Function at 0x422c40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x423f67
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x42e110]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42e110]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 0
push edi
mov dword [esp + 0x2bc], 2
call fcn.00401430
lea ecx, [esp + 0x2cc]
call fcn.0041b2c0
mov ebp, vtable.PathLibrary.0
test al, al
je 0x422d1e
mov dword [esp + 0x58], ebp
sub esp, 0xc
mov ebx, 3
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x2cc]
mov esi, esp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], esp
call fcn.0041b390
sub esp, 0xc
mov dword [esp + 0x2d0], 4
lea ecx, [esp + 0x2e4]
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.0041b390
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x2d4], bl
call fcn.004208d0
add esp, 0x1c
mov dword [esp + 0x2b8], 5
mov ebx, 7
jmp 0x422d69
mov dword [esp + 0x18], ebp
sub esp, 0xc
mov dword [esp + 0x2c4], 6
lea ecx, [esp + 0x2cc]
mov esi, esp
mov dword [esp + 0x20], 9
mov dword [esp + 0x2c], esp
call fcn.0041b390
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.00420bc0
add esp, 0x14
mov dword [esp + 0x2b8], 7
mov ebx, 0x19
mov ecx, eax
lea esi, [esp + 0x4c]
mov dword [esp + 0x14], ebx
call fcn.0041b390
mov dword [esp + 0x2b8], 8
test bl, 0x10
je 0x422d98
and ebx, 0xffffffef
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], ebx
call fcn.0041b440
test bl, 8
je 0x422da4
and ebx, 0xfffffff7
mov dword [esp + 0x14], ebx
test bl, 4
je 0x422db9
and ebx, 0xfffffffb
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.0041b440
test bl, 2
je 0x422dc5
and ebx, 0xfffffffd
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
sub esp, 0xc
mov byte [esp + 0x2c4], 0xd
lea ecx, [esp + 0x58]
mov esi, esp
mov dword [esp + 0x2c], esp
call fcn.0041b390
lea edx, [esp + 0x4c]
push edx
call fcn.00420600
add esp, 0x10
mov ecx, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x2b8], 0xe
call fcn.0041b390
lea ecx, [esp + 0x40]
call fcn.0041b440
push 0x24c
lea eax, [esp + 0x64]
push 0
mov byte [esp + 0x2c0], 0x11
push eax
mov dword [esp + 0x68], 0
call fcn.0040c6a0
add esp, 0xc
lea ecx, [esp + 0x5c]
push ecx
mov eax, esi
call fcn.0041b2f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
xor eax, eax
cmp ebp, 0xffffffff
setne al
test eax, eax
je 0x422f34
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x4285c4
lea eax, [esp + 0x88]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422e8d
test dx, dx
je 0x422e89
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422e8d
add eax, 4
add ecx, 4
test dx, dx
jne 0x422e67
xor eax, eax
jmp 0x422e92
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x422ed5
mov ecx, 0x4285cc
lea eax, [esp + 0x88]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422ec8
test dx, dx
je 0x422ec4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422ec8
add eax, 4
add ecx, 4
test dx, dx
jne 0x422ea2
xor eax, eax
jmp 0x422ecd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x422ed5
xor al, al
jmp 0x422ed7
mov al, 1
test byte [esp + 0x5c], 0x10
je 0x422ee8
cmp byte [esp + 0x2dc], 0
je 0x422f24
test al, al
jne 0x422f24
mov eax, 0xffffffff
lea edx, [esp + 0x88]
lea esi, [esp + 0x24]
call fcn.0041b400
mov edx, esi
push edx
mov byte [esp + 0x2bc], 0x12
call fcn.00401720
mov ecx, esi
mov byte [esp + 0x2b8], 0x11
call fcn.0041b440
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x5c]
push eax
push ebp
call ebx
test eax, eax
jne 0x422e5b
cmp ebp, 0xffffffff
je 0x422f40
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [esp + 0x2d8], 0
je 0x423034
sub esp, 0xc
lea ecx, [esp + 0x40]
mov esi, esp
mov dword [esp + 0x24], esp
call fcn.0041b390
lea ecx, [esp + 0x30]
push ecx
call fcn.004207b0
add esp, 0x10
mov byte [esp + 0x2b8], 0x13
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
xor ebp, ebp
add eax, edx
je 0x42302b
push ebp
mov eax, edi
call fcn.00401590
sub esp, 0xc
mov ecx, eax
mov esi, esp
mov dword [esp + 0x24], esp
call fcn.0041b390
sub esp, 0xc
mov byte [esp + 0x2d0], 0x14
lea ecx, [esp + 0x3c]
mov esi, esp
mov dword [esp + 0x38], esp
call fcn.0041b390
lea ecx, [esp + 0x58]
push ecx
mov byte [esp + 0x2d4], 0x13
call fcn.004208d0
add esp, 0x1c
mov edi, eax
mov byte [esp + 0x2b8], 0x15
mov ebx, dword [esp + 0x1c]
push ebp
mov eax, ebx
call fcn.00401590
mov esi, eax
mov eax, edi
call fcn.0041b760
lea ecx, [esp + 0x40]
mov byte [esp + 0x2b8], 0x13
call fcn.0041b440
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
mov edi, ebx
cmp ebp, eax
jb 0x422f93
lea ecx, [esp + 0x24]
call fcn.0041b440
lea ecx, [esp + 0x34]
call fcn.0041b440
lea ecx, [esp + 0x4c]
call fcn.0041b440
lea ecx, [esp + 0x2c0]
call fcn.0041b440
lea ecx, [esp + 0x2cc]
call fcn.0041b440
mov eax, edi
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.00409d93
add esp, 0x2a8
ret 0x20