Function at 0x406850
Capabilities:
Enumerate files on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x40c208]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x10000
mov dword [ebp - 0x25c], esi
call fcn.0040b5c0
mov ebx, eax
add esp, 4
mov dword [ebp - 0x258], ebx
test ebx, ebx
je 0x406b25
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x401e68
push ebx
call edi
push 0
push 0
push 1
push 0
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4068e7
push 0
lea eax, [ebp - 0x264]
push eax
push 0x401d60
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x401d60
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x25c]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401e84
push ebx
call edi
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
je 0x406a9a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
push dword [esi + 0x40c130]
lea eax, [ebp - 0x228]
push eax
call edi
test eax, eax
je 0x406a72
add esi, 4
cmp esi, 0xd8
jb 0x406922
push dword [ebp - 0x25c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x401e8c
push ebx
call esi
lea eax, [ebp - 0x228]
push eax
push ebx
call esi
test byte [ebp - 0x254], 0x10
jne 0x406a72
push 0x401e90
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x406a72
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
js 0x4069f9
lea esi, [ebp - 0x228]
cmp word [esi + eax*2], 0x2e
lea esi, [esi + eax*2]
je 0x4069b9
sub eax, 1
jns 0x4069a2
jmp 0x4069f9
push 0x401ea8
push esi
call edi
test eax, eax
je 0x406a72
push 0x401eb4
push esi
call edi
test eax, eax
je 0x406a72
push 0x401ec0
push esi
call edi
test eax, eax
je 0x406a72
push 0x401d50
push esi
call edi
test eax, eax
je 0x406a72
push 0
push ebx
push 0x40c22c
call fcn.0040b6f0
add esp, 0xc
test eax, eax
jne 0x406a72
nop dword [eax]
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0
push eax
push 0
push 0x40c22c
call fcn.0040b670
mov esi, eax
add esp, 0xc
test esi, esi
je 0x406a5e
push esi
call fcn.00405e30
push esi
call fcn.0040b5f0
lea eax, [ebp - 0x258]
push eax
push 0
push 0x40c22c
call fcn.0040b670
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x406a36
push 0
push ebx
push 0x40c22c
call fcn.0040b6f0
add esp, 0xc
test eax, eax
je 0x406a10
mov esi, dword [ebp - 0x260]
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406920
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x406b1b
cmp dword [0x40c28c], 0
je 0x406b1b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push esi
push 0
push 0xfde9
call edi
mov esi, eax
push esi
call fcn.0040b5c0
add esp, 4
mov dword [ebp - 0x260], eax
push 0
push 0
push esi
mov esi, dword [ebp - 0x25c]
push eax
push esi
call ebx
push eax
push esi
push 0
push 0xfde9
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x260]
push eax
push esi
push 0x401ecc
call fcn.00403150
push esi
call fcn.0040b5f0
mov ebx, dword [ebp - 0x258]
add esp, 0x10
push ebx
call fcn.0040b5f0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b79a
mov esp, ebp
pop ebp
ret