Function at 0x406330
Capabilities:
Check for software breakpoints
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
push ebx
push esi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x428780]
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push esi
push str.Start_Enumeration:__s
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
call fcn.00404c20
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax*2 + 0xe]
push esi
push 8
push dword [0x42b230]
call edi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4063c7
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x42b230]
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x4063a1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, dword [esp + 0x10]
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
mov eax, ecx
mov dword [esp + 0x14], esi
cmp esi, eax
je 0x4066ae
add esi, 8
mov ecx, esi
call fcn.004059f0
push 0x425c04
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x40667d
push 0x2a
push esi
call fcn.0040822f
mov esi, dword [esp + 0x14]
add esp, 8
xor ecx, ecx
mov word [eax], cx
nop dword [eax]
push 0x425c0c
lea eax, [esp + 0x50]
push eax
call ebx
test eax, eax
je 0x40665c
push 0x425c10
lea eax, [esp + 0x50]
push eax
call ebx
test eax, eax
je 0x40665c
mov eax, dword [esp + 0x20]
test eax, 0x404
jne 0x40665c
xor esi, esi
test al, 0x10
je 0x406540
push dword [esi + 0x422ce8]
lea eax, [esp + 0x50]
push eax
call ebx
test eax, eax
je 0x406658
add esi, 4
cmp esi, 0x144
jb 0x406481
mov eax, dword [esp + 0x10]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, eax
lea esi, [esi*2 + 0xe]
push esi
push 8
push dword [0x42b230]
call edi
mov edi, eax
test edi, edi
jne 0x406500
nop word [eax + eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4064e0
mov eax, dword [esp + 0x10]
lea esi, [edi + 8]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [esp + 0x18], edi
jmp 0x406658
push dword [esi + 0x4228a0]
lea eax, [esp + 0x50]
push eax
call ebx
test eax, eax
je 0x406658
add esi, 4
cmp esi, 0x4c
jb 0x406540
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], 0
je 0x40658f
lea edi, [eax + 2]
xor esi, esi
push dword [esi + 0x422920]
push edi
call ebx
test eax, eax
je 0x406658
add esi, 4
cmp esi, 0xcc
jb 0x406573
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
test ecx, ecx
jne 0x4065a3
test eax, eax
je 0x406658
cmp dword [esp + 0x1c], 0
je 0x4065ba
test eax, eax
jne 0x4065ba
cmp ecx, 0xa00000
jb 0x406658
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 8
push eax
call edi
mov esi, eax
lea eax, [esp + 0x4c]
push eax
call edi
add esi, eax
lea edi, [esi*2 + 2]
push edi
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x406611
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4065f1
mov eax, dword [esp + 0x10]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, esi
call fcn.00405940
test al, al
jne 0x406649
mov ecx, esi
call fcn.00405e10
test eax, eax
jne 0x406649
lock inc dword [0x42b22c]
push esi
push 0
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x406440
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x10]
push edx
push 0
push dword [0x42b230]
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], esi
cmp esi, eax
jne 0x4063f6
cmp dword [esp + 0x1c], 0
je 0x4066d0
mov esi, dword [ebp + 8]
push esi
push str.Finished_Exploring_Large_Files_on:__s
call fcn.00404c20
mov dword [esp + 0x24], 0
jmp 0x40637d
mov ebx, dword [ebp + 8]
push ebx
push str.Finished_Exploring_Small_Files_on:__s
call fcn.00404c20
add esp, 8
push ebx
push 0
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4