Function at 0x402ea8
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xbcc
xor ecx, ecx
mov dword [0x6231c4], ecx
mov dword [0x6231c8], ecx
mov dword [0x6231d4], ecx
mov eax, 0x41eca0
mov edx, 0x6259fc
call fcn.004038a8
movsx eax, al
test eax, eax
jne 0x402efa
mov edi, 0x41eca0
mov edx, 0x6259f4
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x402ef0
call fcn.00401c60
mov esi, dword [0x6230e4]
xor edx, edx
cmp esi, 0xc80
jne 0x4037d7
mov eax, esi
sub eax, 1
sbb edx, 0
jl 0x402f38
mov eax, 1
mov byte [eax + 0x4b02bf], 0
inc eax
cdq
mov ecx, eax
sub ecx, esi
sbb edx, 0
jl 0x402f22
or ecx, edx
je 0x402f22
movsx eax, byte [0x6231a0]
test eax, eax
jne 0x40343e
test esi, esi
jbe 0x402f59
xor eax, eax
mov byte [eax + 0x4b02c0], 1
inc eax
cmp eax, esi
jb 0x402f4d
xor eax, eax
mov dword [0x6231b8], eax
mov dword [0x6231bc], eax
test esi, esi
jbe 0x4037be
xor ebp, ebp
movzx eax, byte [ebp + 0x4b02c0]
test eax, eax
jne 0x402f91
inc ebp
cmp ebp, esi
jb 0x402f6f
mov esi, dword [0x6231b8]
movsx eax, byte [0x623170]
jmp 0x40305e
mov dword [esp + 0x248], 0
mov dword [esp + 0x258], 0x108
lea eax, [esp + 8]
mov dword [esp + 0x254], eax
lea edx, [esp + 0x240]
push edx
push ebp
push 0x102d
push dword [0x6230e8]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x220], 3
mov dword [esp + 0x230], 0x108
lea eax, [esp + 0x110]
mov dword [esp + 0x22c], eax
lea edx, [esp + 0x218]
push edx
push ebp
push 0x102d
push dword [0x6230e8]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x40303c
mov esi, dword [0x6231b8]
cmp esi, 0x2000
jl 0x40346b
mov byte [0x623170], 1
mov eax, 1
jmp 0x40305e
mov eax, dword [0x6231bc]
cmp eax, 0x10000
jb 0x403676
mov byte [0x623170], 1
mov esi, dword [0x6231b8]
mov eax, 1
xor ebp, ebp
test eax, eax
jne 0x403585
lea ebx, [ebp + 1]
cmp esi, ebx
jl 0x403585
lea esi, [esp + 0x878]
mov edi, dword [ebp*4 + 0x41fec0]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x403081
lea edi, [esp + 0x878]
mov edx, 0x6258cc
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4030a1
lea esi, [esp + 0x770]
mov edi, dword [ebp*4 + 0x427fc0]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4030b9
lea edi, [esp + 0x770]
mov edx, 0x6258cc
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4030d9
lea esi, [esp + 0x668]
lea edi, [esp + 0x770]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4030f1
lea edi, [esp + 0x668]
mov edx, 0x625a04
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x403111
mov ebp, ebx
lea edx, [esp + 0x668]
lea eax, [esp + 0x980]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40342c
mov dword [esp + 0xbc8], ebp
cmp byte [esp + 0x9ac], 0x2e
je 0x403546
xor edx, edx
test edx, edx
jne 0x403407
mov edx, dword [esp + 0x980]
and edx, 0x10
cmp edx, 0x10
jne 0x403238
mov ebp, dword [0x6231b8]
cmp ebp, 0x2000
jge 0x4034fe
push 0x108
call fcn.004065f4
mov dword [ebp*4 + 0x41fec0], eax
push 0x108
call fcn.004065f4
add esp, 8
mov dword [ebp*4 + 0x427fc0], eax
mov esi, dword [ebp*4 + 0x41fec0]
lea edi, [esp + 0x878]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4031b5
mov ecx, dword [0x6231b8]
mov edi, dword [ecx*4 + 0x41fec0]
lea edx, [esp + 0x9ac]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4031dd
mov edx, dword [0x6231b8]
mov esi, dword [edx*4 + 0x427fc0]
lea edi, [esp + 0x770]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4031fb
mov ecx, dword [0x6231b8]
mov edi, dword [ecx*4 + 0x427fc0]
lea edx, [esp + 0x9ac]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x403223
inc dword [0x6231b8]
jmp 0x403407
mov ebp, dword [0x6231bc]
cmp ebp, 0x10000
jge 0x403533
lea eax, [esp + 0xac0]
lea edx, [esp + 0x9ac]
call fcn.00403834
mov edx, dword [0x6231cc]
test edx, edx
jle 0x40352c
xor esi, esi
xor edi, edi
lea ecx, [esp + 0xac0]
lea edx, [edi + 0x621fc0]
push edx
push ecx
call fcn.00406ef0
add esp, 8
test eax, eax
je 0x403521
add edi, 0x10
inc esi
mov edx, dword [0x6231cc]
cmp esi, edx
jl 0x40326f
cmp esi, edx
jne 0x403407
lea esi, [esp + 0x268]
lea edi, [esp + 0x770]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4032b2
lea edi, [esp + 0x268]
lea edx, [esp + 0x9ac]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4032d4
lea edx, [esp + 0x268]
push 0x62504c
push edx
call fcn.0040675f
add esp, 8
mov esi, eax
test esi, esi
je 0x403407
push 2
push 0
push esi
call fcn.00406928
push esi
call fcn.004069e1
mov edi, eax
push esi
call fcn.004068ab
add esp, 0x14
test edi, edi
je 0x403407
push 0x108
call fcn.004065f4
mov dword [ebp*4 + 0x4300c0], eax
push 0x108
call fcn.004065f4
add esp, 8
mov dword [ebp*4 + 0x4701c0], eax
mov esi, dword [ebp*4 + 0x4300c0]
lea edi, [esp + 0x878]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x403353
mov edi, dword [ebp*4 + 0x4300c0]
lea edx, [esp + 0x9ac]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x403375
mov esi, dword [ebp*4 + 0x4701c0]
lea edi, [esp + 0x268]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x40338d
mov esi, dword [ebp*4 + 0x4300c0]
movsx ecx, byte [esi]
test ecx, ecx
je 0x4033cc
movzx edi, cl
movzx edx, byte [edi + 0x41a040]
inc edx
movsx edx, dl
cmp edx, 2
je 0x403519
cmp ecx, 0x2f
jne 0x4033c4
mov byte [esi], 0x5c
inc esi
movsx ecx, byte [esi]
test ecx, ecx
jne 0x4033a5
mov ecx, dword [ebp*4 + 0x4701c0]
movsx edx, byte [ecx]
test edx, edx
je 0x403401
movzx ebp, dl
movzx eax, byte [ebp + 0x41a040]
inc eax
movsx esi, al
cmp esi, 2
je 0x403511
cmp edx, 0x2f
jne 0x4033f9
mov byte [ecx], 0x5c
inc ecx
movsx edx, byte [ecx]
test edx, edx
jne 0x4033da
inc dword [0x6231bc]
lea edx, [esp + 0x980]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403145
mov ebp, dword [esp + 0xbc8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [0x6231b8]
movsx eax, byte [0x623170]
jmp 0x403060
mov eax, 0xffffffff
jmp 0x40344c
mov byte [eax + 0x4b02c0], 1
push 2
push eax
push 0x100c
push dword [0x6230e8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x4037cc
jmp 0x403445
lea edi, [esp + 8]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x403481
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x403479
inc eax
push eax
call fcn.004065f4
pop ecx
lea ebx, [esi + esi]
mov dword [esi*4 + 0x41fec0], eax
lea edi, [esp + 0x110]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4034ac
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4034a4
inc eax
push eax
call fcn.004065f4
pop ecx
mov dword [ebx*2 + 0x427fc0], eax
mov esi, dword [ebx*2 + 0x41fec0]
lea edi, [esp + 8]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4034c6
mov eax, dword [0x6231b8]
mov esi, dword [eax*4 + 0x427fc0]
lea edi, [esp + 0x110]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4034e3
inc dword [0x6231b8]
mov esi, dword [0x6230e4]
jmp 0x402f7a
mov ebp, dword [esp + 0xbc8]
mov byte [0x623170], 1
jmp 0x403425
add ecx, 2
jmp 0x4033fa
add esi, 2
jmp 0x4033c5
mov edx, dword [0x6231cc]
jmp 0x40329c
xor esi, esi
jmp 0x40329c
mov ebp, dword [esp + 0xbc8]
mov byte [0x623170], 1
jmp 0x403425
movsx edx, byte [esp + 0x9ad]
test edx, edx
jne 0x40355c
mov edx, 1
jmp 0x403155
cmp edx, 0x2e
je 0x403568
xor edx, edx
jmp 0x403155
movsx edx, byte [esp + 0x9ae]
test edx, edx
jne 0x40357e
mov edx, 1
jmp 0x403155
xor edx, edx
jmp 0x403155
test esi, esi
jle 0x4035d9
xor esi, esi
xor ebp, ebp
mov eax, dword [esi*4 + 0x41fec0]
test eax, eax
je 0x40359f
push eax
call fcn.00406c7b
pop ecx
mov dword [esi*4 + 0x41fec0], 0
mov eax, dword [ebp + 0x427fc0]
test eax, eax
je 0x4035bb
push eax
call fcn.00406c7b
pop ecx
mov dword [esi*4 + 0x427fc0], 0
add ebp, 4
inc esi
cmp esi, dword [0x6231b8]
jl 0x40358d
movsx eax, byte [0x623170]
test eax, eax
je 0x4035ed
mov eax, 0xffffffff
add esp, 0xbcc
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, dword [0x6231bc]
test esi, esi
jbe 0x40361c
xor ebp, ebp
mov eax, dword [ebp*4 + 0x4300c0]
call fcn.004037f0
mov eax, dword [ebp*4 + 0x4701c0]
call fcn.004037f0
inc ebp
mov esi, dword [0x6231bc]
cmp ebp, esi
jb 0x4035f9
test esi, esi
jbe 0x403650
xor ebp, ebp
mov edi, dword [ebp*4 + 0x4300c0]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x40363b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x403633
mov edx, eax
mov eax, edi
call fcn.00403860
mov dword [ebp*4 + 0x4c03c0], eax
inc ebp
cmp ebp, esi
jb 0x403622
test esi, esi
jbe 0x403669
xor eax, eax
xor edx, edx
mov byte [eax + 0x5c07c0], dl
mov byte [eax + 0x5d08c0], dl
inc eax
cmp eax, esi
jb 0x403656
xor eax, eax
add esp, 0xbcc
pop ebx
pop ebp
pop esi
pop edi
ret
lea eax, [esp + 0xac0]
lea edx, [esp + 8]
call fcn.00403834
mov eax, dword [0x6231cc]
test eax, eax
jle 0x4037b7
xor ebx, ebx
xor esi, esi
lea edx, [esp + 0xac0]
lea eax, [esi + 0x621fc0]
push eax
push edx
call fcn.00406ef0
add esp, 8
test eax, eax
je 0x4037ad
add esi, 0x10
inc ebx
mov eax, dword [0x6231cc]
cmp ebx, eax
jl 0x403697
cmp ebx, eax
je 0x4036d2
mov esi, dword [0x6230e4]
jmp 0x402f7a
lea eax, [esp + 0x110]
push 0x62504c
push eax
call fcn.0040675f
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40370c
push 2
push 0
push ebx
call fcn.00406928
push ebx
call fcn.004069e1
mov esi, eax
push ebx
call fcn.004068ab
add esp, 0x14
test esi, esi
jne 0x403717
mov esi, dword [0x6230e4]
jmp 0x402f7a
lea edi, [esp + 8]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x40372d
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x403725
inc eax
push eax
call fcn.004065f4
pop ecx
mov ebx, dword [0x6231bc]
mov dword [ebx*4 + 0x4300c0], eax
lea edi, [esp + 0x110]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x40375b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x403753
inc eax
push eax
call fcn.004065f4
pop ecx
mov dword [ebx*4 + 0x4701c0], eax
mov esi, dword [ebx*4 + 0x4300c0]
lea edi, [esp + 8]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x403775
mov eax, dword [0x6231bc]
mov esi, dword [eax*4 + 0x4701c0]
lea edi, [esp + 0x110]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x403792
inc dword [0x6231bc]
mov esi, dword [0x6230e4]
jmp 0x402f7a
mov eax, dword [0x6231cc]
jmp 0x4036c3
xor ebx, ebx
jmp 0x4036c3
movsx eax, byte [0x623170]
xor esi, esi
jmp 0x40305e
mov esi, dword [0x6230e4]
jmp 0x402f59
push esi
push 0
push 0x4b02c0
call fcn.0040e80c
add esp, 0xc
jmp 0x402f38