Function at 0x441cf0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x548
push ebx
push esi
push edi
mov edi, edx
mov eax, dword [edi + 4]
xor esi, esi
cmp eax, esi
mov ebx, 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], esi
mov edx, ebx
je 0x441d56
cmp byte [eax], 0x2d
jne 0x441d56
push 0x6f
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x441d37
mov dword [esp + 0x1c], ebx
mov eax, dword [edi + 4]
push 0x61
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x441d51
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov edx, 2
cmp dword [edi + edx*4], esi
jne 0x441d72
mov edx, dword [edi]
push esi
push esi
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebx
add esp, 0x548
ret 0xc
mov ebx, dword [esp + 0x558]
push ebp
push esi
push 0x104
push ebx
mov ecx, edi
call fcn.004f51f0
mov ebp, eax
cmp ebp, esi
jge 0x441da7
mov edx, dword [edi]
push 3
push esi
xor ecx, ecx
call fcn.00479790
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x548
ret 0xc
mov edx, ebx
mov ecx, ebx
call fcn.0041da40
test eax, eax
je 0x441d8e
push esi
mov esi, dword [esp + 0x564]
push 0x104
push esi
lea edx, [ebp + 1]
mov ecx, edi
call fcn.004f51f0
test eax, eax
jge 0x441dea
mov edx, dword [edi]
push 3
push 0
xor ecx, ecx
call fcn.00479790
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x548
ret 0xc
push 0x5a15c8
push 0x5a14c8
push 0x5a13c8
push 0x5a13c0
push esi
call fcn.005706cf
mov al, byte [0x5a13c0]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
test al, al
jne 0x441e58
mov al, byte [0x5a13c8]
cmp al, 0x5c
je 0x441e58
cmp al, 0x2f
je 0x441e58
test al, al
push 0x5a15c8
push 0x5a14c8
je 0x441e48
push 0x5a13c8
push 0x5a9798
push str._s_s_s_s
push esi
call edi
add esp, 0x18
jmp 0x441e58
push 0x5a9798
push str._s_s_s
push esi
call edi
add esp, 0x14
mov al, byte [0x5a14c8]
test al, al
jne 0x441e79
mov al, byte [0x5a15c8]
test al, al
jne 0x441e79
mov ecx, esi
call fcn.004203c0
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x442115
mov dword [esp + 0x10], 0
test byte [esp + 0x30], 0x10
je 0x441ec0
lea edx, [esp + 0x30]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x441ea4
jmp 0x4420c6
mov eax, dword [esp + 0x24]
test eax, eax
je 0x441efc
push 0x5a15c8
push 0x5a14c8
push 0x5a13c8
push 0x5a13c0
push esi
call fcn.005706cf
lea eax, [esp + 0x70]
push eax
push 0x5a13c8
push 0x5a13c0
push str._s_s_s
push esi
call edi
add esp, 0x28
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x441f97
mov edx, 3
mov ecx, esi
call fcn.0041fd10
test eax, eax
je 0x441f97
cmp dword [esp + 0x14], 1
jge 0x441f2e
mov edx, dword [0x5a5504]
mov ecx, dword [esp + 0x1c]
call fcn.00502b10
push esi
xor edx, edx
mov ecx, 0x2cf
call fcn.0041d620
push eax
lea ecx, [esp + 0x178]
push ecx
call edi
mov edx, dword [0x5a5504]
mov ecx, dword [esp + 0x28]
add esp, 0xc
push edx
lea edx, [esp + 0x174]
mov dword [0x59bcec], 0
call fcn.00502c40
lea eax, [esp + 0x30]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x441f82
mov dword [esp + 0x10], 1
inc dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x441ea4
jmp 0x4420ce
push 0x5a15c8
push 0x5a14c8
push 0x5a13c8
push 0x5a13c0
push ebx
call fcn.005706cf
lea ecx, [esp + 0x70]
push ecx
push 0x5a13c8
push 0x5a13c0
push str._s_s_s
push ebx
call edi
mov edx, dword [esp + 0x54]
add esp, 0x28
push edx
mov edx, esi
mov ecx, ebx
call fcn.0041dff0
mov ebp, eax
test ebp, ebp
jne 0x442074
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x564]
inc ecx
test eax, eax
mov dword [esp + 0x14], ecx
je 0x442030
push esi
push ebx
xor edx, edx
mov ecx, 0x2d0
call fcn.0041d620
push eax
lea eax, [esp + 0x17c]
push eax
call edi
mov ecx, dword [0x5a5504]
add esp, 0x10
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x174]
mov dword [0x59bcec], ebp
call fcn.00502c40
push 0x5a15c8
push 0x5a14c8
push 0x5a13c8
push 0x5a13c0
push str._s_s_s_s
push ebx
call edi
mov eax, dword [esp + 0x3c]
add esp, 0x18
test eax, eax
je 0x4420c2
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov ebp, dword [esp + 0x18]
je 0x4420c6
jmp 0x441ea4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp ebp, 1
jne 0x4420a0
mov edx, dword [esp + 0x28]
mov edx, dword [edx]
push ebp
push ebx
xor ecx, ecx
call fcn.00479790
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x548
ret 0xc
cmp ebp, 2
jne 0x4420d5
mov eax, dword [esp + 0x28]
mov edx, dword [eax]
push 4
push esi
xor ecx, ecx
call fcn.00479790
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x548
ret 0xc
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], 1
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x14]
test ebp, ebp
jle 0x4420f9
mov eax, dword [esp + 0x564]
test eax, eax
je 0x4420f7
mov edx, dword [0x5a5504]
mov ecx, dword [esp + 0x1c]
call fcn.00502b10
test ebp, ebp
je 0x442115
mov eax, dword [esp + 0x10]
test eax, eax
je 0x442115
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x548
ret 0xc
push esi
push ebx
xor edx, edx
mov ecx, 0x2d1
call fcn.0041d620
push eax
push 0x5a7240
call edi
add esp, 0x10
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x548
ret 0xc