Function at 0x4071d0
Capabilities:
Enumerate files on windows
Get file system object information

Disassembly:
sub esp, 0x5c4
mov edx, dword [esp + 0x5c8]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1a0]
push ebx
mov ebx, dword [esp + 0x5d0]
push ebp
push esi
push edi
push 0x2ee0
push ebx
push eax
push 0x2c4
push ecx
push edx
call fcn.00408c70
add esp, 0x18
test al, al
jne 0x407218
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c4
ret
mov esi, str.DESKTOP
lea eax, [esp + 0x1b0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407248
test cl, cl
je 0x407244
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407248
add eax, 2
add esi, 2
test cl, cl
jne 0x407224
xor eax, eax
jmp 0x40724d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4072a7
mov ecx, 0x80
lea edi, [esp + 0x1b0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1b0]
push 0x200
push eax
push 0
call fcn.00407c50
mov edi, 0x42e514
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1b0]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x70]
lea ecx, [esp + 0x1b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x20], ebp
jne 0x4072d2
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5c4
ret
mov ecx, 0x58
xor eax, eax
lea edi, [esp + 0x474]
push 0x510
lea edx, [esp + 0x478]
push 0x160
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0xa8]
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [esp + 0x70]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test al, 0x10
mov edi, str.Folder
jne 0x407346
lea edi, [esp + 0x584]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3b0]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0x8c]
sub ecx, esi
shr ecx, 0xa
push ecx
push 0x42e508
push edx
call fcn.0041255c
mov al, byte [esp + 0x7c]
add esp, 0xc
test al, 0x10
mov edi, 0x432af0
jne 0x4073a1
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x430]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x84]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a]
mov ecx, dword [esp + 0x18]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1a]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x1a]
push ecx
mov ecx, dword [esp + 0x1c]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x68]
push str._4d__02d__02d__02d:_02d:_02d
push edx
call fcn.0041255c
lea edi, [esp + 0x70]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x450]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x9c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x70]
mov esi, 0x42e4e4
mov dword [esp + 0x470], ecx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40749d
test cl, cl
je 0x407499
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40749d
add eax, 2
add esi, 2
test cl, cl
jne 0x407479
xor eax, eax
jmp 0x4074a2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407507
mov esi, 0x42e4e0
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4074d6
test cl, cl
je 0x4074d2
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4074d6
add eax, 2
add esi, 2
test cl, cl
jne 0x4074b2
xor eax, eax
jmp 0x4074db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407507
mov edx, dword [esp + 0x5d8]
push 0x2ee0
lea eax, [esp + 0x28]
push ebx
push eax
lea ecx, [esp + 0x1bc]
push 0x2c4
push ecx
push edx
call fcn.00408be0
add esp, 0x18
test ebp, ebp
je 0x407783
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x70]
push eax
push ecx
call ebp
test eax, eax
je 0x407774
mov esi, 0x42e4e4
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40755f
test cl, cl
je 0x40755b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40755f
add eax, 2
add esi, 2
test cl, cl
jne 0x40753b
xor eax, eax
jmp 0x407564
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40751b
mov esi, 0x42e4e0
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x407598
test cl, cl
je 0x407594
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x407598
add eax, 2
add esi, 2
test cl, cl
jne 0x407574
xor eax, eax
jmp 0x40759d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40751b
mov ecx, 0x58
xor eax, eax
lea edi, [esp + 0x474]
push 0x510
rep stosd dword es:[edi], eax
lea eax, [esp + 0x478]
push 0x160
push eax
lea ecx, [esp + 0xa8]
push 0x80
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [esp + 0x70]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test al, 0x10
mov edi, str.Folder
jne 0x407619
lea edi, [esp + 0x584]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3b0]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0x8c]
sub ecx, esi
shr ecx, 0xa
push ecx
push 0x42e508
push edx
call fcn.0041255c
mov al, byte [esp + 0x7c]
add esp, 0xc
test al, 0x10
mov edi, 0x432af0
jne 0x407674
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x430]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x84]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a]
mov ecx, dword [esp + 0x18]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1a]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x1a]
push ecx
mov ecx, dword [esp + 0x1c]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x68]
push str._4d__02d__02d__02d:_02d:_02d
push edx
call fcn.0041255c
lea edi, [esp + 0x70]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x470]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2ee0
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x600]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x48]
and ecx, 3
push edx
mov edx, dword [esp + 0x600]
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x9c]
push 0x2c4
mov dword [esp + 0x4a0], ecx
lea ecx, [esp + 0x1e0]
push ecx
push edx
call fcn.00408be0
add esp, 0x38
jmp 0x40751b
call ebx
cmp eax, 0x12
jne 0x40751b
mov ebp, dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x5c4
ret