Function at 0x40bcb0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x4c0
mov eax, dword [0x41c1e4]
xor eax, esp
mov dword [esp + 0x4bc], eax
push ebx
push ebp
push esi
push edi
push 0x202
lea eax, [esp + 0x268]
mov edi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [edi + 0x188]
add esp, 0xc
test ebx, ebx
jne 0x40bcf3
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
mov ebx, eax
movzx eax, bl
dec eax
cmp eax, 0x3e
ja case.0x40bd07.3
movzx eax, byte [eax + 0x40c30c]
jmp dword [eax*4 + 0x40c278]
mov ebx, 0x401
jmp case.0x40bd07.3
mov eax, ebx
mov ecx, 0x816
and eax, 0xfc00
mov ebx, 0x416
cmp eax, 0x400
cmovne ebx, ecx
jmp case.0x40bd07.3
mov ebx, 0x402
jmp case.0x40bd07.3
mov eax, ebx
mov ecx, 0x404
and eax, 0xfc00
mov ebx, 0x804
cmp eax, 0x800
cmovne ebx, ecx
jmp case.0x40bd07.3
mov ebx, 0x405
jmp case.0x40bd07.3
mov ebx, 0x406
jmp case.0x40bd07.3
mov ebx, 0x413
jmp case.0x40bd07.3
mov ebx, 0x425
jmp case.0x40bd07.3
mov ebx, 0x40b
jmp case.0x40bd07.3
mov ebx, 0x40c
jmp case.0x40bd07.3
mov ebx, 0x407
jmp case.0x40bd07.3
mov ebx, 0x408
jmp case.0x40bd07.3
mov ebx, 0x40d
jmp case.0x40bd07.3
mov ebx, 0x439
jmp case.0x40bd07.3
mov ebx, 0x40e
jmp case.0x40bd07.3
mov ebx, 0x421
jmp case.0x40bd07.3
mov ebx, 0x410
jmp case.0x40bd07.3
mov ebx, 0x411
jmp case.0x40bd07.3
mov ebx, 0x43f
jmp case.0x40bd07.3
mov ebx, 0x412
jmp case.0x40bd07.3
mov ebx, 0x426
jmp case.0x40bd07.3
mov ebx, 0x427
jmp case.0x40bd07.3
mov ebx, 0x43e
jmp case.0x40bd07.3
mov ebx, 0x414
jmp case.0x40bd07.3
mov ebx, 0x415
jmp case.0x40bd07.3
mov ebx, 0x418
jmp case.0x40bd07.3
mov ebx, 0x419
jmp case.0x40bd07.3
mov eax, ebx
mov ecx, 0x41a
and eax, 0xfc00
mov ebx, 0x81a
cmp eax, 0x800
cmovne ebx, ecx
jmp case.0x40bd07.3
mov ebx, 0x41b
jmp case.0x40bd07.3
mov ebx, 0x424
jmp case.0x40bd07.3
mov ebx, 0xc0a
jmp case.0x40bd07.3
mov ebx, 0x41d
jmp case.0x40bd07.3
mov ebx, 0x41e
jmp case.0x40bd07.3
mov ebx, 0x41f
jmp case.0x40bd07.3
mov ebx, 0x422
jmp case.0x40bd07.3
mov ebx, 0x42a
push 0x101
lea eax, [esp + 0x268]
push eax
push dword [0x41c334]
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x40c18f
lea ecx, [esp + 0x264]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40beb0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xb
jb 0x40c18f
lea ecx, [ecx*2 - 0x16]
cmp ecx, 0x202
jae 0x40c273
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xor eax, eax
push 0x417170
mov word [esp + ecx + 0x268], ax
lea eax, [esp + 0x268]
push 0x101
push eax
call esi
lea ebp, [esp + 0x270]
add esp, 0xc
lea ecx, [ebp + 2]
nop dword [eax]
mov ax, word [ebp]
add ebp, 2
test ax, ax
jne 0x40bf10
push 0xa
push 0x32
lea eax, [esp + 0x470]
sub ebp, ecx
push eax
push ebx
sar ebp, 1
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow_s]
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x278]
push 0x101
push eax
call esi
push str.msolui.rll
lea eax, [esp + 0x284]
push 0x101
push eax
call esi
lea esi, [esp + 0x28c]
add esp, 0x28
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40bf70
push 1
push 0
lea eax, [esp + 0x26c]
sub esi, ecx
push eax
sar esi, 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [edi + 0x19c], eax
test eax, eax
jne 0x40c19a
lea ecx, [esp + 0x264]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bfb0
sub ecx, edx
sar ecx, 1
sub ecx, esi
add ecx, ebp
add ecx, ecx
cmp ecx, 0x202
jae 0x40c273
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xor eax, eax
push str.1033msolui.rll
mov word [esp + ecx + 0x268], ax
lea eax, [esp + 0x268]
push 0x101
push eax
call ebx
lea esi, [esp + 0x270]
add esp, 0xc
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40c002
push 1
push 0
lea eax, [esp + 0x26c]
sub esi, ecx
push eax
sar esi, 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [edi + 0x19c], eax
test eax, eax
jne 0x40c19a
lea ecx, [esp + 0x264]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c040
sub ecx, edx
sar ecx, 1
sub ecx, esi
add ecx, ebp
add ecx, ecx
cmp ecx, 0x202
jae 0x40c273
xor eax, eax
push 0x4171c0
mov word [esp + ecx + 0x268], ax
lea eax, [esp + 0x268]
push 0x101
push eax
call ebx
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
lea esi, [esp + 0x264]
mov ebx, eax
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40c0a1
sub esi, ecx
sar esi, 1
sub esi, ebp
cmp ebx, 0xffffffff
je 0x40c186
nop dword [eax + eax]
test byte [esp + 0x14], 0x10
je 0x40c162
lea ecx, [esp + 0x264]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c0d5
sub ecx, edx
sar ecx, 1
sub ecx, esi
add ecx, ecx
cmp ecx, 0x202
jae 0x40c273
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xor eax, eax
mov word [esp + ecx + 0x264], ax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x268]
push 0x101
push eax
call esi
push str.msolui.rll
lea eax, [esp + 0x274]
push 0x101
push eax
call esi
add esp, 0x18
lea eax, [esp + 0x264]
push 1
push 0
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
lea esi, [esp + 0x264]
mov dword [edi + 0x19c], eax
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40c151
sub esi, ecx
sar esi, 1
sub esi, ebp
cmp dword [edi + 0x19c], 0
jne 0x40c17f
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x40c0c0
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [edi + 0x19c], 0
jne 0x40c19a
mov eax, dword [0x41c338]
mov dword [edi + 0x19c], eax
mov ecx, edi
call fcn.00406940
mov ecx, edi
call fcn.00410e50
push 1
mov ecx, edi
call fcn.00411110
mov eax, dword [edi + 0x150]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
cmp cx, word [eax]
jne 0x40c1d9
push ecx
push 1
push dword [edi + 4]
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x150]
push eax
mov ecx, edi
call 0x411380
mov ecx, dword [edi + 4]
test al, al
je 0x40c21a
push 0x4b5
push ecx
call esi
push 0
push 1
mov esi, eax
push 0xf1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
push esi
push 0x4b5
push 0
call fcn.0040b8e0
xor eax, eax
jmp 0x40c24d
push 0x4b6
push ecx
call esi
push 0
push 1
mov esi, eax
push 0xf1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
push esi
push 0x4b6
push 0
call fcn.0040b6f0
mov eax, 1
mov ecx, dword [esp + 0x4cc]
mov dword [edi + 0x194], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00411ed7
add esp, 0x4c0
ret 0x10
call fcn.00412678
push cs
mov ebp, -1120534464
inc eax
add byte [eax - 0x43], al
inc eax
add byte [esi - 0x43], bl
inc eax
add byte [eax - 0x43], ch
inc eax
add byte [edx - 0x5bffbf43], bl
mov ebp, 0xbe580040
inc eax
add byte [esi - 0x6fffbf43], al
mov ebp, 0xbdae0040
inc eax
add dl, al
mov ebp, 0xbdd60040
inc eax
add al, ah
mov ebp, 0xbdf40040
inc eax
add byte [edx - 0x43], dh
inc eax
add byte [ebx], dl
mov esi, 0xbe1a0040
inc eax
add byte [eax], bl
mov ebp, 0xbe210040
inc eax
add byte [eax], ch
mov esi, 0xbe2f0040
inc eax
add byte [edx - 0x42], cl
inc eax
add byte [edi - 0x42], bl
inc eax
add byte [esi - 0x42], ah
inc eax
add byte [ebp - 0x42], ch
inc eax
add ah, cl
mov ebp, 0xbe740040
inc eax
add byte [ecx - 0x42], dl
inc eax
add byte [ebp + edi*4 + 0x40], bh
add dh, bh
mov ebp, 0xbe050040
inc eax
add byte [ebx - 0x42], bh
inc eax
add byte [eax + 0xc0040bd], bh
mov esi, 0xbdea0040
inc eax
add byte [eax + 0x40be], al
add dword [edx + eax], esp
add eax, dword [eax + 134685702]
or dword [edx], ecx
or esp, dword [esp + ecx]
or eax, 286265102
adc ah, byte [ebx + edx]
adc al, 21
push ss
and al, 23
sbb byte [ecx], bl
and al, 26
sbb esp, dword [esp + ebx]
sbb eax, 606347038
and byte [esp], ah
and al, 36
and al, 36
and al, 36
and al, 36
and al, 36
and al, 36
and dword [esp], esp
and al, 36
and ah, byte [ebx]
int3