Function at 0x413514
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x425c18
push 0x423b30
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x108c
call fcn.00424930
mov eax, dword [0x428200]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x10a4], edx
xor ebx, ebx
mov dword [ebp - 0x1094], ebx
mov dword [ebp - 0x1098], ebx
mov dword [ebp - 0x109c], ebx
push ebx
push ebx
push ebx
push ebx
mov edi, 0x104
push edi
lea eax, [ebp - 0x63c]
push eax
push 3
lea eax, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wsplitpath_s]
push 0x4094a4
push 0x4094ac
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wmakepath_s]
add esp, 0x3c
lea eax, [ebp - 0x434]
push eax
push 0x4094b0
push 1
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
pop ecx
push eax
call fcn.00424508
add esp, 0xc
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108c]
push eax
push ebx
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x10a0], eax
cmp eax, 0xffffffff
jne 0x41363a
lea eax, [ebp - 0x434]
push eax
push 0x409504
push 1
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
pop ecx
push eax
call fcn.00424508
add esp, 0xc
push dword [ebp - 0x10a0]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004238b0
leave
ret 4
cmp dword [ebp - 0x109c], 0
jne 0x413610
push ebx
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wmakepath_s]
add esp, 0x18
inc dword [ebp - 0x1094]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x108d], bl
push 0x4093d4
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wfopen]
pop ecx
pop ecx
mov esi, eax
push esi
push 0x400
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fgetws]
add esp, 0xc
test eax, eax
je 0x4136c5
push 0x4093f4
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x41368c
mov byte [ebp - 0x108d], 1
push esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
pop ecx
cmp byte [ebp - 0x108d], 0
je 0x413707
lea eax, [ebp - 0x22c]
push eax
push 0x409530
push 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
pop ecx
push eax
call fcn.00424508
add esp, 0xc
push dword [ebp + 8]
mov edx, dword [ebp - 0x10a4]
lea ecx, [ebp - 0x22c]
call fcn.00413098
mov dword [ebp - 4], 0xfffffffe
jmp 0x413748
lea eax, [ebp - 0x108c]
push eax
push dword [ebp - 0x10a0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41363a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x413785
push eax
push 0x409588
push 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
pop ecx
push eax
call fcn.00424508
add esp, 0xc
mov dword [ebp - 0x109c], 1
jmp 0x41363a