Function at 0x428ed8
Capabilities:
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c0
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x5bc], eax
mov eax, dword [esp + 0x5c8]
push ebx
mov ebx, ecx
mov dword [esp + 0xc], eax
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x5cc]
mov byte [esp + 0xb], cl
cmp byte [ebx + 0x7f], cl
jne 0x428f14
mov al, 1
jmp 0x429606
test dword [ebx + 0x1c8], 0x100
jne 0x428f44
push 0x8124dca2
push 0xfd84beeb
push 0x2d983b76
call fcn.00401bb2
push eax
push 2
push dword [ebx + 0x60]
call fcn.0041ffc2
add esp, 0x18
jmp 0x428f0d
push esi
push 0x104
lea eax, [esp + 0x3c4]
mov dword [esp + 0x14], ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x3c0]
push 0x5c
push eax
call fcn.004bacf8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42902d
push 0x8b2bb835
push 0xf78bda6b
push 0x27975fd8
call fcn.00401bdf
mov ecx, eax
lea edx, [esi + 2]
add esp, 0xc
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x428f96
lea eax, [esp + 0x3c0]
push eax
call fcn.0041fa4a
pop ecx
test al, al
je 0x42902d
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c4]
push eax
lea eax, [ebx + 0x21c]
push eax
call fcn.0042776a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42902d
push dword [esp + 0x10]
mov ecx, ebx
push esi
call fcn.0043697e
push esi
mov byte [esp + 0x13], al
call fcn.00404d44
cmp byte [esp + 0x13], 0
pop ecx
je 0x42902d
lea eax, [esp + 0x3c0]
push eax
push 0xa495a020
push 0xd835c271
push 0x82947b0
call fcn.00401bdf
add esp, 0xc
push eax
push 5
push dword [ebx + 0x60]
call fcn.004200bb
mov al, byte [esp + 0x1f]
add esp, 0x10
jmp 0x429605
mov ecx, dword [0x529a98]
lea eax, [esp + 0x3c0]
push edi
push eax
call fcn.0040dbe1
push 0x6a88831e
mov edi, eax
push 0x1628e140
push 0xc6346491
mov dword [esp + 0x28], edi
call fcn.00401bdf
mov edx, edi
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x429062
lea eax, [esp + 0x3c4]
push eax
call fcn.0041fa4a
pop ecx
test al, al
je 0x42912f
call fcn.004042b3
test eax, eax
je 0x429102
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c8]
push eax
lea eax, [ebx + 0x21c]
push eax
call fcn.0042776a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42912f
push dword [esp + 0x14]
mov ecx, ebx
push esi
call fcn.0043697e
push esi
mov byte [esp + 0x17], al
call fcn.00404d44
cmp byte [esp + 0x17], 0
pop ecx
je 0x42912f
lea eax, [esp + 0x3c4]
push eax
push 0x550220b2
push 0x29a242e3
push 0xf9bec704
call fcn.00401bdf
add esp, 0xc
push eax
push 5
push dword [ebx + 0x60]
call fcn.004200bb
add esp, 0x10
jmp 0x429600
lea eax, [esp + 0x3c4]
push eax
push 0x8077f18b
push 0xfcd793c6
push 0x2ccb1631
call fcn.00401bb2
add esp, 0xc
push eax
push 2
push dword [ebx + 0x60]
call fcn.0041ffc2
add esp, 0x10
test byte [ebp + 0xa], 1
jne 0x4291cb
push dword [esp + 0x18]
lea eax, [esp + 0x3b8]
mov ecx, ebx
push ebp
push eax
call fcn.00428748
test al, al
jne 0x429175
push 0x72aad3df
push 0xe0ab19e
push 0xde16338f
call fcn.00401bb2
push eax
push 2
push dword [ebx + 0x60]
call fcn.0041ffc2
add esp, 0x18
jmp 0x4291cb
push 0
lea eax, [esp + 0x3b8]
push 0
push eax
call fcn.0042b405
add esp, 0xc
push eax
push 0xbaf48822
push 0xc654ea7c
push 0x16486843
call fcn.00401bb2
add esp, 0xc
push eax
push 1
push dword [ebx + 0x60]
call fcn.0041ffc2
lea edi, [ebp + 0x8c]
add esp, 0x10
or dword [ebp + 8], 0x10000
lea esi, [esp + 0x3b4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x1c]
push edi
lea eax, [ebp + 0x8c]
push 0x10
push eax
call fcn.0041fe98
push 0xaf5c68a5
push 0xd3fc0af6
push 0x3e088c3
lea esi, [edi + 0x40]
call fcn.00401bdf
mov edx, esi
add esp, 0x18
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4291f8
lea eax, [esp + 0x3c4]
push eax
call fcn.0041fa4a
pop ecx
test al, al
je 0x429272
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c8]
push eax
call fcn.0041fd60
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x429272
push dword [esp + 0x14]
mov ecx, ebx
push edi
call fcn.00436e60
push edi
mov byte [esp + 0x17], al
call fcn.00404d44
cmp byte [esp + 0x17], 0
pop ecx
je 0x429272
lea eax, [esp + 0x3c4]
push eax
push 0x36ac3ea9
push 0x4a0c5cf7
push 0x9a10deb6
jmp 0x429548
lea eax, [ebx + 0x94]
push eax
push 0x9ca6c23
push 0x756a0e7d
push 0xa5768c22
call fcn.00401bdf
add esp, 0xc
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x3d0]
push eax
call fcn.0041fa4a
add esp, 0x10
test al, al
je 0x429305
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c8]
push eax
call fcn.0041fd60
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x429305
push dword [esp + 0x14]
mov ecx, ebx
push edi
call fcn.00436e60
push edi
mov byte [esp + 0x17], al
call fcn.00404d44
cmp byte [esp + 0x17], 0
pop ecx
je 0x429305
lea eax, [esp + 0x3c4]
push eax
push 0x253c3cd4
push 0x599c5e8a
push 0x8980dce7
jmp 0x429548
push 0xb29e4b34
push 0xce3e2965
push 0x1e22ab1e
call fcn.00401bdf
add esp, 0xc
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x42931e
and dword [esp + 0x164], 0
lea eax, [esp + 0x168]
push 0x24c
push 0
push eax
call fcn.004bea90
add esp, 0xc
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x3c8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4293fd
lea eax, [esp + 0x3c4]
push 0x5c
push eax
call fcn.004bacf8
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x4293f6
lea ecx, [esp + 0x190]
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x42938f
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c8]
push eax
call fcn.0041fd60
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4293df
push dword [esp + 0x14]
mov ecx, ebx
push esi
call fcn.00436e60
push esi
mov byte [esp + 0x17], al
call fcn.00404d44
cmp byte [esp + 0x17], 0
pop ecx
jne 0x429531
lea eax, [esp + 0x164]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42936d
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004042b3
test eax, eax
je 0x4295e7
push 0x143
lea eax, [esp + 0x25]
push 0
push eax
call fcn.004bea90
mov al, byte [ebp + 0x73]
mov byte [esp + 0x2c], 1
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], 0xef
call fcn.0040a8a0
mov dword [esp + 0x68], eax
lea esi, [ebp + 0x58]
mov eax, dword [ebx + 0x224]
lea edi, [esp + 0x4c]
mov dword [esp + 0x34], eax
mov eax, dword [ebx + 0x1a8]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0x1ac]
mov dword [esp + 0x44], eax
mov eax, dword [ebx + 0x21c]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x220]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0xac]
push 5
pop ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x30], 0xa6f
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0xb0]
mov dword [esp + 0x64], eax
movzx eax, byte [esp + 0x2e]
push eax
lea eax, [ebp + 0x140]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.004be440
and dword [esp + 0x30], 0
lea eax, [esp + 0x30]
push eax
movzx eax, byte [esp + 0x3e]
add eax, 0x44
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0043af1e
add esp, 0x24
cmp eax, 0xc8
jne 0x429565
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4295c5
cmp dword [eax], 0x12bfbbef
jne 0x429525
push dword [eax + 8]
add eax, 0x10
mov ecx, ebx
push eax
call fcn.0043697e
mov byte [esp + 0x13], al
test al, al
je 0x429521
push 0x76de2bd5
push 0xa7e4993
push 0xda62cb12
call fcn.00401bdf
push eax
push 5
push dword [ebx + 0x60]
call fcn.004200bb
add esp, 0x18
mov eax, dword [esp + 0x18]
push eax
call fcn.00404d44
pop ecx
jmp 0x429600
lea eax, [esp + 0x3c4]
push eax
push 0xe5fe4b76
push 0x995e2928
push 0x4942aba3
call fcn.00401bb2
add esp, 0xc
push eax
push 1
push dword [ebx + 0x60]
call fcn.0041ffc2
add esp, 0x10
mov al, 1
jmp 0x429604
cmp eax, 0x1e1
jne 0x42957d
push 0x60a7cd62
push 0x1c07af23
push 0xcc1b2d84
jmp 0x4295d4
cmp eax, 0x1e0
jne 0x429595
push 0x910c2b89
push 0xedac49c0
push 0x3db0cb0d
jmp 0x4295d4
cmp eax, 0x1e2
jne 0x4295ad
push 0xde62efd1
push 0xa2c28d94
push 0x72de0f77
jmp 0x4295d4
cmp eax, 0x1e3
jne 0x4295c5
push 0x364b3b38
push 0x4aeb5972
push 0x9af7db87
jmp 0x4295d4
push 0x80d3793e
push 0xfc731b7b
push 0x2c6f986c
call fcn.00401bb2
push eax
push 3
push dword [ebx + 0x60]
call fcn.0041ffc2
add esp, 0x18
mov dword [ebx + 0x74], 0x21
mov al, byte [ebx + 0x26]
mov byte [ebx + 0x78], al
mov al, byte [ebx + 0x30]
mov byte [ebx + 0x79], al
mov al, byte [ebx + 0x31]
mov byte [ebx + 0x7a], al
mov al, byte [esp + 0x13]
pop edi
pop esi
mov ecx, dword [esp + 0x5c4]
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x5c0
ret 8