Function at 0x401000
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x54c
mov eax, dword [0x40344c]
push ebx
mov ebx, dword [esp + 0x554]
push ebp
push esi
mov esi, 1
xor ebp, ebp
cmp ebx, esi
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
jle 0x4010cc
mov ecx, dword [esp + 0x564]
lea edi, [ecx + 4]
mov edx, dword [edi]
push 0x403448
push edx
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
jne 0x401055
mov dword [esp + 0x10], 1
jmp 0x4010c0
mov eax, dword [edi]
push 0x403444
push eax
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
jne 0x401070
mov ebp, 1
jmp 0x4010c0
lea ecx, [ebx - 3]
cmp esi, ecx
jne 0x401085
mov edx, dword [edi]
push 0x103
push edx
lea eax, [esp + 0x1c]
jmp 0x4010b7
lea ecx, [ebx - 2]
cmp esi, ecx
jne 0x40109d
mov edx, dword [edi]
push 0xfe
push edx
lea eax, [esp + 0x364]
jmp 0x4010b7
lea ecx, [ebx - 1]
cmp esi, ecx
jne 0x401186
mov edx, dword [edi]
push 0xfe
push edx
lea eax, [esp + 0x464]
push eax
call sub.MSVCRT.dll_strncpy
add esp, 0xc
inc esi
add edi, 4
cmp esi, ebx
jl 0x401037
push str.1.00
push str._n_____________________________________________________________________________________________n_n
call sub.MSVCRT.dll_printf
add esp, 8
cmp ebx, 5
jg 0x4010f0
cmp ebx, 4
jl 0x4010f0
test ebp, ebp
je 0x40119a
push str.Binary_file_search_and_replace_utility_n_n
call sub.MSVCRT.dll_printf
push str.Usage:_FileBinReplace________C__filemask_search_text_new_text_n_n
call sub.MSVCRT.dll_printf
push str.Switches:_n
call sub.MSVCRT.dll_printf
push str._______________Print_this_help._n
call sub.MSVCRT.dll_printf
push str.C______________Case_sensitive_search__by_default_search_is_not_case_sensitive_._n
call sub.MSVCRT.dll_printf
push str.filemask_______The_file_mask_to_be_used_for_the_file_search._Example:_.DLL._n
call sub.MSVCRT.dll_printf
push str.search_text____The_search_text._If_this_text_contains_spaces_the_entire__n
call sub.MSVCRT.dll_printf
push str._______________parameter_must_be_enclosed_in_double_quotes._n
call sub.MSVCRT.dll_printf
push str.new_text_______The_text_to_replace_the_found_search_text._If_this_text_n
call sub.MSVCRT.dll_printf
push str._______________contains_spaces_the_entire_parameter_must_be_enclosed_in_n
call sub.MSVCRT.dll_printf
push str._______________double_quotes._n_n
call sub.MSVCRT.dll_printf
push str._______________IMPORTANT:__If_length_of_the_new_text_differs_from_length_n
call sub.MSVCRT.dll_printf
push str._______________of_the_search_text_the_produced_files_will_also_have_different_n
call sub.MSVCRT.dll_printf
push str._______________length_which_may_lead_to_file_corruption._n_n
call sub.MSVCRT.dll_printf
add esp, 0x38
push 0
call sub.MSVCRT.dll_exit
push str.Invalid_command_line_switch._Run_FileBinReplace____for_help._n
call sub.MSVCRT.dll_printf
add esp, 4
push 1
call sub.MSVCRT.dll_exit
lea ecx, [esp + 0x21c]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
lea eax, [esp + 0x14]
push 0x403040
push eax
call sub.MSVCRT.dll_strstr
mov esi, eax
add esp, 8
test esi, esi
jne 0x4011cd
mov byte [esp + 0x14], al
jmp 0x401207
lea edi, [esi + 1]
push 0x403040
push edi
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
je 0x401204
push 0x403040
push edi
call sub.MSVCRT.dll_strstr
mov esi, eax
push 0x403040
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_strstr
add esp, 0x10
test eax, eax
jne 0x4011e2
mov byte [esi], 0
cmp ebp, 0xffffffff
jne 0x401220
push str.No_files_found._n
call sub.MSVCRT.dll_printf
add esp, 4
push 1
call sub.MSVCRT.dll_exit
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x21c]
test al, 0x12
jne 0x401333
test ah, 0x11
jne 0x401333
mov al, byte [esp + 0x14]
test al, al
je 0x4012d1
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x403040
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x118]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x248]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x4012f7
lea edi, [esp + 0x248]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x248]
push ecx
push str.Processing_file__s..._n
call sub.MSVCRT.dll_printf
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x464]
push edx
lea ecx, [esp + 0x368]
push eax
lea edx, [esp + 0x128]
push ecx
push edx
call fcn.00401370
add esp, 0x18
lea eax, [esp + 0x21c]
push eax
push ebp
call ebx
test eax, eax
jne 0x401226
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x403010
call sub.MSVCRT.dll_printf
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54c
ret