Function at 0x41b570
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495a84
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x37c
mov eax, dword [0x4cf0c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x388], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00474a90
add esp, 4
cmp eax, 0x10
ja 0x41b5ca
mov ecx, dword [ebp + 8]
push ecx
call fcn.00474a90
add esp, 4
cmp eax, 6
jae 0x41b5cf
jmp 0x41bb26
push 0x14
push 0
lea edx, [ebp - 0x98]
push edx
call fcn.00474130
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x98]
push edx
call fcn.00474a28
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x98]
push eax
call fcn.00474a90
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x41b629
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jbe 0x41b66c
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x98]
cmp eax, 0x2e
jne 0x41b66a
push 0x49dfa0
push 0x49dfa4
call fcn.00474a90
add esp, 4
add eax, 2
push eax
mov ecx, dword [ebp - 0x14]
lea edx, [ebp + ecx - 0x97]
push edx
call fcn.00474a28
add esp, 0xc
jmp 0x41b66c
jmp 0x41b620
mov dword [ebp - 0x1e0], 0xffffffff
lea eax, [ebp - 0x98]
push eax
call fcn.00474a90
add esp, 4
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x14], 0
jmp 0x41b69d
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x14
jae 0x41b704
mov edx, dword [ebp - 0x1e4]
push edx
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x34
mov edx, dword [ebp - 0x388]
lea eax, [edx + ecx + 0x1858]
push eax
call fcn.00474cfd
add esp, 0xc
test eax, eax
jne 0x41b702
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x34
mov edx, dword [ebp - 0x388]
cmp dword [edx + ecx + 0x1840], 0xffffffff
je 0x41b702
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x34
mov ecx, dword [ebp - 0x388]
mov edx, dword [ecx + eax + 0x1840]
mov dword [ebp - 0x1e0], edx
jmp 0x41b704
jmp 0x41b694
push 0x802
call fcn.0047371f
add esp, 4
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x378], 0
push 0x802
push 0
mov edx, dword [ebp - 0x1dc]
push edx
call fcn.00474130
add esp, 0xc
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x1e8], 0
jmp 0x41b774
mov eax, dword [ebp - 0x1e8]
add eax, 1
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x10
jge 0x41bab8
mov ecx, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x388]
cmp dword [edx + ecx*4 + 0x17fc], 0
jne 0x41b799
jmp 0x41b765
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x388]
mov edx, dword [ecx + eax*4 + 0x17fc]
push edx
call fcn.00474a90
add esp, 4
test eax, eax
jbe 0x41bab3
mov dword [ebp - 0x14], 0
jmp 0x41b7cf
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jae 0x41bab3
push 0x28
push 0
lea ecx, [ebp - 0x268]
push ecx
call fcn.00474130
add esp, 0xc
mov edx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x388]
mov ecx, dword [eax + edx*4 + 0x17fc]
push ecx
mov edx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x388]
mov ecx, dword [eax + edx*4 + 0x17fc]
push ecx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x268]
push edx
call fcn.00474a28
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x41b86f
push 0x49dfa8
push 0x49dfb0
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00474a90
add esp, 4
lea ecx, [ebp + eax - 0x268]
push ecx
call fcn.00474a28
add esp, 0xc
jmp 0x41b924
cmp dword [ebp - 0x14], 1
jne 0x41b8ac
push 0x49dfb8
push 0x49dfc0
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x268]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x268]
push eax
call fcn.00474a28
add esp, 0xc
jmp 0x41b924
cmp dword [ebp - 0x14], 2
jne 0x41b8e9
push 0x49dfc8
push 0x49dfd0
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x268]
push ecx
call fcn.00474a90
add esp, 4
lea edx, [ebp + eax - 0x268]
push edx
call fcn.00474a28
add esp, 0xc
jmp 0x41b924
cmp dword [ebp - 0x14], 3
jne 0x41b924
push 0x49dfd8
push 0x49dfe0
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00474a90
add esp, 4
lea ecx, [ebp + eax - 0x268]
push ecx
call fcn.00474a28
add esp, 0xc
mov dword [ebp - 0x378], 0
lea edx, [ebp - 0x1d8]
push edx
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0xffffffff
jne 0x41b956
jmp 0x41b7c6
cmp dword [ebp - 0x378], 0
jne 0x41baa1
push 0x28
push 0
lea ecx, [ebp - 0x370]
push ecx
call fcn.00474130
add esp, 0xc
lea edx, [ebp - 0x1ac]
push edx
lea eax, [ebp - 0x1ac]
push eax
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x370]
push ecx
call fcn.00474a28
add esp, 0xc
push 4
push 0
lea edx, [ebp - 0x370]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x374]
push eax
call fcn.00474130
add esp, 0xc
lea ecx, [ebp - 0x370]
push ecx
call fcn.00474cdc
add esp, 4
test eax, eax
jle 0x41ba7a
lea edx, [ebp - 0x370]
push edx
call fcn.00474cdc
add esp, 4
push eax
mov eax, dword [ebp - 0x1dc]
add eax, dword [ebp - 0x374]
push eax
mov ecx, 0x4d3be8
call fcn.00423950
mov ecx, dword [ebp - 0x374]
add ecx, 4
mov dword [ebp - 0x374], ecx
cmp dword [ebp - 0x374], 0x800
jl 0x41ba7a
cmp dword [ebp - 0x1e0], 0xffffffff
je 0x41ba4f
mov edx, dword [ebp - 0x374]
push edx
push 0x1d4c
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x1dc]
push ecx
mov edx, dword [ebp - 0x1e0]
push edx
mov ecx, 0x4d4470
call fcn.0042a280
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x802
push 0
mov eax, dword [ebp - 0x1dc]
push eax
call fcn.00474130
add esp, 0xc
mov dword [ebp - 0x374], 0
lea ecx, [ebp - 0x1d8]
push ecx
mov edx, dword [ebp - 0x37c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ba9c
mov dword [ebp - 0x378], 1
jmp 0x41b956
mov eax, dword [ebp - 0x37c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41b7c6
jmp 0x41b765
cmp dword [ebp - 0x374], 0
jle 0x41baf5
cmp dword [ebp - 0x1e0], 0xffffffff
je 0x41baf5
mov ecx, dword [ebp - 0x374]
push ecx
push 0x1d4c
lea edx, [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x1dc]
push eax
mov ecx, dword [ebp - 0x1e0]
push ecx
mov ecx, 0x4d4470
call fcn.0042a280
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x384], edx
mov eax, dword [ebp - 0x384]
push eax
call fcn.00477380
add esp, 4
jmp 0x41bb1f
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00474590
mov esp, ebp
pop ebp
ret 4