Function at 0x402a68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov al, byte [esi + 4]
test al, al
jne 0x402ad4
mov dl, byte [esi + 5]
test dl, dl
je 0x402a98
mov ecx, dword [esi + 0x3f0]
push ecx
call sub.KERNEL32.DLL_FindClose
mov byte [esi + 5], 0
mov al, byte [esi + 7]
test al, al
jne 0x402aa6
xor eax, eax
jmp 0x402c92
lea edx, [ebp - 0x148]
push edx
lea ecx, [esi + 7]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov dword [esi + 0x3f0], edi
cmp edi, 0xffffffff
jne 0x402aca
xor eax, eax
jmp 0x402c92
mov dl, 1
mov byte [esi + 5], dl
mov byte [esi + 4], dl
jmp 0x402b06
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [esi + 0x3f0]
push ecx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x402b06
mov eax, dword [esi + 0x3f0]
push eax
call sub.KERNEL32.DLL_FindClose
xor edx, edx
mov byte [esi + 5], dl
mov byte [esi + 4], dl
xor eax, eax
jmp 0x402c92
xor ecx, ecx
mov dword [ebx], ecx
test byte [ebp - 0x148], 0x10
je 0x402b16
or dword [ebx], 1
test byte [ebp - 0x148], 2
je 0x402b22
or dword [ebx], 8
test byte [ebp - 0x148], 1
je 0x402b2e
or dword [ebx], 4
test byte [ebp - 0x148], 4
je 0x402b3a
or dword [ebx], 2
xor eax, eax
xor edx, edx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x1c], edx
lea eax, [ebp - 8]
lea ecx, [ebp - 0x144]
push eax
push ecx
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
test eax, eax
je 0x402bd4
lea eax, [ebp - 0x158]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_FileTimeToSystemTime
test eax, eax
je 0x402bd4
movzx eax, word [ebp - 0x158]
mov dword [ebx + 0x18], eax
cmp eax, 0x641
jne 0x402ba2
mov dword [ebx + 0x18], 0x7bc
movzx edx, word [ebp - 0x156]
mov dword [ebx + 0x14], edx
movzx ecx, word [ebp - 0x152]
mov dword [ebx + 0x10], ecx
movzx eax, word [ebp - 0x150]
mov dword [ebx + 0xc], eax
movzx edx, word [ebp - 0x14e]
mov dword [ebx + 8], edx
movzx ecx, word [ebp - 0x14c]
mov dword [ebx + 4], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
test eax, eax
je 0x402c46
lea ecx, [ebp - 0x158]
push ecx
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_FileTimeToSystemTime
test eax, eax
je 0x402c46
movzx eax, word [ebp - 0x158]
mov dword [ebx + 0x30], eax
cmp eax, 0x641
jne 0x402c14
mov dword [ebx + 0x30], 0x7bc
movzx edx, word [ebp - 0x156]
mov dword [ebx + 0x2c], edx
movzx ecx, word [ebp - 0x152]
mov dword [ebx + 0x28], ecx
movzx eax, word [ebp - 0x150]
mov dword [ebx + 0x24], eax
movzx edx, word [ebp - 0x14e]
mov dword [ebx + 0x20], edx
movzx ecx, word [ebp - 0x14c]
mov dword [ebx + 0x1c], ecx
push 0xc8
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebx + 0x40]
push edx
call fcn.0069d020
add esp, 0xc
xor edx, edx
mov byte [ebx + 0x107], 0
push 1
push 0
mov eax, dword [ebp - 0x12c]
call fcn.006a4d58
push edx
push eax
mov eax, dword [ebp - 0x128]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret