Function at 0x406841
Capabilities:
Enumerate files on windows

Disassembly:
push 0x464
mov eax, 0x44323e
call fcn.0041f670
mov esi, edx
mov dword [ebp - 0x43c], esi
mov ebx, ecx
mov dword [ebp - 0x440], ebx
mov edi, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x438], eax
call fcn.0040739d
mov esi, dword [ebp - 0x438]
lea ecx, [ebp - 0x12]
xor eax, eax
push 0xa
mov dword [ebp - 4], eax
pop ebx
mov eax, esi
xor edx, edx
div ebx
sub ecx, 2
mov esi, eax
lea eax, [edx + 0x30]
mov word [ecx], ax
test esi, esi
jne 0x40688d
mov ebx, dword [ebp - 0x440]
xor eax, eax
mov dword [ebp - 0x448], eax
mov word [ebp - 0x458], ax
lea eax, [ebp - 0x12]
mov dword [ebp - 0x444], 7
cmp ecx, eax
je 0x4068d9
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x458]
call fcn.00408a3d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x470]
xor eax, eax
mov dword [ebp - 0x45c], 7
push 0x454c38
mov dword [ebp - 0x460], eax
mov word [ebp - 0x470], ax
call fcn.00408a16
mov ecx, edi
mov byte [ebp - 4], 2
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x406911
sub ecx, edx
sar ecx, 1
push ecx
push edi
push ecx
lea ecx, [ebp - 0x470]
call fcn.0040a9b3
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040736a
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x448], eax
jbe 0x406990
mov eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0xc8]
jb 0x406990
cmp dword [ebp - 0xc4], 8
lea eax, [ebp - 0xd8]
jb 0x40697b
mov eax, dword [ebp - 0xd8]
push dword [ebp - 0xc8]
push eax
push ecx
lea ecx, [ebp - 0x458]
call fcn.0040a9b3
jmp 0x4069a2
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040a996
push eax
lea ecx, [ebp - 0xf8]
call fcn.0040736a
push str..log
lea edx, [ebp - 0xf8]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x128]
call fcn.00409f18
pop ecx
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x110]
call fcn.0040ae0b
lea ecx, [ebp - 0x128]
call fcn.00403b3f
lea ecx, [ebp - 0xf8]
call fcn.00403b3f
lea ecx, [ebp - 0xd8]
call fcn.00403b3f
lea ecx, [ebp - 0x470]
call fcn.00403b3f
xor eax, eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], al
call fcn.00403b3f
xor eax, eax
push 0x250
push eax
lea eax, [ebp - 0x384]
push eax
call fcn.00421350
add esp, 0xc
lea eax, [ebp - 0x110]
cmp dword [ebp - 0xfc], 8
jb 0x406a42
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x384]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406c8c
mov ecx, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov byte [ebp - 0xcc], al
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xc4], esi
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 6
push eax
push ebx
mov dword [ebp - 0xc0], 0xbaadc0de
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x43c]
mov edi, 0x80
push ebx
lea ecx, [ebp - 0xf8]
call fcn.0040739d
xor eax, eax
mov byte [ebp - 4], 7
push 0xb0
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.00421350
add esp, 0xc
lea edx, [ebp - 0x358]
lea ecx, [ebp - 0xf8]
call fcn.0040aef9
cmp dword [eax + 0x14], 8
jb 0x406adc
mov eax, dword [eax]
sub esp, 0xc
lea ecx, [ebp - 0x434]
push eax
call fcn.00408d93
mov eax, dword [ebp - 0x434]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x434], 0x45483c
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x438], eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x434]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x428], 6
jne 0x406c34
xor eax, eax
push edi
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00421350
xor eax, eax
push eax
call fcn.00426d04
mov dword [ebp - 0xe0], eax
lea edi, [ebp - 0x134]
push 9
xor eax, eax
mov dword [ebp - 0xdc], edx
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.00424c43
lea eax, [ebp - 0x134]
mov edi, 0x80
push eax
lea eax, [ebp - 0xbc]
push edi
push eax
call fcn.004248c3
add esp, 0x24
lea eax, [ebp - 0xbc]
mov ecx, edi
xor ebx, ebx
cmp byte [eax], 0xa
jne 0x406b9e
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x406b97
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov edx, str._r_n
lea ecx, [ebp - 0x434]
call fcn.00409f51
lea edx, [ebp - 0xbc]
mov ecx, eax
call fcn.00409f51
mov edx, str._Message_from_kldw__
mov ecx, eax
call fcn.00409f51
mov ecx, eax
call fcn.00407cf2
mov edx, str.__:_process
mov ecx, eax
call fcn.00409f51
mov ecx, eax
call fcn.00407cf2
mov edx, str._exited_with_code_0x
mov ecx, eax
call fcn.00409f51
mov edx, eax
test edx, edx
jne 0x406c0a
mov ecx, eax
jmp 0x406c11
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x14], eax
mov ecx, edx
push dword [ebp - 0xc0]
call fcn.00407cf2
mov ebx, dword [ebp - 0x43c]
lea ecx, [ebp - 0x3cc]
call fcn.00407442
lea eax, [ebp - 0x3cc]
mov byte [ebp - 4], 9
push eax
mov dword [ebp - 0x3cc], 0x4547fc
call fcn.0041ddbb
pop ecx
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 6
call fcn.00403b3f
lea eax, [ebp - 0x384]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406a9c
push 0xa
pop eax
push esi
mov byte [ebp - 4], al
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x110]
call fcn.00403b3f
call fcn.0041f61a
ret