Function at 0x41eefd
Capabilities:
Enumerate files on windows
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402b68
push 0x45ea34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb7c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 4]
test edx, edx
jne 0x41ef34
xor eax, eax
jmp 0x41ef3c
mov eax, dword [ebx + 8]
sub eax, edx
sar eax, 2
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jge 0x41f029
mov esi, ecx
shl esi, 2
cmp dword [esi + edx], 0
je 0x41f029
mov edi, dword [esi + edx]
mov dword [ebp - 0x820], edi
cmp byte [edi], 0x2a
jne 0x41ef75
inc edi
push edi
mov ecx, 0x4789e8
call fcn.00419869
jmp 0x41f235
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, dword [ebp - 0x820]
cmp byte [ecx + edi - 1], 0x5c
jne 0x41f1be
cmp dword [0x476650], eax
je 0x41efd2
push eax
push eax
push 0xbb
call fcn.004252ac
pop ecx
push eax
mov esi, 0x460a90
mov ecx, esi
call fcn.00412478
push dword [0x5358f4]
mov ecx, esi
call fcn.004124e8
mov ebx, eax
mov ecx, esi
call fcn.004124d4
mov dword [0x476650], eax
cmp ebx, 1
jne 0x41f029
or dword [ebp - 0xa68], 0xffffffff
push 0x40aad4
push edi
push 0x40aa14
mov ebx, 0x104
push ebx
lea eax, [ebp - 0xa64]
push eax
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
call edi
add esp, 0x14
and byte [ebp - 0x961], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0xa64]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xa68], eax
cmp eax, 0xffffffff
jne 0x41f03a
or dword [ebp - 4], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
mov esi, 0x40aad0
lea eax, [ebp - 0x934]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41f067
test cl, cl
je 0x41f063
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41f067
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x41f045
xor eax, eax
jmp 0x41f06c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41f169
mov esi, 0x40aacc
lea eax, [ebp - 0x934]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41f0a1
test cl, cl
je 0x41f09d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41f0a1
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x41f07f
xor eax, eax
jmp 0x41f0a6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41f169
test byte [ebp - 0x960], 0x10
jne 0x41f169
lea eax, [ebp - 0x934]
push eax
push dword [ebp - 0x820]
push 0x40aa14
push ebx
lea eax, [ebp - 0xb70]
push eax
call edi
add esp, 0x14
and byte [ebp - 0xa6d], 0
lea eax, [ebp - 0xb70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x41f169
and byte [ebp - 0x818], 0
lea eax, [ebp - 0xb70]
push eax
call fcn.00427325
pop ecx
test eax, eax
lea eax, [ebp - 0xb70]
push eax
je 0x41f134
push 0x800
lea eax, [ebp - 0x818]
push eax
push 0x460a68
push 0x40aa68
push 0x40aa54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x41f159
call fcn.004272c6
pop ecx
test eax, eax
je 0x41f159
push 0x800
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0xb70]
push eax
call fcn.00427832
add esp, 0xc
push 1
lea eax, [ebp - 0x818]
push eax
call fcn.004212b0
pop ecx
pop ecx
lea eax, [ebp - 0x960]
push eax
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41f03a
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0xa68], 0xffffffff
or dword [ebp - 4], 0xffffffff
jmp 0x41f235
cmp dword [esi + edx], 0
je 0x41f235
and byte [ebp - 0x818], 0
push dword [esi + edx]
call fcn.00427325
pop ecx
test eax, eax
mov eax, dword [ebx + 4]
push dword [esi + eax]
je 0x41f201
push 0x800
lea eax, [ebp - 0x818]
push eax
push 0x460a68
push 0x40aa68
push 0x40aa54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x41f225
call fcn.004272c6
pop ecx
test eax, eax
je 0x41f225
push 0x800
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ebx + 4]
push dword [esi + eax]
call fcn.00427832
add esp, 0xc
push 0
lea eax, [ebp - 0x818]
push eax
call fcn.004212b0
pop ecx
pop ecx
push 1
pop eax
jmp 0x41f02b