Function at 0x402330
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x27c
mov esi, dword [eax + 0x40]
mov dword [ebp - 0x26c], eax
add eax, 0x40
mov dword [ebp - 0x274], eax
cmp eax, esi
je 0x402528
lea esi, [esi]
lea esi, [esi]
mov edi, dword [esi + 8]
mov dword [esp + 4], 0x405248
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
je 0x402550
mov eax, dword [ebp - 0x26c]
mov ebx, dword [eax + 4]
movzx ecx, word [ebx]
test cx, cx
je 0x4025d0
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x402398
sub eax, ebx
sar eax, 1
add eax, 2
cmp word [edi], 0
je 0x4025c8
mov edx, edi
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4023b8
sub edx, edi
sar edx, 1
add edx, eax
mov dword [ebp - 0x270], ecx
add edx, edx
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, eax
test eax, eax
je 0x4025bb
mov ecx, dword [ebp - 0x270]
jmp 0x4023f3
movzx ecx, word [ebx]
add eax, 2
add ebx, 2
mov word [eax - 2], cx
test cx, cx
jne 0x4023f0
mov dword [esp], edx
mov dword [ebp - 0x270], edx
call dword [sym.imp.shlwapi.dll_PathAddBackslashW]
mov edx, dword [ebp - 0x270]
sub esp, 4
cmp word [edx], 0
mov ecx, edx
je 0x402431
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x402428
xor eax, eax
lea esi, [esi]
nop
movzx ebx, word [edi + eax]
mov word [ecx + eax], bx
add eax, 2
test bx, bx
jne 0x402438
lea eax, [ebp - 0x268]
mov dword [esp], edx
mov dword [ebp - 0x270], edx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x270]
sub esp, 8
mov ebx, eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 0xffffffff
je 0x4025bb
lea edi, [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
cmp eax, 0x2e
je 0x4024f0
cmp eax, 0x2e002e
je 0x402538
test byte [ebp - 0x268], 0x10
jne 0x4024f0
mov dword [esp], edi
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x4024f0
mov dword [esp + 4], 0x40524c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x4024f0
mov eax, dword [ebp - 0x26c]
mov ecx, edi
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call sym._import_table.isra.0
test eax, eax
je 0x4025da
lea esi, [esi]
lea esi, [esi]
lea eax, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x402484
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov esi, dword [esi]
cmp dword [ebp - 0x274], esi
jne 0x402360
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [ebp - 0x238], 0
jne 0x40249a
jmp 0x4024f0
mov dword [esp], edi
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x402578
mov dword [esp + 4], 0x40524c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x4025a0
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x268]
mov dword [esp + 8], str._.8s.idt
mov dword [esp + 4], 0x104
mov dword [esp], eax
call sym._swprintf.constprop.0
mov eax, dword [ebp - 0x26c]
mov ecx, edi
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call sym._import_table.isra.0
test eax, eax
jne 0x40251a
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
jmp 0x4023c5
mov eax, 2
jmp 0x4023a8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
jmp 0x4025bb