Function at 0x433f12
Capabilities:
Enumerate files on windows

Disassembly:
enter 0, 0
pushal
mov dword [0x43f688], 0
mov dword [0x43f68c], 0
mov eax, dword [ebp + 0xc]
mov dword [0x43f690], eax
mov eax, dword [ebp + 0xc]
mov dword [0x43f694], eax
mov eax, dword [ebp + 0x10]
mov dword [0x43f698], eax
mov dword [0x43f69c], 0
mov dword [0x43f6a0], 0
mov dword [0x43f6a4], 0
mov dword [0x43f6a8], 2
mov dword [0x43f6b0], 0
mov dword [0x43f6b4], 0
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x447cff
push dword [ebp + 8]
call sub.KERNEL32.dll_FindFirstFileA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0xffffffff
je 0x434251
mov dword [0x43f6ac], eax
mov edi, 0x447d2b
cmp byte [edi], 0x2e
je 0x4340a0
cmp word [edi], 0x2e2e
je 0x4340a0
mov eax, dword [0x447cff]
test dword [ebp + 0x1c], 8
je 0x43401c
pushal
push edi
mov ebx, 0
pop edi
cmp byte [edi], bl
je 0x433fdc
inc edi
jmp 0x433fd5
mov dword [0x44478f], edi
popal
pushal
push dword [0x44478f]
mov ebx, 0x2e
pop edi
cmp byte [edi], bl
je 0x433ff7
dec edi
jmp 0x433ff0
mov dword [0x44478f], edi
popal
mov ebx, dword [0x44478f]
cmp dword [ebx], 0x6b6e6c2e
je 0x4340a0
cmp dword [ebx], 0x6c72752e
je 0x4340a0
test dword [ebp + 0x1c], 4
jne 0x43403a
test dword [ebp + 0x1c], 2
je 0x43403a
mov dword [0x43f68c], 1
jmp 0x43404c
cmp dword [0x43f68c], 0
jne 0x43404c
test eax, 0x10
je 0x4340a0
jmp 0x434053
test eax, 0x10
jne 0x4340a0
mov edi, 0x447d2b
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, 0
jne 0x43405d
dec edi
mov byte [edi], 0xd
mov byte [edi + 1], 0xa
inc ecx
pushal
push ecx
push dword [0x43f690]
push 0x447d2b
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
inc dword [0x43f6b0]
inc dword [0x43f69c]
inc dword [0x43f6a4]
add dword [0x43f6b4], ecx
add dword [0x43f690], ecx
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x447cff
push dword [0x43f6ac]
call sub.KERNEL32.dll_FindNextFileA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0
je 0x4340c6
jmp 0x433fa6
push ebx
push ecx
push edx
push esi
push edi
push ebp
push dword [0x43f6ac]
call sub.KERNEL32.dll_FindClose
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
test dword [ebp + 0x1c], 4
je 0x434110
mov eax, dword [0x43f690]
mov dword [0x43f694], eax
mov eax, dword [0x43f69c]
mov dword [0x43f688], eax
mov dword [0x43f68c], 1
dec dword [0x43f6a8]
jne 0x433f7f
cmp dword [0x43f6a4], 0
je 0x434251
mov eax, dword [ebp + 0xc]
mov dword [0x43f690], eax
mov eax, dword [0x43f6b0]
mov dword [0x43f6b8], eax
mov eax, dword [ebp + 0x10]
mov dword [0x43f698], eax
pushal
push 0x12c
push 0x43f6c8
push dword [ebp + 8]
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
pushal
push 0x43f6c8
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x43415d
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
dec dword [0x44478b]
mov edi, dword [0x44478b]
dec edi
mov dword [0x43f6bc], edi
inc dword [0x444787]
mov eax, dword [0x444787]
mov dword [0x43f6c0], eax
mov edi, dword [0x43f690]
mov ecx, 0
mov ax, word [edi]
inc edi
inc ecx
cmp ax, 0xa0d
jne 0x4341a1
inc edi
dec ecx
mov esi, dword [0x43f698]
mov eax, dword [0x43f690]
mov dword [esi], eax
mov eax, ecx
mov dword [esi + 4], eax
mov edi, dword [0x43f6bc]
pushal
push dword [esi + 4]
push edi
push dword [0x43f690]
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
add edi, dword [esi + 4]
mov byte [edi], 0
mov edi, esi
add edi, 0x2c
mov ecx, dword [0x43f6c0]
add ecx, dword [esi + 4]
pushal
push ecx
push edi
push 0x43f6c8
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x4486c3
push 0
push 0x43f6c8
call sub.KERNEL32.dll_GetFileAttributesExA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov edi, 0x4486c3
add edi, 0xc
mov eax, dword [edi]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
add dword [0x43f690], eax
add dword [0x43f690], 2
add dword [0x43f698], 0x158
dec dword [0x43f6b8]
jne 0x434196
mov esi, dword [ebp + 0x14]
mov eax, dword [0x43f6b0]
mov dword [esi], eax
mov esi, dword [ebp + 0x18]
mov eax, dword [0x43f6b4]
mov dword [esi], eax
popal
leave
ret 0x18