Function at 0x41620c
Capabilities:
Enumerate files on windows

Disassembly:
push 0x268
mov eax, 0x43db84
call fcn.00429c87
mov eax, dword [ebp + 8]
and dword [ebp - 0x270], 0
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00409ada
and dword [ebp - 4], 0
push str.360Tray
lea eax, [ebx + 0x44]
push eax
call fcn.004031c2
lea ecx, [ebp - 0x268]
lea eax, [ebp - 0x26c]
call fcn.00416b66
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x41627d
test ecx, ecx
jge 0x41626d
push 0x80070057
call fcn.00405487
movzx eax, word [eax]
mov byte [ebp - 0x261], 0
cmp ax, 0x5c
je 0x416284
mov byte [ebp - 0x261], 1
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.004054cf
cmp byte [ebp - 0x261], 0
je 0x4162cd
mov eax, dword [ebp - 0x26c]
mov edi, dword [eax - 0xc]
lea eax, [edi + 1]
push eax
lea esi, [ebp - 0x26c]
mov dword [ebp - 0x268], eax
call fcn.004030e2
push 0x5c
pop ecx
mov word [eax + edi*2], cx
mov eax, dword [ebp - 0x268]
mov edx, esi
call fcn.00403123
lea edi, [ebx + 0x3c]
lea eax, [ebp - 0x26c]
call fcn.00408b96
lea eax, [ebp - 0x274]
push 0x444ffc
push eax
lea ecx, [ebp - 0x26c]
call fcn.00409bd2
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
push ecx
push eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x274]
cmp esi, 0xffffffff
sete byte [ebp - 0x261]
add eax, 0xfffffff0
call fcn.004054cf
cmp byte [ebp - 0x261], 0
je 0x416344
xor esi, esi
mov byte [ebx + 0x28], 0
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.004054cf
mov eax, esi
jmp 0x41654d
test byte [ebp - 0x260], 0x10
je 0x4163aa
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00409ada
push 0x443bfc
push dword [ebp - 0x268]
call fcn.0042617e
test eax, eax
setne al
pop ecx
pop ecx
test al, al
je 0x41639c
push 0x443c00
push dword [ebp - 0x268]
call fcn.0042617e
test eax, eax
setne al
pop ecx
pop ecx
test al, al
je 0x41639c
inc dword [ebp - 0x270]
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.004054cf
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x416344
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x270], 0
jne 0x4163d4
xor esi, esi
inc esi
jmp 0x41632b
mov esi, ebx
call fcn.004167ab
mov esi, dword [ebp - 0x270]
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
mov dword [ebx + 0xc], esi
neg ecx
or ecx, eax
push ecx
call fcn.004250c7
mov dword [ebx + 4], eax
lea eax, [ebp - 0x274]
mov dword [esp], 0x444ffc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebx + 0x28], 1
call fcn.00409bd2
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
push ecx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x274]
sete byte [ebp - 0x261]
add eax, 0xfffffff0
call fcn.004054cf
cmp byte [ebp - 0x261], 0
je 0x416456
xor esi, esi
jmp 0x41632f
xor edi, edi
test byte [ebp - 0x260], 0x10
je 0x416515
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00409ada
mov byte [ebp - 4], 1
push 0x443bfc
push dword [ebp - 0x268]
call fcn.0042617e
test eax, eax
setne al
pop ecx
pop ecx
test al, al
je 0x416503
push 0x443c00
push dword [ebp - 0x268]
call fcn.0042617e
test eax, eax
setne al
pop ecx
pop ecx
test al, al
je 0x416503
lea eax, [ebp - 0x234]
push eax
call fcn.00425946
mov esi, eax
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004250c7
mov ecx, dword [ebx + 4]
mov dword [edi + ecx], eax
push esi
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebx + 4]
push dword [edi + eax]
call fcn.00426770
mov eax, dword [ebx + 4]
mov eax, dword [edi + eax]
xor ecx, ecx
add esp, 0x14
mov word [eax + esi*2 - 2], cx
add edi, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.004054cf
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x416458
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.004054cf
xor eax, eax
inc eax
call fcn.00429d0a
ret 4