Function at 0x401291
Capabilities:
Enumerate files on windows

Disassembly:
push 0x290
mov eax, 0x40fa08
call fcn.0040f8a7
mov esi, ecx
mov dword [ebp - 0x27c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], eax
cmp byte [ebp + 0x10], bl
mov ecx, str._sharedMicrosoft.WindowsDesktop.App
mov dword [ebp - 4], eax
mov eax, str._sharedMicrosoft.NETCore.App
cmove ecx, eax
add edx, edx
sub edx, ecx
add edx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4012ef
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
or ecx, 0xffffffff
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x268], ecx
cmp edi, ecx
je 0x40162d
push 8
pop ecx
push 0x2e
pop esi
mov dword [ebp - 0x280], 1
lea eax, [ebp - 0x234]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x234]
add eax, 0xffffffcf
cmp ax, cx
ja 0x4014b5
test dword [ebp - 0x260], 0x10
je 0x4014b5
push 0xa
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00406ae6
add esp, 0xc
cmp eax, 8
jne 0x4014b5
mov ecx, dword [ebp - 0x264]
mov ax, word [ecx]
add ecx, 2
mov dword [ebp - 0x264], ecx
cmp ax, si
jne 0x4014b5
movzx eax, word [ecx]
push 0x30
pop edx
cmp ax, dx
jb 0x4014b5
push 0x39
pop edx
cmp ax, dx
ja 0x4014b5
push 0xa
lea eax, [ebp - 0x264]
push eax
push ecx
call fcn.00406ae6
add esp, 0xc
mov esi, eax
push 0x2e
test esi, esi
js 0x4014b4
mov edx, dword [ebp - 0x264]
pop eax
mov cx, word [edx]
add edx, 2
mov dword [ebp - 0x264], edx
cmp cx, ax
jne 0x4014b2
movzx eax, word [edx]
push 0x30
pop ecx
cmp ax, cx
jb 0x4014b2
push 0x39
pop ecx
cmp ax, cx
ja 0x4014b2
push 0xa
lea eax, [ebp - 0x264]
push eax
push edx
call fcn.00406ae6
add esp, 0xc
test eax, eax
js 0x4014b2
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x298], eax
cmp word [ecx], 0x2d
jne 0x401459
cmp word [ecx + 2], 0x70
jne 0x401459
mov byte [ebp - 0x294], 1
test esi, esi
jne 0x401461
test eax, eax
je 0x4014b2
jmp 0x401461
xor eax, eax
mov byte [ebp - 0x294], al
lea eax, [ebp - 0x234]
push eax
call fcn.00406d2b
pop ecx
mov dword [ebp - 0x290], eax
cmp ebx, dword [ebp - 0x270]
je 0x401499
mov edi, ebx
lea esi, [ebp - 0x29c]
add ebx, 0x10
mov dword [ebp - 0x274], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x284]
jmp 0x4014b2
lea eax, [ebp - 0x29c]
push eax
push ebx
lea ecx, [ebp - 0x278]
call fcn.00402d22
mov ebx, dword [ebp - 0x274]
push 0x2e
pop esi
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 8
pop ecx
test eax, eax
jne 0x401335
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x278]
sub ebx, esi
sar ebx, 4
test ebx, ebx
je 0x40162d
or edx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x264], edx
mov ecx, edx
mov edi, eax
test ebx, ebx
jle 0x40157f
mov edx, esi
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x401519
mov esi, dword [ebp - 0x26c]
cmp eax, dword [esi]
mov esi, dword [ebp - 0x278]
je 0x40156b
cmp eax, ecx
inc edi
cmovb ecx, eax
add edx, 0x10
cmp edi, ebx
jl 0x401501
or edx, 0xffffffff
xor eax, eax
test ebx, ebx
jle 0x40157f
mov edi, esi
cmp dword [edi], ecx
jne 0x401571
cmp byte [ebp + 0x10], 0
mov edx, dword [edi + 4]
je 0x401553
mov esi, dword [ebp - 0x26c]
cmp edx, dword [esi + 4]
mov esi, dword [ebp - 0x278]
je 0x40161e
cmp edx, dword [ebp - 0x264]
jle 0x401571
mov dword [ebp - 0x264], edx
mov edx, eax
mov dword [ebp - 0x268], edx
jmp 0x401577
mov ecx, eax
xor eax, eax
jmp 0x40152f
mov edx, dword [ebp - 0x268]
inc eax
add edi, 0x10
cmp eax, ebx
jl 0x401531
mov edi, dword [ebp - 0x264]
mov eax, edx
add eax, eax
cmp byte [esi + eax*8 + 8], 0
je 0x4015b8
xor eax, eax
mov edx, eax
test ebx, ebx
jle 0x4015b2
lea eax, [esi + 8]
cmp dword [eax - 8], ecx
jne 0x4015aa
cmp dword [eax - 4], edi
jne 0x4015aa
cmp byte [eax], 0
je 0x4015b8
inc edx
add eax, 0x10
cmp edx, ebx
jl 0x40159b
mov edx, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x27c]
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x288]
jne 0x4015c1
shl edx, 4
sub ecx, edi
sar ecx, 1
add esi, edx
mov edx, dword [ebp - 0x27c]
push ecx
push dword [esi + 0xc]
lea eax, [ecx - 1]
mov ecx, dword [ebp - 0x28c]
push eax
call fcn.004010ee
mov edi, dword [ebp - 0x26c]
add esp, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
jle 0x401635
mov esi, dword [ebp - 0x278]
add esi, 0xc
push dword [esi]
call fcn.00406daf
lea esi, [esi + 0x10]
pop ecx
sub ebx, 1
jne 0x40160c
jmp 0x401635
mov edi, edx
mov edx, eax
mov dword [ebp - 0x268], edx
jmp 0x401585
xor eax, eax
mov byte [ebp - 0x280], al
lea ecx, [ebp - 0x278]
call fcn.00402750
mov al, byte [ebp - 0x280]
call fcn.0040f865
ret