Function at 0x4023d8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc34
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, 0x4a678c
call fcn.00499b88
mov dword [ebp - 0x54], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.004a4af0
inc dword [ebp - 0x54]
mov word [ebp - 0x60], 8
mov word [ebp - 0x60], 0x14
mov edx, dword [edi + 0xc]
test edx, edx
jne 0x402996
mov word [ebp - 0x60], 0x20
xor ecx, ecx
lea edx, [ebp - 8]
mov dword [ebp - 8], ecx
inc dword [ebp - 0x54]
mov word [ebp - 0x60], 0x2c
mov eax, dword [ebp - 4]
call fcn.0041a34c
mov word [ebp - 0x60], 0x38
xor ecx, ecx
mov edx, 0x4a6137
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x10]
inc dword [ebp - 0x54]
mov word [ebp - 0x60], 0x2c
push 0
mov word [ebp - 0x60], 0x44
call fcn.004a4ab8
inc dword [ebp - 0x54]
mov edx, dword [eax]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00419ed0
dec dword [ebp - 0x54]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0x50
mov edx, 0x4a613c
lea eax, [ebp - 0x14]
call fcn.004a4ab8
inc dword [ebp - 0x54]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.004a4cb8
push eax
dec dword [ebp - 0x54]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x4024e6
lea eax, [ebp - 0x70]
lea edx, [ebp - 0x74]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x74], str.Name_IS_NULL
push edx
push 0x401d3c
call fcn.004a18e1
add esp, 0x24
lea edx, [ebp - 0xc]
lea eax, [edi + 0x10]
call fcn.004a4c04
push 0
mov edx, str.Description
mov word [ebp - 0x60], 0x5c
lea eax, [ebp - 0x18]
call fcn.004a4ab8
inc dword [ebp - 0x54]
mov edx, dword [eax]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00419ed0
dec dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004a4bd4
lea edx, [ebp - 0xc]
lea eax, [edi + 0x14]
call fcn.004a4c04
push 0
mov edx, str.CreateTime
mov word [ebp - 0x60], 0x68
lea eax, [ebp - 0x1c]
call fcn.004a4ab8
inc dword [ebp - 0x54]
mov edx, dword [eax]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00419ed0
dec dword [ebp - 0x54]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0x74
mov edx, 0x4a6161
lea eax, [ebp - 0x20]
call fcn.004a4ab8
inc dword [ebp - 0x54]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.004a4cb8
push eax
dec dword [ebp - 0x54]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x4025c5
lea eax, [ebp - 0x70]
lea edx, [ebp - 0x78]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x78], str.CreateTime_IS_NULL
push edx
push 0x401d3c
call fcn.004a18e1
add esp, 0x24
lea edx, [ebp - 0xc]
lea eax, [edi + 0x18]
call fcn.004a4c04
push 0
mov edx, str.ModifyTime
mov word [ebp - 0x60], 0x80
lea eax, [ebp - 0x24]
call fcn.004a4ab8
inc dword [ebp - 0x54]
mov edx, dword [eax]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00419ed0
dec dword [ebp - 0x54]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0x8c
mov edx, 0x4a6180
lea eax, [ebp - 0x28]
call fcn.004a4ab8
inc dword [ebp - 0x54]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.004a4cb8
push eax
dec dword [ebp - 0x54]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x402664
lea eax, [ebp - 0x70]
lea edx, [ebp - 0x7c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x7c], str.ModifyTime_IS_NULL
push edx
push 0x401d3c
call fcn.004a18e1
add esp, 0x24
lea edx, [ebp - 0xc]
lea eax, [edi + 0x1c]
call fcn.004a4c04
lea edx, [ebp - 4]
lea eax, [edi + 0x20]
call fcn.004a4c04
lea ecx, [ebp - 0x2c8]
push 0x104
push ecx
mov edx, str...xml
mov word [ebp - 0x60], 0x98
lea eax, [ebp - 0x2c]
call fcn.004a4ab8
inc dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 4]
inc dword [ebp - 0x54]
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
call fcn.004a4c2c
lea edx, [ebp - 0x30]
mov ecx, dword [edx]
push ecx
call fcn.0041c3a4
add esp, 0xc
and eax, 0xff
cmp eax, 1
lea eax, [ebp - 0x30]
sbb edx, edx
neg edx
push edx
mov edx, 2
dec dword [ebp - 0x54]
call fcn.004a4bd4
dec dword [ebp - 0x54]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x40271a
lea eax, [ebp - 0x70]
lea edx, [ebp - 0x80]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x80], 0x4a619b
push edx
push 0x401d3c
call fcn.004a18e1
add esp, 0x24
push 0x5c
lea ecx, [ebp - 0x2c8]
push ecx
call fcn.004999d5
mov word [ebp - 0x60], 0x2c
add esp, 8
mov ebx, eax
lea eax, [ebp - 0x2c8]
lea edx, [ebp - 0x3cc]
push 0x104
sub ebx, eax
push 0
push edx
inc ebx
call fcn.004997fc
add esp, 0xc
push ebx
lea ecx, [ebp - 0x2c8]
push ecx
lea eax, [ebp - 0x3cc]
push eax
call fcn.0049978c
add esp, 0xc
lea edx, [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x2c8]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x84], eax
mov word [ebp - 0x60], 0xa4
mov word [ebp - 0x60], 0xb0
xor eax, eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x54]
mov word [ebp - 0x60], 0xbc
jmp 0x40291d
mov word [ebp - 0x60], 0xc8
lea edx, [ebp - 0x3cc]
lea eax, [ebp - 0x38]
call fcn.004a4ab8
inc dword [ebp - 0x54]
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.004a4c04
dec dword [ebp - 0x54]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0xd4
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x3c]
call fcn.004a4ab8
inc dword [ebp - 0x54]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x34]
call fcn.004a4c18
dec dword [ebp - 0x54]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.004a4bd4
push 0x28
call fcn.00498cf8
pop ecx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x40282d
mov word [ebp - 0x60], 0xec
mov eax, dword [ebp - 0x40]
call fcn.00402a04
mov word [ebp - 0x60], 0xe0
mov esi, dword [ebp - 0x40]
jmp 0x402830
mov esi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.00402bdc
test al, al
je 0x40287d
mov ebx, dword [edi + 0xc]
dec ebx
mov word [ebp - 0x60], 0xbc
cmp ebx, 0xffffffff
jle 0x40286c
push ebx
push edi
call fcn.00401ce4
add esp, 8
add eax, 0x10
lea edx, [esi + 0x10]
call fcn.004a4ce8
test al, al
jne 0x40286c
dec ebx
cmp ebx, 0xffffffff
jg 0x40284d
inc ebx
push esi
push ebx
push edi
call fcn.0040393c
add esp, 0xc
jmp 0x402906
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4028a0
mov word [ebp - 0x60], 0x104
mov edx, 3
mov eax, dword [ebp - 0x44]
call fcn.00401d50
mov word [ebp - 0x60], 0xf8
lea ecx, [ebp - 0x70]
mov edx, 0x4a61ac
push ecx
push 0
push 0
push 0
push 3
push fcn.004a4af0
push 0
lea eax, [ebp - 0x4c]
mov word [ebp - 0x60], 0x11c
call fcn.004a4ab8
inc dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
inc dword [ebp - 0x54]
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.004a4c2c
dec dword [ebp - 0x54]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0x110
lea ecx, [ebp - 0x48]
push ecx
push 0x4017c8
call fcn.004a18e1
add esp, 0x24
lea eax, [ebp - 0x1c4]
push eax
mov edx, dword [ebp - 0x84]
push edx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
je 0x402936
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x402936
mov eax, dword [ebp - 0x84]
cmp eax, 0xffffffff
jne 0x4027a1
dec dword [ebp - 0x54]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0xa4
mov word [ebp - 0x60], 0x2c
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x402968
mov eax, dword [ebp - 0x84]
push eax
call sub.KERNEL32.DLL_FindClose
cmp word [ebp - 0x5e], 0
je 0x402970
ret
dec dword [ebp - 0x54]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4bd4
dec dword [ebp - 0x54]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x60], 0x14
mov word [ebp - 0x60], 8
jmp 0x4029d0
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x54]
call fcn.004a4bd4
pop eax
mov edx, dword [ebp - 0x70]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x3d8]
mov esi, dword [ebp - 0x3d4]
mov ebx, dword [ebp - 0x3d0]
pop ebp
ret