Function at 0x409620
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4502cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3b0
mov eax, dword [0x46aa78]
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x6c]
mov dword [esp + 0x3b0], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push edi
push ecx
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.00408a30
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
xor eax, eax
mov byte [esp + 0x1a0], 0
mov ecx, 0x40
lea edi, [esp + 0x1a1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebx + 0x1c], 0x10
jb 0x4096a5
mov eax, dword [ebx + 8]
jmp 0x4096a8
lea eax, [ebx + 8]
push 0x104
push eax
lea edx, [esp + 0x1a8]
push edx
call fcn.00430cf0
add esp, 0xc
push 0x456800
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x409700
push eax
jmp 0x409886
cmp byte [esp + 0x8c], 0x2e
je 0x40986d
cmp dword [ebx + 0x1c], 0x10
jb 0x409719
mov eax, dword [ebx + 8]
jmp 0x40971c
lea eax, [ebx + 8]
push 0x104
push eax
lea eax, [esp + 0x2b0]
push eax
call fcn.00430cf0
add esp, 0xc
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x2ac]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ebx, dword [esp + 0x60]
shr ebx, 4
not bl
and bl, 1
je 0x409798
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push str..zip
lea eax, [esp + 0x90]
push eax
call edi
push eax
call fcn.00432a58
add esp, 8
test eax, eax
je 0x409794
push str..xzip
lea ecx, [esp + 0x90]
push ecx
call edi
push eax
call fcn.00432a58
add esp, 8
test eax, eax
jne 0x409798
mov al, 1
jmp 0x40979a
xor al, al
test bl, bl
je 0x409869
test al, al
je 0x409869
push 0
push 0x8000005
push 3
push 0
push 3
push SysReAllocStringLen
lea edx, [esp + 0x2c0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x409869
lea eax, [esp + 0x18]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x409862
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, ecx
or ecx, eax
xor ebx, ebx
or edx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x2a8]
lea edx, [esp + 0x20]
mov dword [esp + 0x28], ecx
push edx
lea ecx, [esp + 0x34]
call fcn.00407a70
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
mov dword [esp + 0x3cc], ebx
call fcn.004090c0
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0x3c4], 0xffffffff
jb 0x409851
mov edx, dword [esp + 0x3c]
push edx
call fcn.00446915
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x60]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409700
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x3bc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x3b4]
call fcn.00430cd9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret