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x4a8], ax
lea eax, [ebp - 0x4a6]
push eax
call fcn.004051d0
xorps xmm0, xmm0
add esp, 0xc
movdqu xmmword [ebp - 0x24f8], xmm0
movdqu xmmword [ebp - 0x24f8], xmm0
push 0x7d0
lea eax, [ebp - 0x14a8]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004051d0
add esp, 0xc
lea eax, [ebp - 0x24a8]
push 0x7d0
push 0
push eax
call fcn.004051d0
add esp, 0xc
lea eax, [ebp - 0x14a8]
push esi
push str._s
push eax
call fcn.00402220
add esp, 0xc
lea eax, [ebp - 0x14a8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push str._system32_
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x401646
lea eax, [ebp - 0x24ac]
mov dword [ebp - 0x24ac], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x401646
cmp dword [ebp - 0x24ac], 0
je 0x401646
lea ecx, [ebp - 0x14a8]
call fcn.004020f0
push eax
lea eax, [ebp - 0x14a8]
push 0x41995c
push eax
call fcn.00402220
add esp, 0xc
mov ecx, esi
call fcn.004020f0
push eax
jmp 0x401647
push esi
lea eax, [ebp - 0x24a8]
push 0x41995c
push eax
call fcn.00402220
add esp, 0xc
lea eax, [ebp - 0x2788]
push eax
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x24ac], eax
cmp eax, 0xffffffff
jne 0x40168c
push str.Path_not_found
call fcn.00404dad
add esp, 4
jmp 0x401db7
push str.NtQueryInformationFile
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MD5_SHA1_SHA256_Size_ItemType_CreateTime_LastWriteTime_Owner_ItemName_MFTChangeTime_IsPEFile_Signature_n
mov dword [0x41e328], eax
call fcn.00404dad
mov eax, dword [ebp - 0x24ec]
add esp, 4
cmp byte [0x41e324], 0
mov ecx, 1
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
cmovne eax, ecx
mov dword [ebp - 0x24ec], eax
lea esp, [esp]
xorps xmm0, xmm0
lea eax, [ebp - 0x98]
push 0x40
push 0
push eax
movdqu xmmword [ebp - 0x30], xmm0
movdqu xmmword [ebp - 0x20], xmm0
movdqu xmmword [ebp - 0x58], xmm0
movdqu xmmword [ebp - 0x48], xmm0
movq qword [ebp - 0x38], xmm0
call fcn.004051d0
add esp, 0xc
xorps xmm0, xmm0
test byte [ebp - 0x2788], 0x10
movq qword [ebp - 0x24e8], xmm0
je 0x401878
mov ecx, 0x419a78
lea eax, [ebp - 0x275c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401758
test dx, dx
je 0x401754
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401758
add eax, 4
add ecx, 4
test dx, dx
jne 0x401732
xor eax, eax
jmp 0x40175d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401878
mov ecx, 0x419a7c
lea eax, [ebp - 0x275c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401796
test dx, dx
je 0x401792
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401796
add eax, 4
add ecx, 4
test dx, dx
jne 0x401770
xor eax, eax
jmp 0x40179b
sbb eax, eax
or eax, 1
test eax, eax
je 0x401878
lea eax, [ebp - 0x2508]
push eax
lea eax, [ebp - 0x2784]
push eax
call edi
lea eax, [ebp - 0x2518]
push eax
lea eax, [ebp - 0x2774]
push eax
call edi
lea eax, [ebp - 0x24bc]
push eax
lea eax, [ebp - 0x2508]
push eax
push 0
call esi
lea eax, [ebp - 0x24cc]
push eax
lea eax, [ebp - 0x2518]
push eax
push 0
call esi
lea edx, [ebp - 0x4a8]
lea ecx, [ebp - 0x14a8]
call fcn.00401e30
lea eax, [ebp - 0x275c]
push eax
lea eax, [ebp - 0x4a8]
push eax
movzx eax, word [ebp - 0x24c0]
push eax
movzx eax, word [ebp - 0x24c2]
push eax
movzx eax, word [ebp - 0x24c4]
push eax
movzx eax, word [ebp - 0x24c6]
push eax
movzx eax, word [ebp - 0x24ca]
push eax
movzx eax, word [ebp - 0x24cc]
push eax
movzx eax, word [ebp - 0x24b0]
push eax
movzx eax, word [ebp - 0x24b2]
push eax
movzx eax, word [ebp - 0x24b4]
push eax
movzx eax, word [ebp - 0x24b6]
push eax
movzx eax, word [ebp - 0x24ba]
push eax
movzx eax, word [ebp - 0x24bc]
push eax
push str.____Directory__02d__02d__02d__02d:_02d:_02d__02d__02d__02d__02d:_02d:_02d__s___s____N_a_n
call fcn.00404dad
add esp, 0x3c
jmp 0x401d90
mov ecx, 0x419a78
lea eax, [ebp - 0x275c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4018a9
test dx, dx
je 0x4018a5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4018a9
add eax, 4
add ecx, 4
test dx, dx
jne 0x401883
xor eax, eax
jmp 0x4018ae
sbb eax, eax
or eax, 1
test eax, eax
je 0x401d90
mov ecx, 0x419a7c
lea eax, [ebp - 0x275c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4018e7
test dx, dx
je 0x4018e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4018e7
add eax, 4
add ecx, 4
test dx, dx
jne 0x4018c1
xor eax, eax
jmp 0x4018ec
sbb eax, eax
or eax, 1
test eax, eax
je 0x401d90
lea eax, [ebp - 0x275c]
push eax
lea eax, [ebp - 0x24a8]
push eax
lea eax, [ebp - 0x14a8]
push str._s_s
push eax
call fcn.00402220
add esp, 0x10
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14a8]
push eax
call fcn.00402d00
mov byte [ebp - 0x2789], al
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
push str..exe
push esi
call fcn.00404ab2
add esp, 8
test eax, eax
je 0x401980
push str..dll
push esi
call fcn.00404ab2
add esp, 8
test eax, eax
je 0x401980
push str..sys
push esi
call fcn.00404ab2
add esp, 8
test eax, eax
je 0x401980
xor edi, edi
jmp 0x401985
mov edi, 1
lea edx, [ebp - 0x4a8]
lea ecx, [ebp - 0x14a8]
call fcn.00401e30
lea edx, [ebp - 0x2538]
lea ecx, [ebp - 0x14a8]
call fcn.00401f60
lea eax, [ebp - 0x24dc]
push eax
lea eax, [ebp - 0x2538]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401a8b
push 0
lea eax, [ebp - 0x2520]
push eax
lea eax, [ebp - 0x2528]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x401a0e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401d84
mov ecx, esi
call fcn.00402050
test eax, eax
jne 0x401a1d
test edi, edi
je 0x401a22
mov edi, 1
lea eax, [ebp - 0x24e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
lea eax, [ebp - 0x2508]
push eax
lea eax, [ebp - 0x2528]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x2518]
push eax
lea eax, [ebp - 0x2520]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x24bc]
push eax
lea eax, [ebp - 0x2508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea eax, [ebp - 0x24cc]
push eax
lea eax, [ebp - 0x2518]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x401c2e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2a0], ax
lea eax, [ebp - 0x29e]
push eax
call fcn.004051d0
add esp, 0xc
lea eax, [ebp - 0x2a0]
lea ecx, [ebp - 0x24f8]
push eax
lea eax, [ebp - 0x14a8]
push eax
call fcn.00403060
cmp byte [ebp - 0x2789], 0
je 0x401aee
xor esi, esi
movzx eax, byte [ebp + esi - 0x30]
push eax
push str._02X
call fcn.00404dad
inc esi
add esp, 8
cmp esi, 0xf
jle 0x401ad5
push 0x419b54
call fcn.00404dad
add esp, 4
cmp byte [ebp - 0x2789], 1
jne 0x401b29
xor esi, esi
jmp 0x401b10
movzx eax, byte [ebp + esi - 0x58]
push eax
push str._02X
call fcn.00404dad
inc esi
add esp, 8
cmp esi, 0x13
jle 0x401b10
push 0x419b54
call fcn.00404dad
add esp, 4
cmp byte [ebp - 0x2789], 1
jne 0x401b5d
xor esi, esi
movzx eax, byte [ebp + esi - 0x98]
push eax
push str._02X
call fcn.00404dad
inc esi
add esp, 8
cmp esi, 0x1f
jle 0x401b41
push 0x419b54
call fcn.00404dad
add esp, 4
lea eax, [ebp - 0x2a0]
push eax
movzx eax, word [ebp - 0x24d0]
push edi
push eax
movzx eax, word [ebp - 0x24d2]
push eax
movzx eax, word [ebp - 0x24d4]
push eax
movzx eax, word [ebp - 0x24d6]
push eax
movzx eax, word [ebp - 0x24da]
push eax
movzx eax, word [ebp - 0x24dc]
push eax
lea eax, [ebp - 0x275c]
push eax
lea eax, [ebp - 0x4a8]
push eax
movzx eax, word [ebp - 0x24c0]
push eax
movzx eax, word [ebp - 0x24c2]
push eax
movzx eax, word [ebp - 0x24c4]
push eax
movzx eax, word [ebp - 0x24c6]
push eax
movzx eax, word [ebp - 0x24ca]
push eax
movzx eax, word [ebp - 0x24cc]
push eax
movzx eax, word [ebp - 0x24b0]
push eax
movzx eax, word [ebp - 0x24b2]
push eax
movzx eax, word [ebp - 0x24b4]
push eax
movzx eax, word [ebp - 0x24b6]
push eax
movzx eax, word [ebp - 0x24ba]
push eax
movzx eax, word [ebp - 0x24bc]
push eax
push dword [ebp - 0x24e4]
push dword [ebp - 0x24e8]
push 0x419b58
call fcn.00404dad
add esp, 0x64
jmp 0x401d84
cmp byte [ebp - 0x2789], 0
je 0x401c59
xor esi, esi
lea esp, [esp]
movzx eax, byte [ebp + esi - 0x30]
push eax
push str._02X
call fcn.00404dad
inc esi
add esp, 8
cmp esi, 0xf
jle 0x401c40
push 0x419b54
call fcn.00404dad
add esp, 4
cmp byte [ebp - 0x2789], 1
jne 0x401c8a
xor esi, esi
movzx eax, byte [ebp + esi - 0x58]
push eax
push str._02X
call fcn.00404dad
inc esi
add esp, 8
cmp esi, 0x13
jle 0x401c71
push 0x419b54
call fcn.00404dad
add esp, 4
cmp byte [ebp - 0x2789], 1
jne 0x401cbe
xor esi, esi
movzx eax, byte [ebp + esi - 0x98]
push eax
push str._02X
call fcn.00404dad
inc esi
add esp, 8
cmp esi, 0x1f
jle 0x401ca2
push 0x419b54
call fcn.00404dad
movzx eax, word [ebp - 0x24d0]
add esp, 4
push 0
push eax
movzx eax, word [ebp - 0x24d2]
push eax
movzx eax, word [ebp - 0x24d4]
push eax
movzx eax, word [ebp - 0x24d6]
push eax
movzx eax, word [ebp - 0x24da]
push eax
movzx eax, word [ebp - 0x24dc]
push eax
lea eax, [ebp - 0x275c]
push eax
lea eax, [ebp - 0x4a8]
push eax
movzx eax, word [ebp - 0x24c0]
push eax
movzx eax, word [ebp - 0x24c2]
push eax
movzx eax, word [ebp - 0x24c4]
push eax
movzx eax, word [ebp - 0x24c6]
push eax
movzx eax, word [ebp - 0x24ca]
push eax
movzx eax, word [ebp - 0x24cc]
push eax
movzx eax, word [ebp - 0x24b0]
push eax
movzx eax, word [ebp - 0x24b2]
push eax
movzx eax, word [ebp - 0x24b4]
push eax
movzx eax, word [ebp - 0x24b6]
push eax
movzx eax, word [ebp - 0x24ba]
push eax
movzx eax, word [ebp - 0x24bc]
push eax
push dword [ebp - 0x24e4]
push dword [ebp - 0x24e8]
push str._lld_File__02d__02d__02d__02d:_02d:_02d__02d__02d__02d__02d:_02d:_02d__s___s___02d__02d__02d__02d:_02d:_02d__d_Unknown_n
call fcn.00404dad
add esp, 0x60
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x2788]
push eax
push dword [ebp - 0x24ac]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4016e0
push dword [ebp - 0x24ac]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24f8]
test eax, eax
je 0x401e09
mov edi, dword [ebp - 0x24f4]
mov esi, eax
cmp eax, edi
je 0x401e00
mov edx, dword [esi]
or ecx, 0xffffffff
sub edx, 0x10
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x401df0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x418
cmp esi, edi
jne 0x401dd4
mov eax, dword [ebp - 0x24f8]
push eax
call fcn.00404765
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040476a
mov esp, ebp
pop ebp
ret