Function at 0x429d10
Capabilities:
Accept command line arguments
Access peb ldr_data
Enumerate files on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x844
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0x840], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x42a778
mov ebx, dword [esp + 0x858]
lea eax, [esp + 0xb8]
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0x104
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
lea ecx, [esp + 0xac]
lea edx, [esp + 0x3dc]
push ecx
push eax
push esi
push edx
call fcn.0042fd90
add esp, 0x10
mov eax, dword [esp + 0x3dc]
test eax, eax
je 0x429dbc
mov ecx, dword [esp + 0x3e0]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
jmp 0x42a54b
mov eax, dword [esp + 0x860]
mov ebp, dword [esp + 0x85c]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0x14
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
lea ecx, [esp + 0x14]
push 0
push eax
push ecx
push dword [esp + 0xbc]
push dword [esp + 0xbc]
call fcn.0040baa0
add esp, 0x14
mov eax, dword [esp + 0x54]
test eax, eax
je 0x42a2c2
mov edi, dword [esp + 0x50]
lea eax, [edi + eax*4]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0xc]
mov dword [esp], eax
jmp 0x429e50
test edi, edi
jne 0x42a582
mov edi, dword [esp + 8]
add edi, 4
cmp edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x85c]
je 0x42a2c2
mov esi, dword [edi]
test esi, esi
je 0x429e70
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
jmp 0x429e72
xor eax, eax
mov dword [esp + 8], edi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], eax
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x42a289
lea ecx, [esp + 0x48]
push 0
push 2
push 0x538532
call fcn.004230d0
mov edi, dword [esp + 0x48]
cmp eax, 0xffffffff
je 0x429fc0
mov eax, dword [esp + 0x4c]
cmp eax, 2
jne 0x429ee5
movzx ecx, word [edi]
cmp ecx, 0x3f2f
je 0x429fc0
movzx ecx, word [edi]
cmp ecx, 0x3f2d
je 0x429fc0
lea ecx, [esp + 0x638]
mov dword [esp + 0x62c], ecx
mov dword [esp + 0x630], 0
mov dword [esp + 0x634], 0x104
lea ecx, [esp + 0x62c]
push ecx
push eax
push edi
lea esi, [esp + 0x3e8]
push esi
call fcn.0042fc00
add esp, 0x10
mov edi, dword [esp + 0x3dc]
mov ebp, dword [esp + 0x3e0]
test edi, edi
jne 0x42a238
mov dword [esp + 4], ebp
push esi
push dword [esp + 0x630]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
lea ebp, [esp + 0x1bc]
je 0x429fde
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
lea ecx, [esp + 0x2d8]
mov dword [esp + 0x2cc], ecx
mov dword [esp + 0x2d0], 0
mov dword [esp + 0x2d4], 0x104
cmp edi, 0x105
jb 0x42a006
mov eax, ecx
lea ecx, [esp + 0x2cc]
push 1
push edi
push eax
call fcn.00424880
mov ecx, dword [esp + 0x2cc]
mov eax, dword [esp + 0x2d0]
jmp 0x42a00c
mov eax, dword [ebp + 4]
lea edx, [eax + 1]
cmp edx, dword [ebp + 8]
ja 0x42a25d
mov ecx, dword [ebp]
mov dword [ecx + eax*4], edi
add dword [ebp + 4], 1
jmp 0x429e38
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x85c]
mov eax, dword [esi + 4]
lea edx, [eax + 1]
cmp edx, dword [esi + 8]
ja 0x42a273
mov ecx, dword [esi]
mov dword [ecx + eax*4], ebx
add dword [esi + 4], 1
jmp 0x42a22d
xor eax, eax
test edi, edi
je 0x42a020
add eax, ecx
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x2d0]
add eax, edi
mov dword [esp + 0x2d0], eax
push 2
lea eax, [esp + 0x2d0]
push eax
call fcn.0042c330
add esp, 8
mov ebx, dword [esp + 0x2d0]
jmp 0x42a063
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42a207
lea eax, [esp + 0x1c8]
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], 0
mov dword [esp + 0x1c4], 0x104
lea esi, [esp + 0x408]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
push ebp
push eax
push esi
lea esi, [esp + 0x48]
push esi
call fcn.0042fd90
add esp, 0x10
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
test edi, edi
jne 0x42a1eb
mov word [esp + 0x44], 0x101
mov word [esp + 0x38], 0x101
mov word [esp + 0x2c], 0x101
mov word [esp + 0x20], 0x106
mov dword [esp + 0x18], ebp
push esi
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2dc]
push eax
call fcn.0042c240
add esp, 0x14
lea ecx, [esp + 0x14]
push dword [esp + 0x2d0]
push dword [esp + 0x2d0]
push esi
call fcn.0042af30
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x85c]
mov eax, dword [ebp + 4]
lea edx, [eax + 1]
cmp edx, dword [ebp + 8]
ja 0x42a1d5
mov ecx, dword [ebp]
mov dword [ecx + eax*4], esi
add dword [ebp + 4], 1
mov eax, dword [esp + 0x2d0]
cmp eax, ebx
lea esi, [esp + 0x3dc]
lea ebp, [esp + 0x1bc]
jbe 0x42a160
mov dword [esp + 0x2d0], ebx
jmp 0x42a1b0
jae 0x42a1b0
cmp dword [esp + 0x2d4], ebx
jae 0x42a189
lea ecx, [esp + 0x2cc]
push 1
push ebx
lea eax, [esp + 0x2e0]
push eax
call fcn.00424880
mov eax, dword [esp + 0x2d0]
mov ecx, ebx
sub ecx, eax
je 0x42a151
add eax, dword [esp + 0x2cc]
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x42a151
mov eax, dword [esp + 0x1bc]
lea ecx, [esp + 0x1c8]
cmp eax, ecx
je 0x42a050
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x42a050
mov ecx, ebp
push 4
push edx
push dword [esp + 8]
call fcn.00424880
mov eax, dword [ebp + 4]
jmp 0x42a12e
mov eax, dword [esp + 0x1bc]
lea ecx, [esp + 0x1c8]
cmp eax, ecx
je 0x42a207
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x2cc]
lea ecx, [esp + 0x2d8]
cmp eax, ecx
je 0x42a22d
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ebx, dword [esp + 0x858]
mov ebp, dword [esp + 4]
mov eax, dword [esp + 0x62c]
lea ecx, [esp + 0x638]
cmp eax, ecx
je 0x429e30
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x429e30
mov ecx, ebp
push 4
push edx
push dword [esp + 8]
call fcn.00424880
mov eax, dword [ebp + 4]
jmp 0x429fcf
mov ecx, esi
push 4
push edx
push dword [esp + 8]
call fcn.00424880
mov eax, dword [esi + 4]
jmp 0x429ff8
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x429e9f
push 0x42aec0
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x429e9f
mov eax, dword [ebp]
mov edi, dword [eax]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
lea ebx, [esp + 0x638]
mov dword [esp + 0x62c], ebx
mov dword [esp + 0x630], 0
mov dword [esp + 0x634], 0x104
cmp eax, 0x105
jb 0x42a30f
lea ecx, [esp + 0x62c]
push 1
push esi
push ebx
call fcn.00424880
jmp 0x42a313
test esi, esi
je 0x42a32c
mov eax, dword [esp + 0x62c]
add eax, dword [esp + 0x630]
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esp + 0x630], esi
lea ebp, [esp + 0x2d8]
mov dword [esp + 0x2cc], ebp
mov dword [esp + 0x2d0], 0
mov dword [esp + 0x2d4], 0x104
lea esi, [esp + 0x62c]
push 2
push esi
call fcn.0042c330
add esp, 8
push 0x104
lea eax, [esp + 0x3e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
je 0x42a3b5
test eax, eax
je 0x42a3b5
push 0x104
lea eax, [esp + 0x3e0]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x42a3b5
cmp eax, 0x105
jb 0x42a589
lea eax, [esp + 0x30]
push 0x7a
push eax
jmp 0x42a3c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.004295f0
add esp, 8
mov eax, dword [esp + 0x30]
test eax, eax
je 0x42a3e6
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x858]
mov dword [edx], eax
mov dword [edx + 4], ecx
jmp 0x42a504
mov word [esp + 0x3e4], 0x101
mov word [esp + 0x1c4], 0x101
mov word [esp + 0x44], 0x101
mov word [esp + 0x38], 0x106
lea eax, [esp + 0x2cc]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1bc]
lea edi, [esp + 0x3c]
lea ecx, [esp + 0x30]
lea ebp, [esp + 0x3dc]
push ebp
push eax
push edi
push ecx
push esi
call fcn.0042c240
add esp, 0x14
mov word [esp + 0x1c4], 0x106
mov dword [esp + 0x1bc], esi
lea ecx, [esp + 0x1bc]
push ebp
call fcn.004382d0
mov eax, dword [esp + 0x3ec]
cmp dword [esp + 0x3f0], 0xf
jbe 0x42a46c
mov ebp, dword [esp + 0x3dc]
lea ecx, [esp + 0x14]
push eax
push ebp
push edi
call fcn.0042af30
mov eax, dword [esp + 0x3f0]
cmp eax, 0x10
mov ebp, dword [esp + 0x85c]
jb 0x42a4bf
mov ecx, dword [esp + 0x3dc]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x42a4b5
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42a7ea
add eax, 0x24
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.00533ac0
add esp, 8
mov eax, dword [esp + 0x3c]
mov ecx, dword [ebp]
mov dword [ecx], eax
mov edi, dword [esp + 0x858]
mov dword [edi], 0
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x42a7b1
mov dword [edi + 4], 0x567398
lea ebp, [esp + 0x2d8]
mov eax, dword [esp + 0x2cc]
cmp eax, ebp
je 0x42a519
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [esp + 0x62c]
cmp eax, ebx
je 0x42a52e
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ebx, dword [esp + 0x858]
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x5c]
cmp eax, ecx
je 0x42a54b
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xb8]
cmp eax, ecx
je 0x42a567
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esp + 0x840]
xor ecx, esp
call fcn.00533ace
mov eax, ebx
add esp, 0x844
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebx], edi
mov dword [ebx + 4], ebp
jmp 0x42a535
lea ecx, [esp + 0x2cc]
lea edx, [esp + 0x3c]
push ecx
push eax
lea eax, [esp + 0x3e4]
push eax
push edx
call fcn.0042fd90
add esp, 0x10
cmp dword [esp + 0x3c], 0
je 0x42a5c3
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
jmp 0x42a3c9
mov edi, dword [esp + 0x2cc]
test edi, edi
je 0x42a5d9
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
jmp 0x42a5db
xor eax, eax
lea ecx, [esp + 0x30]
push 2
push eax
push edi
push ecx
call fcn.0042cdf0
add esp, 0x10
mov eax, dword [esp + 0x30]
test eax, eax
je 0x42a63b
mov edi, dword [esp + 0x34]
mov dword [esp + 0x1d0], 0xf
mov dword [esp + 0x1cc], 0
mov byte [esp + 0x1bc], 0
cmp edi, 0xf
jbe 0x42a671
sub esp, 0xc
mov cl, byte [esp + 0x30]
mov byte [esp + 4], cl
mov dword [esp + 8], eax
mov dword [esp], edi
lea ecx, [esp + 0x1c8]
call fcn.00404140
jmp 0x42a692
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x1d0], 0xf
mov dword [esp + 0x1cc], 0
mov byte [esp + 0x1bc], 0
mov dword [esp + 0x2d0], 0
xor edi, edi
xor eax, eax
jmp 0x42a6e8
mov dword [esp + 0x1cc], edi
lea ecx, [esp + 0x1bc]
push edi
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esp + edi + 0x1bc], 0
mov edi, dword [esp + 0x1cc]
cmp dword [esp + 0x1d0], 0xf
jbe 0x42a6ac
mov ecx, dword [esp + 0x1bc]
jmp 0x42a6b3
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x2d0], 0
xor eax, eax
cmp dword [esp + 0x2d4], edi
jae 0x42a6e8
mov dword [esp + 8], ecx
lea ecx, [esp + 0x2cc]
push 1
push edi
push ebp
call fcn.00424880
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x2d0]
add eax, dword [esp + 0x2cc]
push edi
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
add dword [esp + 0x2d0], edi
mov dword [esp + 0x30], 0
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x42a7f0
mov dword [esp + 0x34], 0x567398
mov eax, dword [esp + 0x1d0]
cmp eax, 0x10
jb 0x42a3c9
mov ecx, dword [esp + 0x1bc]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x42a76c
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42a7ea
add eax, 0x24
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.00533ac0
jmp 0x42a3c6
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x429d51
push 0x42aec0
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x429d51
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x42a4f6
push 0x42aec0
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x42a4f6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x42a72a
push 0x42aec0
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x42a72a