Function at 0x42c2c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af909
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, edx
mov dword [ebp - 0x494], eax
mov ebx, ecx
mov dword [ebp - 0x47c], 0
cmp dword [ebx + 0xa8], 0
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4ac], eax
jne 0x42c338
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x50]
sub eax, 0x10
mov byte [ebp - 0x46e], 1
push eax
call fcn.00405670
add esp, 4
lea edi, [eax + 0x10]
mov dword [ebp - 0x488], edi
mov dword [ebp - 4], 0
mov ecx, dword [edi - 0xc]
lea eax, [ecx - 1]
test eax, eax
js 0x42cd2e
cmp eax, ecx
jg 0x42cd2e
cmp word [edi + eax*2], 0x5c
je 0x42c41b
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x42c391
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x42c3a7
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x42cd38
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x474], eax
mov eax, 0x5f3928
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x474]
test eax, 0xffff0000
jne 0x42c3d6
movzx eax, ax
push eax
call fcn.00403130
jmp 0x42c3e0
push 0x5f3928
call fcn.00406060
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x488]
mov esi, dword [ebp - 0x474]
push dword [esi - 0xc]
push esi
call fcn.00405b30
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42c415
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x488]
mov byte [ebp - 4], 3
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x42c431
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x42c447
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x42cd42
mov eax, dword [ecx]
call dword [eax + 0xc]
push 1
push 0x5f5268
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x490], eax
lea eax, [ebp - 0x490]
push edi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x490]
lea eax, [ebp - 0x46c]
add esp, 0x14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea edx, [esi - 0x10]
mov dword [ebp - 0x490], eax
or esi, 0xffffffff
mov dword [ebp - 0x47c], 0
mov byte [ebp - 4], 0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42c4c1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x490]
cmp eax, 0xffffffff
je 0x42cd07
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x42cd4c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x478], eax
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x490]
push 0
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c50b
mov byte [ebp - 0x46e], al
jmp 0x42ccdc
test byte [ebp - 0x46c], 0x10
je 0x42c6a5
cmp word [ebp - 0x440], 0x2e
jne 0x42c546
mov ax, word [ebp - 0x43e]
test ax, ax
je 0x42ccc6
cmp ax, 0x2e
jne 0x42c546
cmp word [ebp - 0x43c], 0
je 0x42ccc6
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 5
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x42c566
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x42c57c
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x42cd56
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp - 0x47c]
lea ecx, [ebp - 0x440]
add eax, 0x10
lea edx, [ecx + 2]
or esi, 2
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x47c], esi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c5a2
sub ecx, edx
lea eax, [ebp - 0x440]
sar ecx, 1
push ecx
push eax
push dword [edi - 0xc]
lea eax, [ebp - 0x498]
push edi
push eax
call fcn.00416370
mov eax, dword [ebp - 0x498]
add esp, 0x14
mov ecx, dword [ebx + 0x50]
sub ecx, 0x10
mov dword [ebp - 0x474], ecx
lea edx, [eax - 0x10]
mov dword [ebp - 0x484], edx
cmp edx, ecx
je 0x42c65a
add ecx, 0xc
mov dword [ebp - 0x48c], ecx
cmp dword [ecx], 0
jl 0x42c648
mov eax, dword [ebp - 0x474]
mov ecx, dword [edx]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x498]
jne 0x42c648
push edx
call fcn.00405670
mov edx, dword [ebp - 0x48c]
add esp, 4
mov dword [ebp - 0x480], eax
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42c640
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x480]
add eax, 0x10
mov dword [ebx + 0x50], eax
jmp 0x42c654
push dword [eax - 0xc]
lea ecx, [ebx + 0x50]
push eax
call fcn.00402d30
mov edx, dword [ebp - 0x484]
and esi, 0xfffffffd
mov byte [ebp - 4], 4
mov dword [ebp - 0x47c], esi
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c67c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
mov edx, dword [ebp - 0x494]
mov ecx, ebx
call fcn.0042c2c0
test al, al
jne 0x42ccc0
mov byte [ebp - 0x46e], al
jmp 0x42ccc0
mov byte [ebp - 4], 6
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x42c6bb
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x42c6d1
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x42cd60
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp - 0x47c]
lea ecx, [ebp - 0x440]
add eax, 0x10
lea edx, [ecx + 2]
or esi, 4
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x47c], esi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c6f7
sub ecx, edx
lea eax, [ebp - 0x440]
sar ecx, 1
push ecx
push eax
push dword [edi - 0xc]
lea eax, [ebp - 0x49c]
push edi
push eax
call fcn.00416370
mov eax, dword [ebp - 0x49c]
add esp, 0x14
mov ecx, dword [ebp - 0x478]
add ecx, 0xfffffff0
mov dword [ebp - 0x484], ecx
lea edx, [eax - 0x10]
mov dword [ebp - 0x474], edx
cmp edx, ecx
je 0x42c7b8
add ecx, 0xc
mov dword [ebp - 0x480], ecx
cmp dword [ecx], 0
jl 0x42c7a3
mov eax, dword [ebp - 0x484]
mov ecx, dword [edx]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x49c]
jne 0x42c7a3
push edx
call fcn.00405670
mov edx, dword [ebp - 0x480]
add esp, 4
mov dword [ebp - 0x48c], eax
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42c798
mov eax, dword [ebp - 0x484]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x48c]
add eax, 0x10
mov dword [ebp - 0x478], eax
jmp 0x42c7b2
push dword [eax - 0xc]
lea ecx, [ebp - 0x478]
push eax
call fcn.00402d30
mov edx, dword [ebp - 0x474]
and esi, 0xfffffffb
mov byte [ebp - 4], 4
mov dword [ebp - 0x47c], esi
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c7da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebx + 0xc]
push eax
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x484], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x478]
mov edx, dword [ebx + 0x50]
sub edx, 0x10
mov dword [ebp - 0x474], edx
lea ecx, [eax - 0x10]
mov dword [ebp - 0x480], ecx
cmp ecx, edx
je 0x42c878
cmp dword [edx + 0xc], 0
lea esi, [edx + 0xc]
mov dword [ebp - 0x48c], esi
mov esi, dword [ebp - 0x47c]
jl 0x42c86c
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x42c86c
push dword [ebp - 0x480]
call fcn.00405670
mov dword [ebp - 0x480], eax
add esp, 4
mov eax, dword [ebp - 0x48c]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42c85e
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x480]
add eax, 0x10
mov dword [ebx + 0x50], eax
jmp 0x42c878
push dword [eax - 0xc]
lea ecx, [ebx + 0x50]
push eax
call fcn.00402d30
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
cmp byte [0x62b64e], 0
mov byte [ebp - 0x46d], 0
je 0x42c9bf
push 0x104
mov byte [ebp - 4], 7
lea eax, [ebp - 0x21c]
push dword [ebp - 0x478]
push 0x104
push eax
call fcn.00590c06
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [ebp - 0x494]
test eax, eax
je 0x42c983
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x42c8eb
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x42c901
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x42cd6a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
or esi, 8
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x478]
push 0x11
push str.__Protected_File_
mov dword [ebp - 0x47c], esi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00416370
add esp, 0x14
lea eax, [ebp - 0x4a0]
lea ecx, [ebx + 0x18c]
push eax
push dword [ecx + 8]
call fcn.0044c8e6
mov byte [ebp - 4], 7
and esi, 0xfffffff7
mov edx, dword [ebp - 0x4a0]
or eax, 0xffffffff
mov dword [ebp - 0x47c], esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c978
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov byte [ebp - 0x46e], 0
jmp 0x42c989
mov al, byte [ebp - 0x46d]
mov dword [ebp - 4], 4
test al, al
jne 0x42cc59
jmp 0x42c9bf
push dword [ebp - 0x4a4]
mov esi, 3
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x42c9eb
push 0
push 0
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp byte [0x62b64e], 0
mov dword [ebp - 0x48c], eax
je 0x42ca1f
cmp eax, 0xffffffff
je 0x42ca1f
test eax, 0x4a00
jne 0x42cc59
push 0x80
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push SysReAllocString
xor eax, eax
cmp byte [ebx + 0x206], al
push 3
push 0
cmovne eax, esi
push eax
push 0xc0000000
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea esi, [ebx + 0x84]
cmp eax, 0xffffffff
mov dword [esi], eax
mov dword [ebp - 0x4a4], esi
setne byte [ebp - 0x46d]
je 0x42cc22
lea ecx, [ebp - 0x4b4]
push ecx
lea ecx, [ebp - 0x4bc]
push ecx
lea ecx, [ebp - 0x4c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [ebx + 0x8c]
mov dword [ebp - 0x480], eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx + 0x88], eax
cmp eax, 0xffffffff
jne 0x42cac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42cac8
mov byte [ebp - 0x46d], 0
jmp 0x42cbf4
mov edx, dword [ebx + 0xac]
mov eax, 0x200
mov ecx, dword [ebx + 0xa8]
cmp edx, eax
cmova eax, edx
cmp ecx, eax
ja 0x42caec
mov ecx, 0x200
cmp edx, ecx
cmova ecx, edx
mov edx, dword [ebx + 0x88]
xor eax, eax
mov edi, dword [ebx + 0x8c]
add edx, ecx
mov dword [ebp - 0x474], edi
adc dword [ebp - 0x474], eax
add edx, 0xffffffff
adc dword [ebp - 0x474], 0xffffffff
add ecx, 0xffffffff
not ecx
adc eax, 0xffffffff
and edx, ecx
mov ecx, dword [ebp - 0x474]
not eax
and ecx, eax
cmp ecx, edi
mov edi, dword [ebp - 0x488]
jb 0x42cbf4
mov eax, dword [ebx + 0x88]
ja 0x42cb44
cmp edx, eax
jbe 0x42cbf4
mov edi, dword [ebx + 0x8c]
sub edx, eax
mov dword [ebx + 0x90], eax
mov byte [ebp - 4], 0xa
sbb ecx, edi
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x88], edx
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x98], edx
mov eax, dword [eax + 0xa5]
push ebx
call eax
mov edi, dword [ebp - 0x488]
add esp, 4
mov byte [ebp - 0x46d], al
mov dword [ebp - 4], 4
jmp 0x42cbd5
push 0
lea eax, [ebx + 0x94]
push eax
push dword [ebx + 0x90]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x480], 0
je 0x42cc1a
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x4c4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48c]
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [ebp - 0x46d], 0
jne 0x42cc59
lea eax, [ebp - 0x478]
lea ecx, [ebx + 0x18c]
push eax
push dword [ecx + 8]
call fcn.0044c8e6
mov byte [ebp - 0x46e], 0
push dword [ebp - 0x484]
inc dword [ebx + 0x1dc]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
imul eax, dword [ebx + 0x1dc], 0x64
lea ecx, [ebx + 4]
xor edx, edx
div dword [ebx + 0x1d8]
mov byte [ebx + 0x1bc], al
mov eax, dword [ebx + 4]
call dword [eax + 0x14]
mov ecx, ebx
call fcn.00403d40
push dword [ebp - 0x484]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x42ccb7
push 0
push 1
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
mov esi, dword [ebp - 0x490]
lea eax, [ebp - 0x46c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42c4f1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x478]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cd07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x42cd23
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x46e]
jmp 0x42c31c
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
int3