Function at 0x443800
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x5245b4
call fcn.0051f0b4
sub esp, 0x274
push ebx
push esi
push edi
and dword [ebp - 0x30], 0
mov esi, 0x56f16c
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.00402946
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402946
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x443c86
mov edi, 0x104
cmp eax, edi
jge 0x443c86
push edi
lea ecx, [ebp + 8]
call fcn.00401db6
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
or eax, 0xffffffff
lea esi, [ebp + 8]
call fcn.004048ba
push str..
mov eax, esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041217d
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00404918
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040297c
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x4438cf
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040297c
lea ecx, [esi - 0x10]
jmp 0x443c97
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x53f8c0
lea eax, [ebp - 0x254]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x443906
test dx, dx
je 0x443902
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x443906
add eax, 4
add ecx, 4
test dx, dx
jne 0x4438e0
xor eax, eax
jmp 0x44390b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443aac
mov esi, 0x53f8e4
mov ecx, esi
lea eax, [ebp - 0x254]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x443946
test dx, dx
je 0x443942
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x443946
add eax, 4
add ecx, 4
test dx, dx
jne 0x443920
xor eax, eax
jmp 0x44394b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push 0x53f8c0
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push esi
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push 0x53f8ec
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push 0x53f8f4
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push 0x53f900
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push 0x53f908
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push 0x53f910
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push str.desktop.ini
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
push 0x53f93c
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x443aac
lea eax, [ebp - 0x254]
push 0x53f950
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
lea eax, [ebp - 0x254]
push str.All_Programs
push eax
call fcn.004e9d0d
pop ecx
pop ecx
test eax, eax
je 0x443aac
test byte [ebp - 0x280], 0x10
jne 0x443aac
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401f01
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.004048da
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004048f2
test eax, eax
je 0x443ac5
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040297c
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x20]
call ebx
test eax, eax
jne 0x4438d5
jmp 0x443c41
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404918
push 0x53f8bc
lea ecx, [ebp - 0x18]
call fcn.004143bd
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x18]
call fcn.004143bd
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x10]
push eax
push 0x52b298
push 1
push esi
push 0x52b2a8
mov byte [ebp - 4], 8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x443b33
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x443b25
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
cmp eax, esi
jmp 0x443c2e
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x52b2c8
push eax
call dword [ecx]
test eax, eax
jl 0x443b14
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
push 0
lea esi, [ebp - 0x18]
mov dword [ebp - 0x24], eax
add ebx, 0x14
call fcn.004048da
push eax
push dword [ebp - 0x24]
call dword [ebx]
test eax, eax
jl 0x443c14
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0x11
push 0
push eax
call dword [ecx + 0x4c]
test eax, eax
jl 0x443c14
mov ebx, 0x56f16c
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402946
mov byte [ebp - 4], 9
mov esi, dword [ebp - 0x10]
push edi
lea ecx, [ebp - 0x28]
call fcn.00401db6
mov ecx, dword [esi]
push 2
push 0
push edi
push eax
push esi
call dword [ecx + 0xc]
or eax, 0xffffffff
lea esi, [ebp - 0x28]
call fcn.004048ba
push ebx
lea ecx, [ebp - 0x24]
call fcn.00402946
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x10]
push edi
lea ecx, [ebp - 0x24]
call fcn.00401db6
mov ecx, dword [esi]
push edi
push eax
push esi
call dword [ecx + 0x28]
or eax, 0xffffffff
lea esi, [ebp - 0x24]
call fcn.004048ba
lea esi, [ebp + 0x10]
call fcn.004048da
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004048f2
test eax, eax
jne 0x443bfe
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0040297c
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x443c25
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x443c36
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040297c
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040297c
mov eax, dword [ebp - 0x30]
jmp 0x443cbf
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040297c
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret