Function at 0x401930
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x270
mov esi, dword [eax + 0x40]
mov dword [ebp - 0x260], eax
add eax, 0x40
mov dword [ebp - 0x26c], eax
cmp eax, esi
je 0x401b10
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [esi + 8]
mov dword [esp + 4], 0x406248
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
je 0x401b30
mov eax, dword [ebp - 0x260]
mov edx, dword [eax + 4]
movzx ecx, word [edx]
test cx, cx
je 0x401ba8
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x401998
sub eax, edx
sar eax, 1
add eax, 1
cmp word [ebx], 0
je 0x4019bf
mov edi, ebx
add edi, 2
cmp word [edi], 0
jne 0x4019b0
sub edi, ebx
sar edi, 1
add eax, edi
lea eax, [eax + eax + 2]
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x401b9b
mov edx, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x268]
jmp 0x4019f3
movzx ecx, word [edx]
add eax, 2
add edx, 2
mov word [eax - 2], cx
test cx, cx
jne 0x4019f0
mov dword [esp], edi
call dword [sym.imp.shlwapi.dll_PathAddBackslashW]
mov edx, edi
sub esp, 4
cmp word [edi], 0
je 0x401a29
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x401a20
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401a30
lea eax, [ebp - 0x25c]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov ebx, eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 0xffffffff
je 0x401b9b
lea edi, [ebp - 0x230]
mov eax, dword [ebp - 0x230]
cmp eax, 0x2e
je 0x401ad8
cmp eax, 0x2e002e
je 0x401b20
test byte [ebp - 0x25c], 0x10
jne 0x401ad8
mov dword [esp], edi
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x401ad8
mov dword [esp + 4], 0x40624c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x401ad8
mov eax, dword [ebp - 0x260]
mov ecx, edi
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call fcn.004018a0
test eax, eax
je 0x401bb2
lea esi, [esi]
lea eax, [ebp - 0x25c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401a70
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov esi, dword [esi]
cmp dword [ebp - 0x26c], esi
jne 0x401960
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [ebp - 0x22c], 0
jne 0x401a86
jmp 0x401ad8
mov dword [esp], ebx
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x401b58
mov dword [esp + 4], 0x40624c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x401b80
lea eax, [ebp - 0x25c]
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x25c]
mov dword [esp + 8], str._.8s.idt
mov dword [esp + 4], 0x104
mov dword [esp], eax
call fcn.00401290
mov eax, dword [ebp - 0x260]
mov ecx, ebx
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call fcn.004018a0
test eax, eax
jne 0x401b02
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
jmp 0x4019a8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
jmp 0x401b9b