Function at 0x408604
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp byte [esi + 4], 0
jne 0x40866c
cmp byte [esi + 5], 0
je 0x408631
push dword [esi + 0x3ef]
call sub.KERNEL32.dll_FindClose
mov byte [esi + 5], 0
cmp byte [esi + 7], 0
jne 0x40863e
xor eax, eax
jmp 0x408828
lea edx, [ebp - 0x148]
push edx
lea ecx, [esi + 7]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [esi + 0x3ef], edi
cmp edi, 0xffffffff
jne 0x408662
xor eax, eax
jmp 0x408828
mov dl, 1
mov byte [esi + 5], dl
mov byte [esi + 4], dl
jmp 0x40869c
lea eax, [ebp - 0x148]
push eax
push dword [esi + 0x3ef]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x40869c
push dword [esi + 0x3ef]
call sub.KERNEL32.dll_FindClose
xor ecx, ecx
mov byte [esi + 5], cl
mov byte [esi + 4], cl
xor eax, eax
jmp 0x408828
xor edx, edx
mov dword [ebx], edx
test byte [ebp - 0x148], 0x10
je 0x4086ac
or dword [ebx], 1
test byte [ebp - 0x148], 2
je 0x4086b8
or dword [ebx], 8
test byte [ebp - 0x148], 1
je 0x4086c4
or dword [ebx], 4
test byte [ebp - 0x148], 4
je 0x4086d0
or dword [ebx], 2
xor eax, eax
xor edx, edx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x1c], edx
lea eax, [ebp - 8]
lea ecx, [ebp - 0x144]
push eax
push ecx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
test eax, eax
je 0x40876a
lea eax, [ebp - 0x158]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToSystemTime
test eax, eax
je 0x40876a
movzx eax, word [ebp - 0x158]
mov dword [ebx + 0x18], eax
cmp eax, 0x641
jne 0x408738
mov dword [ebx + 0x18], 0x7bc
movzx edx, word [ebp - 0x156]
mov dword [ebx + 0x14], edx
movzx ecx, word [ebp - 0x152]
mov dword [ebx + 0x10], ecx
movzx eax, word [ebp - 0x150]
mov dword [ebx + 0xc], eax
movzx edx, word [ebp - 0x14e]
mov dword [ebx + 8], edx
movzx ecx, word [ebp - 0x14c]
mov dword [ebx + 4], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
test eax, eax
je 0x4087dc
lea ecx, [ebp - 0x158]
push ecx
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_FileTimeToSystemTime
test eax, eax
je 0x4087dc
movzx eax, word [ebp - 0x158]
mov dword [ebx + 0x30], eax
cmp eax, 0x641
jne 0x4087aa
mov dword [ebx + 0x30], 0x7bc
movzx edx, word [ebp - 0x156]
mov dword [ebx + 0x2c], edx
movzx ecx, word [ebp - 0x152]
mov dword [ebx + 0x28], ecx
movzx eax, word [ebp - 0x150]
mov dword [ebx + 0x24], eax
movzx edx, word [ebp - 0x14e]
mov dword [ebx + 0x20], edx
movzx ecx, word [ebp - 0x14c]
mov dword [ebx + 0x1c], ecx
push 0xc8
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebx + 0x3c]
push edx
call fcn.0049b180
add esp, 0xc
xor edx, edx
mov byte [ebx + 0x103], 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x12c]
call fcn.004a5428
push edx
push eax
mov eax, dword [ebp - 0x128]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret