Function at 0x404fc0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x14c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x160]
xor ebp, ebp
xor ebx, ebx
cmp edi, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
je 0x4051f8
cmp dword [esp + 0x164], ebp
je 0x4051f8
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x4051f8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebp
mov cl, byte [eax + esi - 1]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x405031
push 0x41115c
push esi
call edi
push str.cnmi
push esi
call edi
push str.____
push esi
call edi
push str..dll
push esi
call edi
push str.cnmi
call ebp
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4051c3
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xc
jne 0x4050c6
movsx edx, byte [esp + ebp + 0x48]
push edx
call fcn.004054e0
add esp, 4
test eax, eax
je 0x4050c6
movsx eax, byte [esp + ebp + 0x49]
push eax
call fcn.004054e0
add esp, 4
test eax, eax
je 0x4050c6
movsx ecx, byte [esp + ebp + 0x4a]
push ecx
call fcn.004054e0
add esp, 4
test eax, eax
je 0x4050c6
movsx edx, byte [esp + ebp + 0x4b]
push edx
call fcn.004054e0
add esp, 4
test eax, eax
je 0x4050c6
inc ebx
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40506d
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
test ebx, ebx
jle 0x4051c3
mov ecx, dword [esp + 0x164]
lea edx, [ebx + ebx*4 + 1]
push edx
push 0x40
mov dword [ecx], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4051c3
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4051c3
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xc
jne 0x40519d
mov edx, dword [esp + 0x14]
movsx eax, byte [esp + edx + 0x48]
lea ebx, [esp + edx + 0x48]
push eax
call fcn.004054e0
add esp, 4
test eax, eax
je 0x40519d
mov ecx, dword [esp + 0x14]
movsx edx, byte [esp + ecx + 0x49]
push edx
call fcn.004054e0
add esp, 4
test eax, eax
je 0x40519d
mov eax, dword [esp + 0x14]
movsx ecx, byte [esp + eax + 0x4a]
push ecx
call fcn.004054e0
add esp, 4
test eax, eax
je 0x40519d
mov edx, dword [esp + 0x14]
movsx eax, byte [esp + edx + 0x4b]
push eax
call fcn.004054e0
add esp, 4
test eax, eax
je 0x40519d
push 5
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add ebp, 5
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405124
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or edi, 0xffffffff
mov dword [esp + 0x18], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
cmp edi, 0xffffffff
je 0x4051d8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x4051fa
test eax, eax
je 0x4051fa
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14c
ret
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret