Function at 0x41c031
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2d8
mov eax, 0x46bdac
call fcn.0042dc79
push str.C:ProgramData
mov edi, 0x104
lea eax, [ebp - 0x118]
xor ebx, ebx
push edi
mov esi, ebx
push eax
mov dword [ebp - 0x2dc], esi
call fcn.00414c25
push 0x471964
push edi
lea eax, [ebp - 0x118]
push eax
call fcn.00414be7
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x168], ebx
xor eax, eax
mov dword [ebp - 0x2e4], edi
mov dword [ebp - 0x164], 7
mov word [ebp - 0x178], ax
mov dword [ebp - 4], ebx
cmp edi, 0xffffffff
jne 0x41c0bb
push ebx
push str.In_Operations::removeMcInstTraceOp_:_Folder_not_present
jmp 0x41c393
test byte [ebp - 0x2d0], 0x10
je 0x41c36c
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x148], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c0e7
sub ecx, edx
lea eax, [ebp - 0x2a4]
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.00404230
push 0xa
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], ecx
jbe 0x41c31a
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
push ecx
cmovae eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x130]
push eax
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], bl
call fcn.00404230
or esi, 1
mov dword [ebp - 0x2dc], esi
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x130]
mov esi, dword [ebp - 0x130]
mov eax, dword [ebp - 0x120]
cmovae ecx, esi
push 0xa
pop edx
cmp eax, edx
cmova eax, edx
push eax
push str.McInstTemp
push ecx
call fcn.0042fe0d
add esp, 0xc
test eax, eax
jne 0x41c2cb
push 0xa
pop ecx
cmp dword [ebp - 0x120], ecx
jb 0x41c2cb
ja 0x41c2cb
push 0xe
push str.C:ProgramData
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 3
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], bl
call fcn.00404230
push 1
push 0x46f9b8
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 4
call fcn.0040ba2e
lea ecx, [ebp - 0x2a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c1f1
sub ecx, edx
lea eax, [ebp - 0x2a4]
push ecx
push eax
lea ecx, [ebp - 0x160]
call fcn.0040ba2e
mov byte [ebp - 0x2e0], bl
lea eax, [ebp - 0x160]
push dword [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004129a6
add esp, 0xc
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 5
push eax
call fcn.0041c3ae
pop ecx
lea ecx, [ebp - 0x190]
call fcn.00403f00
mov eax, dword [ebp - 0x14c]
cmp eax, 0x10
jb 0x41c2be
mov ecx, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d8], ecx
cmp eax, 0x1000
jb 0x41c291
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x2d4]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2d8]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
jmp 0x41c2be
mov esi, dword [ebp - 0x130]
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x11c]
cmp eax, 0x10
jb 0x41c314
inc eax
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d8], eax
cmp eax, 0x1000
jb 0x41c30b
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x2d8]
mov esi, dword [ebp - 0x2d4]
pop ecx
pop ecx
push eax
push esi
call fcn.0042d727
pop ecx
pop ecx
mov esi, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x134]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x41c36c
mov ecx, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], ecx
cmp eax, 0x1000
jb 0x41c363
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x2d8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2d4]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea eax, [ebp - 0x2d0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41c0bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x41c39f
push ebx
push str.In_Operations::removeMcInstTraceOp_:_FindFirstFiles_Error
mov ecx, 0x493f4c
call fcn.0040c5b8
jmp 0x41c3a6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
call fcn.0042dbc6
ret