Function at 0x402b87
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da660
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x420
mov eax, dword [0x524330]
xor eax, ebp
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3e8], ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareDoctor_WebScanning_EngineMachineDrWebEngineSettings
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], 0
sete al
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x4030c5
lea eax, [ebp - 0x315]
mov dword [ebp - 0x314], eax
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00404010
mov byte [ebp - 4], 1
push str.notexist
lea ecx, [ebp - 0x2b8]
call fcn.00403a33
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 2
push str.Scan_VdbPath
lea ecx, [ebp - 0x2d4]
call fcn.00403a33
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3e8]
call fcn.004030ef
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2d4]
call fcn.00404010
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x2b8]
call fcn.00404010
cmp dword [ebp - 0x1c], 0
jne 0x4030b5
cmp dword [ebp - 0x28], 8
jb 0x402cb9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3f8], eax
jmp 0x402cc2
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3f8], eax
push dword [ebp - 0x3f8]
lea ecx, [ebp - 0x14c]
call fcn.004032ef
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 4
or dword [ebp - 0x294], 0xffffffff
push 0x4ee3c8
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.004038b5
add esp, 0xc
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x338], eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x338]
mov eax, dword [eax]
mov dword [ebp - 0x33c], eax
push dword [ebp - 0x33c]
push 0x104
lea eax, [ebp - 0x148]
push eax
call fcn.004020aa
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2d8]
sub eax, 0x10
mov dword [ebp - 0x344], eax
mov ecx, dword [ebp - 0x344]
call fcn.0040110c
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffff
je 0x403024
push 0x4ee3cc
lea ecx, [ebp - 0x29c]
call fcn.00403241
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 6
push 0x4ee3d8
lea ecx, [ebp - 0x298]
call fcn.00403241
mov dword [ebp - 0x408], eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x290]
and eax, 0x10
je 0x402dc3
jmp 0x402e88
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x298]
call fcn.00403dc5
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x35c], eax
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x298]
call fcn.00403419
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jle 0x402e88
push 0
push str.drw9
lea ecx, [ebp - 0x298]
call fcn.0040355e
cmp eax, 0xffffffff
je 0x402e88
push 0
push str..vdb
lea ecx, [ebp - 0x298]
call fcn.0040355e
push eax
push 0
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [ebp - 0x298]
call fcn.004036cc
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x380], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x380]
lea ecx, [ebp - 0x29c]
call fcn.00403d36
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2dc]
sub eax, 0x10
mov dword [ebp - 0x384], eax
mov ecx, dword [ebp - 0x384]
call fcn.0040110c
lea eax, [ebp - 0x290]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402db3
push 0
push str.00000000
lea ecx, [ebp - 0x29c]
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x402f73
mov eax, dword [ebp - 0x29c]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x394], eax
xor eax, eax
cmp dword [ebp - 0x394], 0
sete al
movzx eax, al
test eax, eax
jne 0x402f73
lea eax, [ebp - 0x29c]
push eax
mov ecx, dword [ebp - 0x3e8]
call fcn.00403d36
push ecx
mov ecx, esp
mov dword [ebp - 0x2e0], esp
push 0
call fcn.00403241
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 9
push ecx
mov eax, esp
mov dword [ebp - 0x2e4], esp
mov dword [ebp - 0x3a0], eax
lea eax, [ebp - 0x29c]
push eax
mov ecx, dword [ebp - 0x3a0]
call fcn.00448edc
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x2e8], esp
push 0x4ee400
call fcn.00403241
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x2ec], esp
push 0x4ee404
call fcn.00403241
mov byte [ebp - 4], 7
call fcn.00459e6b
add esp, 0x10
jmp 0x402fe6
push ecx
mov ecx, esp
mov dword [ebp - 0x2f0], esp
push 0
call fcn.00403241
mov dword [ebp - 0x41c], eax
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x2f4], esp
push str.unverified_dir_empty
call fcn.00403241
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x2f8], esp
push 0x4ee424
call fcn.00403241
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push 0x4ee428
call fcn.00403241
mov byte [ebp - 4], 7
call fcn.00459e6b
add esp, 0x10
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x298]
sub eax, 0x10
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x3d4]
call fcn.0040110c
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x29c]
sub eax, 0x10
mov dword [ebp - 0x3d8], eax
mov ecx, dword [ebp - 0x3d8]
call fcn.0040110c
jmp 0x403097
push ecx
mov ecx, esp
mov dword [ebp - 0x300], esp
push 0
call fcn.00403241
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x304], esp
push str.unverified_dir_not_found
call fcn.00403241
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x308], esp
push 0x4ee44c
call fcn.00403241
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x30c], esp
push str.ais_vdv
call fcn.00403241
mov byte [ebp - 4], 4
call fcn.00459e6b
add esp, 0x10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14c]
sub eax, 0x10
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
call fcn.0040110c
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00404010
jmp 0x4030d1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004bc439
leave
ret