Function at 0x412ec0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x127c
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1274], eax
push ebx
push ebp
push esi
mov esi, ecx
mov edx, 0x4add24
push edi
push esi
mov ecx, str.FILE
call fcn.00477440
push eax
push 0x400
push 0x4ce800
call fcn.0040a3c0
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
cmp dword [0x4deb74], 2
jne 0x412f46
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call edi
cmp eax, 5
jne 0x412f46
push 0x4ce800
push 1
push 0x40b
push dword [0x4deb68]
call edi
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xa88], ax
lea eax, [esp + 0xa8a]
push eax
call fcn.0048e880
add esp, 0xc
xor eax, eax
mov word [esp + 0x280], ax
push 0x7fe
push eax
lea eax, [esp + 0x28a]
push eax
call fcn.0048e880
add esp, 0xc
mov dword [esp + 0x14], 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
inc eax
mov dword [esp + 0x20], 1
push 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0x1312d00
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x1312d00
push 8
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4132b8
push esi
push ebp
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
xor eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax + eax]
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
lea esi, [eax*2]
add esi, ebp
lea eax, [esp + 0xa80]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push esi
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
inc ecx
add ecx, eax
lea eax, [esp + 0x280]
push 0x4ad2c8
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x30]
mov esi, 1
push eax
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x413263
test esi, esi
je 0x41325f
push 0x4ad2d0
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x413249
push 0x4ad2d4
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x413249
push 0x4ad2dc
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x413249
push str.winsxs
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x413249
test byte [esp + 0x30], 0x10
je 0x413249
push str.recycle
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x413249
push str.wintools
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x413249
push str.systemindex
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x413249
push str.prefetch
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x413249
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0xa84]
push eax
push 0x4ad304
lea eax, [esp + 0x28c]
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x14
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [esp + 0x20]
add eax, esi
mov ecx, dword [esp + 0x1c]
lea eax, [eax*2 + 2]
cmp eax, ecx
jb 0x413190
add ecx, 0x1312d00
push ecx
push ebp
push 8
push dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
test ebp, ebp
je 0x4132a0
inc dword [esp + 0x18]
lea eax, [esp + 0x280]
push eax
lea eax, [esi*2]
add eax, ebp
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
mov edx, 0x4add24
add esi, eax
mov ecx, str.FILE
lea eax, [esp + 0x280]
mov dword [esp + 0x20], esi
push eax
call fcn.00477440
push eax
push 0x400
push 0x4ce800
call fcn.0040a3c0
add esp, 0x10
cmp dword [0x4deb74], 2
jne 0x413230
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
cmp eax, 5
jne 0x413230
push 0x4ce800
push 1
push 0x40b
push dword [0x4deb68]
call esi
cmp dword [0x4c518c], 0
je 0x4132bd
lea ecx, [esp + 0x280]
call fcn.004134f0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x413071
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x18]
jne 0x412ff0
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, 1
mov ecx, dword [esp + 0x1284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x127c
ret
push 0x10
push str.Error_23
push str.No_free_memory.
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x413287
call fcn.004132d0
int3