Function at 0x40ddfd
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aac6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa54
push esi
push edi
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x99c]
push eax
call fcn.0045f715
mov ecx, eax
call fcn.0045ba80
mov ecx, eax
call fcn.004272e5
mov ecx, eax
call fcn.00453a6c
mov ecx, eax
call fcn.004172b0
push eax
lea ecx, [ebp - 0x10]
call fcn.0045f770
jmp 0x40debd
mov ecx, dword [ebp - 0x9e8]
cmp dword [ecx + 0x434], 0
jne 0x40de87
push 0
lea edx, [ebp - 0x9a0]
push edx
lea ecx, [ebp - 0x10]
call fcn.00417310
mov eax, dword [eax]
mov dword [ebp - 0x9a8], eax
jmp 0x40debd
lea ecx, [ebp - 0x9a4]
push ecx
call fcn.0045f715
mov ecx, eax
call fcn.0045ba80
mov ecx, eax
call fcn.004272e5
mov ecx, eax
call fcn.00453a6c
mov ecx, eax
call fcn.00436710
mov edx, dword [eax]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x9a8], eax
mov ecx, dword [ebp - 0x9e8]
cmp dword [ecx + 0x434], 0
jne 0x40f27d
call fcn.0045f715
mov ecx, eax
call fcn.0045ba80
mov ecx, eax
call fcn.004272e5
mov ecx, eax
call fcn.00453a6c
mov ecx, eax
call fcn.004318f0
test eax, eax
jbe 0x40f27d
lea edx, [ebp - 0x9ac]
push edx
call fcn.0045f715
mov ecx, eax
call fcn.0045ba80
mov ecx, eax
call fcn.004272e5
mov ecx, eax
call fcn.00453a6c
mov ecx, eax
call fcn.00436710
push eax
lea ecx, [ebp - 0x10]
call fcn.00448ed0
and eax, 0xff
test eax, eax
je 0x40f27d
lea ecx, [ebp - 0x10]
call fcn.00432be0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x9e8]
cmp dword [eax + 0x434], 0
jne 0x40df6f
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0045f715
mov ecx, eax
call fcn.0045e481
and eax, 0xff
test eax, eax
je 0x40df6f
jmp 0x40de5d
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
mov cl, 0x3f
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0x9f0], eax
mov dword [ebp - 0x9ec], edx
mov eax, dword [ebp - 0x9f0]
or eax, dword [ebp - 0x9ec]
test eax, eax
je 0x40e98d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov cl, 0x3e
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0x9f8], eax
mov dword [ebp - 0x9f4], edx
mov eax, dword [ebp - 0x9f8]
or eax, dword [ebp - 0x9f4]
test eax, eax
je 0x40e98d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
xor eax, eax
mov al, byte [edx + 0x23]
test eax, eax
jne 0x40e98d
lea ecx, [ebp - 0x9b0]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00489280
mov dword [ebp - 4], 0
lea edx, [ebp - 0x9b4]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00489280
mov byte [ebp - 4], 1
lea eax, [ebp - 0x9b8]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00489280
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00417240
lea ecx, [ebp - 0x2c]
call fcn.00417240
lea ecx, [ebp - 0x5c]
call fcn.00417240
lea ecx, [ebp - 0x40]
push ecx
push 0x4c2568
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.0042343e
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x2c]
push edx
push 0x4c256c
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edx
call fcn.0042343e
add esp, 0xc
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0
jmp 0x40e0a9
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0x1c]
jae 0x40e401
mov dword [ebp - 0x60], 0
jmp 0x40e0c7
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x48]
jae 0x40e3fc
mov edx, dword [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x40]
call fcn.0047b020
mov ecx, eax
call fcn.004155c0
mov esi, eax
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0047b020
mov ecx, eax
call fcn.004155c0
add esi, eax
mov dword [ebp - 0x16c], esi
mov ecx, dword [ebp - 0x16c]
add ecx, 2
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x9bc], eax
mov edx, dword [ebp - 0x9bc]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x16c]
add eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x64]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0
mov edx, dword [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x40]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov eax, dword [ebp - 0x16c]
add eax, 2
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00409000
mov byte [ebp - 0x168], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x167]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0x64]
push edx
push 0x104
lea eax, [ebp - 0x168]
push eax
call fcn.00409000
mov byte [ebp - 0x165], 0
lea ecx, [ebp - 0x168]
push ecx
call fcn.0042b650
add esp, 4
test eax, eax
jne 0x40e1d7
cmp dword [ebp - 0x64], 0
je 0x40e1cb
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x9c0], edx
mov eax, dword [ebp - 0x9c0]
push eax
call fcn.004a90a8
add esp, 4
mov dword [ebp - 0x64], 0
jmp 0x40e0be
mov ecx, dword [ebp - 0x64]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x64]
movsx eax, byte [edx + eax - 1]
cmp eax, 0x5c
je 0x40e208
push 0x4c2570
mov ecx, dword [ebp - 0x16c]
add ecx, 2
push ecx
mov edx, dword [ebp - 0x64]
push edx
call fcn.00407f00
push 0
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov ecx, dword [ebp - 0x16c]
add ecx, 2
push ecx
mov edx, dword [ebp - 0x64]
push edx
call fcn.00407f00
push 0x4c2574
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x40e25b
push 0x4c2578
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40e3a1
mov dword [ebp - 0x170], 1
lea edx, [ebp - 0x2b4]
push edx
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x174], eax
jmp 0x40e298
lea ecx, [ebp - 0x2b4]
push ecx
mov edx, dword [ebp - 0x174]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x174], 0xffffffff
je 0x40e39f
cmp dword [ebp - 0x170], 0
je 0x40e39f
mov eax, dword [ebp - 0x2b4]
and eax, 0x10
test eax, eax
jne 0x40e39a
mov byte [ebp - 0x3b8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x4bc], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x4bb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
push 0x104
lea edx, [ebp - 0x3b8]
push edx
call fcn.00409000
lea eax, [ebp - 0x3b8]
push eax
call sub.ntdll.dll_strlen
add esp, 4
movsx ecx, byte [ebp + eax - 0x3b9]
cmp ecx, 0x5c
je 0x40e34e
push 0x4c257c
push 0x104
lea edx, [ebp - 0x3b8]
push edx
call fcn.00407f00
lea eax, [ebp - 0x288]
push eax
push 0x104
lea ecx, [ebp - 0x3b8]
push ecx
call fcn.00407f00
lea edx, [ebp - 0x3b8]
push edx
lea ecx, [ebp - 0x9c4]
call fcn.00415500
mov byte [ebp - 4], 3
lea eax, [ebp - 0x9c4]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00417210
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c4]
call fcn.00409510
jmp 0x40e27e
jmp 0x40e3d2
mov ecx, dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x9c8]
call fcn.00415500
mov byte [ebp - 4], 4
lea edx, [ebp - 0x9c8]
push edx
lea ecx, [ebp - 0x5c]
call fcn.00417210
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c8]
call fcn.00409510
cmp dword [ebp - 0x64], 0
je 0x40e3f0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9cc], eax
mov ecx, dword [ebp - 0x9cc]
push ecx
call fcn.004a90a8
add esp, 4
mov dword [ebp - 0x64], 0
jmp 0x40e0be
jmp 0x40e0a0
mov dword [ebp - 0x30], 0
jmp 0x40e413
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x9e8]
cmp dword [eax + 0x434], 0
jne 0x40e94e
lea ecx, [ebp - 0x5c]
call fcn.0047afe0
cmp dword [ebp - 0x30], eax
jae 0x40e94e
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x40e47e
push 0
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov ecx, dword [ebp - 0x9e8]
call fcn.00414057
test eax, eax
je 0x40e480
jmp 0x40e40a
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov cl, 0x3f
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa00], eax
mov dword [ebp - 0x9fc], edx
mov eax, dword [ebp - 0xa00]
or eax, dword [ebp - 0x9fc]
test eax, eax
je 0x40e4ed
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov edx, dword [ebp - 0x4c0]
adc edx, 0
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov cl, 0x3e
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa08], eax
mov dword [ebp - 0xa04], edx
mov eax, dword [ebp - 0xa08]
or eax, dword [ebp - 0xa04]
test eax, eax
je 0x40e546
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov edx, dword [ebp - 0x4c0]
adc edx, 0
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov cl, 0x3d
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], edx
mov eax, dword [ebp - 0xa10]
or eax, dword [ebp - 0xa0c]
test eax, eax
je 0x40e64e
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov cl, 0x3d
mov eax, dword [edx + 0x18]
mov edx, dword [edx + 0x1c]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa14], edx
mov eax, dword [ebp - 0xa18]
or eax, dword [ebp - 0xa14]
test eax, eax
je 0x40e608
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0041ced0
mov ecx, eax
call fcn.0041ecc0
test eax, eax
je 0x40e606
mov edx, dword [ebp - 0x4c4]
add edx, 1
mov eax, dword [ebp - 0x4c0]
adc eax, 0
mov dword [ebp - 0x4c4], edx
mov dword [ebp - 0x4c0], eax
jmp 0x40e64e
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0041ced0
mov ecx, eax
call fcn.0041ecc0
test eax, eax
jne 0x40e64e
mov edx, dword [ebp - 0x4c4]
add edx, 1
mov eax, dword [ebp - 0x4c0]
adc eax, 0
mov dword [ebp - 0x4c4], edx
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x30]
xor edx, edx
mov ecx, 5
div ecx
test edx, edx
jne 0x40e6cc
push 0
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
push 0x4c2580
mov eax, dword [ebp - 0x9e8]
push eax
call fcn.0040ba78
add esp, 0xc
call fcn.00435f76
test eax, eax
je 0x40e6cc
call fcn.00435fa3
test eax, eax
je 0x40e6b4
push 0x4c2594
push 0x439
mov ecx, dword [ebp - 0x9e8]
add ecx, 4
call fcn.004152c0
jmp 0x40e6cc
push 0x4c25a8
push 0x439
mov ecx, dword [ebp - 0x9e8]
add ecx, 4
call fcn.004152c0
mov dword [ebp - 0x4c8], 0
mov byte [ebp - 0x4f8], 0
mov ecx, 0xb
xor eax, eax
lea edi, [ebp - 0x4f7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x9e8]
add ecx, 0x570
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x9e8]
cmp dword [edx + 0x434], 0
jne 0x40e764
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x4c8]
push ecx
lea edx, [ebp - 0x4c4]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0045ba91
add esp, 0x14
test eax, eax
je 0x40e764
mov edx, dword [ebp - 0x9e8]
add edx, 0x570
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x40e40a
mov eax, dword [ebp - 0x9e8]
add eax, 0x570
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x9e8]
cmp dword [ecx + 0x434], 0
jne 0x40e90d
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x40e90d
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ecx + 0x10]
push eax
call fcn.00401a90
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], ecx
mov edx, dword [ebp - 0xa20]
cmp edx, dword [ebp - 0x4c4]
jne 0x40e90d
mov eax, dword [ebp - 0xa1c]
cmp eax, dword [ebp - 0x4c0]
jne 0x40e90d
mov dword [ebp - 0x560], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d2f5
mov ecx, dword [eax]
mov dword [ebp - 0x560], ecx
mov byte [ebp - 0x55c], 0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x55b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov cl, byte [eax + 8]
and cl, 0xf
and ecx, 0xff
test ecx, ecx
jl 0x40e866
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov cl, byte [eax + 8]
and cl, 0xf
and ecx, 0xff
cmp ecx, 5
ja 0x40e866
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov cl, byte [eax + 8]
and cl, 0xf
and ecx, 0xff
mov edx, dword [ecx*8 + 0x4adc44]
mov dword [ebp - 0xa24], edx
jmp 0x40e870
mov dword [ebp - 0xa24], 0x4c25d0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00401b90
add esp, 4
push eax
mov ecx, dword [ebp - 0xa24]
push ecx
push 0x4c25d8
push 0x64
lea edx, [ebp - 0x55c]
push edx
call fcn.0040a150
add esp, 0x18
cmp dword [ebp - 0x560], 0
je 0x40e8dd
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov edx, dword [ebp - 0x560]
add edx, 8
push edx
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d72e
jmp 0x40e904
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
push 0
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d72e
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x4c8], 0
je 0x40e949
lea eax, [ebp - 0x4f8]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
push 0
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d4d6
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x40e40a
lea ecx, [ebp - 0x40]
call fcn.00417240
lea ecx, [ebp - 0x2c]
call fcn.00417240
lea ecx, [ebp - 0x5c]
call fcn.00417240
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.004171b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004171b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004171b0
mov eax, dword [ebp - 0x9e8]
cmp dword [eax + 0x434], 0
jne 0x40f278
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov cl, 0x3f
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa28], edx
mov eax, dword [ebp - 0xa2c]
or eax, dword [ebp - 0xa28]
test eax, eax
jne 0x40f278
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov cl, 0x3e
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa34], eax
mov dword [ebp - 0xa30], edx
mov eax, dword [ebp - 0xa34]
or eax, dword [ebp - 0xa30]
test eax, eax
je 0x40f278
lea ecx, [ebp - 0x9d0]
push ecx
lea ecx, [ebp - 0x570]
call fcn.00489280
mov dword [ebp - 4], 5
lea edx, [ebp - 0x9d4]
push edx
lea ecx, [ebp - 0x590]
call fcn.00489280
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x570]
call fcn.00417240
lea ecx, [ebp - 0x590]
call fcn.00417240
lea eax, [ebp - 0x570]
push eax
push 0x4c25e4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push eax
call fcn.0042343e
add esp, 0xc
mov dword [ebp - 0x580], eax
mov ecx, dword [ebp - 0x580]
mov dword [ebp - 0x578], ecx
mov dword [ebp - 0x57c], 0
jmp 0x40eaad
mov edx, dword [ebp - 0x57c]
add edx, 1
mov dword [ebp - 0x57c], edx
mov eax, dword [ebp - 0x57c]
cmp eax, dword [ebp - 0x580]
jae 0x40ed94
mov ecx, dword [ebp - 0x57c]
push ecx
lea ecx, [ebp - 0x570]
call fcn.0047b020
mov ecx, eax
call fcn.004155c0
mov dword [ebp - 0x598], eax
mov edx, dword [ebp - 0x598]
add edx, 2
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x594], eax
mov ecx, dword [ebp - 0x598]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 0x594]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0
mov eax, dword [ebp - 0x57c]
push eax
lea ecx, [ebp - 0x570]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov ecx, dword [ebp - 0x598]
add ecx, 2
push ecx
mov edx, dword [ebp - 0x594]
push edx
call fcn.00409000
push 0x4c25e8
mov eax, dword [ebp - 0x594]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x40eb7f
push 0x4c25ec
mov ecx, dword [ebp - 0x594]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40ed01
mov dword [ebp - 0x59c], 1
lea edx, [ebp - 0x6e0]
push edx
mov eax, dword [ebp - 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x5a0], eax
jmp 0x40ebbf
lea ecx, [ebp - 0x6e0]
push ecx
mov edx, dword [ebp - 0x5a0]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x5a0], 0xffffffff
je 0x40ecff
cmp dword [ebp - 0x59c], 0
je 0x40ecff
mov eax, dword [ebp - 0x6e0]
and eax, 0x10
test eax, eax
jne 0x40ecfa
mov byte [ebp - 0x7e8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x7e7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x8ec], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x8eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x8f4], 0x5c
mov ecx, dword [ebp - 0x8f4]
push ecx
mov edx, dword [ebp - 0x594]
push edx
call dword [sym.imp.ntdll.dll_strrchr]
add esp, 8
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 0
je 0x40ecfa
mov eax, dword [ebp - 0x8f0]
sub eax, dword [ebp - 0x594]
add eax, 1
mov dword [ebp - 0x6e4], eax
mov ecx, dword [ebp - 0x6e4]
push ecx
mov edx, dword [ebp - 0x594]
push edx
lea eax, [ebp - 0x7e8]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x6b4]
push ecx
push 0x104
lea edx, [ebp - 0x7e8]
push edx
call fcn.00407f00
lea eax, [ebp - 0x7e8]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x40ecfa
lea ecx, [ebp - 0x7e8]
push ecx
mov ecx, dword [ebp - 0x9e8]
call fcn.00414057
test eax, eax
jne 0x40ecfa
lea edx, [ebp - 0x7e8]
push edx
lea ecx, [ebp - 0x9dc]
call fcn.00415500
mov byte [ebp - 4], 7
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0x590]
call fcn.00417210
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9dc]
call fcn.00409510
jmp 0x40eba5
jmp 0x40ed61
mov ecx, dword [ebp - 0x594]
push ecx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x40ed61
mov edx, dword [ebp - 0x594]
push edx
mov ecx, dword [ebp - 0x9e8]
call fcn.00414057
test eax, eax
jne 0x40ed61
mov eax, dword [ebp - 0x594]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00415500
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9e0]
push ecx
lea ecx, [ebp - 0x590]
call fcn.00417210
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9e0]
call fcn.00409510
cmp dword [ebp - 0x594], 0
je 0x40ed85
mov edx, dword [ebp - 0x594]
mov dword [ebp - 0x9e4], edx
mov eax, dword [ebp - 0x9e4]
push eax
call fcn.004a90a8
add esp, 4
mov dword [ebp - 0x594], 0
jmp 0x40ea9e
mov dword [ebp - 0x574], 0
jmp 0x40edaf
mov ecx, dword [ebp - 0x574]
add ecx, 1
mov dword [ebp - 0x574], ecx
mov edx, dword [ebp - 0x9e8]
cmp dword [edx + 0x434], 0
jne 0x40f241
lea ecx, [ebp - 0x590]
call fcn.0047afe0
cmp dword [ebp - 0x574], eax
jae 0x40f241
mov dword [ebp - 0x8fc], 0
mov dword [ebp - 0x8f8], 0
push 0
mov eax, dword [ebp - 0x574]
push eax
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x40ee40
push 0
mov ecx, dword [ebp - 0x574]
push ecx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov ecx, dword [ebp - 0x9e8]
call fcn.00414057
test eax, eax
je 0x40ee45
jmp 0x40eda0
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
mov cl, 0x3f
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa38], edx
mov eax, dword [ebp - 0xa3c]
or eax, dword [ebp - 0xa38]
test eax, eax
je 0x40ee9e
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov edx, dword [ebp - 0x8f8]
adc edx, 0
mov dword [ebp - 0x8fc], ecx
mov dword [ebp - 0x8f8], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov cl, 0x3e
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa44], eax
mov dword [ebp - 0xa40], edx
mov eax, dword [ebp - 0xa44]
or eax, dword [ebp - 0xa40]
test eax, eax
je 0x40eef7
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov edx, dword [ebp - 0x8f8]
adc edx, 0
mov dword [ebp - 0x8fc], ecx
mov dword [ebp - 0x8f8], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov cl, 0x3d
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa48], edx
mov eax, dword [ebp - 0xa4c]
or eax, dword [ebp - 0xa48]
test eax, eax
je 0x40f00b
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov cl, 0x3d
mov eax, dword [edx + 0x18]
mov edx, dword [edx + 0x1c]
call sub.ntdll.dll__allshl
mov cl, 0x3f
call sub.ntdll.dll__allshr
and eax, 1
and edx, 0
mov dword [ebp - 0xa54], eax
mov dword [ebp - 0xa50], edx
mov eax, dword [ebp - 0xa54]
or eax, dword [ebp - 0xa50]
test eax, eax
je 0x40efbf
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x574]
push ecx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0041ced0
mov ecx, eax
call fcn.0041ecc0
test eax, eax
je 0x40efbd
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov eax, dword [ebp - 0x8f8]
adc eax, 0
mov dword [ebp - 0x8fc], edx
mov dword [ebp - 0x8f8], eax
jmp 0x40f00b
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x574]
push ecx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0041ced0
mov ecx, eax
call fcn.0041ecc0
test eax, eax
jne 0x40f00b
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov eax, dword [ebp - 0x8f8]
adc eax, 0
mov dword [ebp - 0x8fc], edx
mov dword [ebp - 0x8f8], eax
mov dword [ebp - 0x900], 0
mov byte [ebp - 0x930], 0
mov ecx, 0xb
xor eax, eax
lea edi, [ebp - 0x92f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x930]
push ecx
lea edx, [ebp - 0x900]
push edx
lea eax, [ebp - 0x8fc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x574]
push edx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
call fcn.0045ba91
add esp, 0x14
test eax, eax
je 0x40f074
jmp 0x40eda0
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x40f1fa
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [edx + 0x10]
push ecx
call fcn.00401a90
add esp, 8
xor edx, edx
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa58], edx
mov eax, dword [ebp - 0xa5c]
cmp eax, dword [ebp - 0x8fc]
jne 0x40f1fa
mov ecx, dword [ebp - 0xa58]
cmp ecx, dword [ebp - 0x8f8]
jne 0x40f1fa
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d2f5
mov edx, dword [eax]
mov dword [ebp - 0x998], edx
mov byte [ebp - 0x994], 0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x993]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dl, byte [ecx + 8]
and dl, 0xf
and edx, 0xff
test edx, edx
jl 0x40f147
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dl, byte [ecx + 8]
and dl, 0xf
and edx, 0xff
cmp edx, 5
ja 0x40f147
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dl, byte [ecx + 8]
and dl, 0xf
and edx, 0xff
mov eax, dword [edx*8 + 0x4adc44]
mov dword [ebp - 0xa60], eax
jmp 0x40f151
mov dword [ebp - 0xa60], 0x4c25f0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00401b90
add esp, 4
push eax
mov edx, dword [ebp - 0xa60]
push edx
push 0x4c25f8
push 0x64
lea eax, [ebp - 0x994]
push eax
call fcn.0040a150
add esp, 0x18
cmp dword [ebp - 0x998], 0
je 0x40f1c4
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x574]
push edx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
mov eax, dword [ebp - 0x998]
add eax, 8
push eax
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d72e
jmp 0x40f1f1
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x574]
push edx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
push 0
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d72e
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x900], 0
je 0x40f23c
lea ecx, [ebp - 0x930]
push ecx
push 0
mov edx, dword [ebp - 0x574]
push edx
lea ecx, [ebp - 0x590]
call fcn.0047b020
mov ecx, eax
call fcn.004093c0
push eax
push 0
mov ecx, dword [ebp - 0x9e8]
call fcn.0040d4d6
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x40eda0
lea ecx, [ebp - 0x570]
call fcn.00417240
lea ecx, [ebp - 0x590]
call fcn.00417240
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x590]
call fcn.004171b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x570]
call fcn.004171b0
jmp 0x40de5d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret