Function at 0x406a30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xa9c
mov ebp, dword [esp + 0xab0]
mov esi, dword [esp + 0xab4]
movzx eax, byte [ebp + 0x1c]
mov dword [ebp + 0x14], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov eax, dword [ebp]
mov dword [ebp + 0x18], 0
mov dword [ebp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x6c]
cmp eax, 0xffffffff
jne 0x406ab0
jmp 0x406d49
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x406cb0
mov dword [esp + 4], 0x4121da
mov dword [esp], ebx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x406a90
mov dword [esp + 4], 0x4121de
mov dword [esp], ebx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x406a90
mov dword [esp], ebp
call fcn.004032b0
test eax, eax
jg 0x406c70
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x34], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
sub esp, 8
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004033e0
test eax, eax
jg 0x406c70
mov edx, dword [esp + 0x40]
mov eax, edx
shr eax, 1
and eax, 1
and edx, 0x10
je 0x406c30
movzx eax, al
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.004035f0
test eax, eax
jg 0x406c70
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x406bba
mov edi, dword [ebp]
mov ecx, dword [ebp + 0x10]
movzx eax, word [edi]
mov dword [esp + 0x2c], ecx
cmp ecx, eax
jb 0x406d88
mov dword [esp + 0xab0], ebp
mov edx, 1
mov ebp, ecx
jmp 0x406b9e
movzx ecx, word [edi + eax]
add eax, ecx
cmp eax, ebp
ja 0x406ca0
add edx, 1
cmp esi, edx
jae 0x406b90
mov ebp, dword [esp + 0xab0]
cmp eax, dword [esp + 0x2c]
je 0x406bba
test edx, edx
jne 0x406d88
lea esi, [esp + 0x290]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x3e8
mov dword [esp], esi
call sub.msvcrt.dll_swprintf_s
mov dword [esp + 8], 0x3e8
mov dword [esp + 4], esi
mov dword [esp], ebp
call fcn.004036a0
test eax, eax
jle 0x406a90
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
movzx eax, word [ebp + 0xc]
mov dword [esp + 8], 0x4121e4
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x64
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
jmp 0x406c8c
add eax, 2
mov dword [esp], ebp
movzx eax, al
mov dword [esp + 4], eax
call fcn.004035f0
test eax, eax
jg 0x406c70
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
mov dword [esp], ebp
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.004033e0
test eax, eax
jle 0x406b5b
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], str.Err_malloc
mov dword [esp + 4], 0x64
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
or word [0x4184c0], 4
add esp, 0xa9c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0xab0]
jmp 0x406bb2
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
test esi, esi
je 0x406ce9
mov edi, dword [ebp]
mov edx, 1
movzx eax, word [edi]
cmp eax, ebx
jbe 0x406cda
jmp 0x406d24
movzx ecx, word [edi + eax]
add eax, ecx
cmp eax, ebx
ja 0x406ce5
add edx, 1
cmp esi, edx
jae 0x406cd0
cmp eax, ebx
je 0x406ce9
test edx, edx
jne 0x406d24
mov dword [esp + 0x10], ebx
movzx eax, word [ebp + 0xc]
mov dword [esp + 8], str.Ok__bloks___d__len___d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x64
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
or word [0x4184c0], 4
add esp, 0xa9c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.Err__bloks___d
mov dword [esp + 4], 0x64
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
jmp 0x406c8c
xor eax, eax
nop
lea esi, [esi]
cmp word [esi + eax*2], 0
je 0x406d82
add eax, 1
cmp eax, 0x258
jne 0x406d50
mov eax, 0x4ac
mov edx, 0x78
mov word [esi + eax], dx
or word [0x4184c0], 0x18
add esp, 0xa9c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [eax + eax - 2]
jmp 0x406d66
mov dword [esp + 8], str.check
mov dword [esp + 4], 0x64
mov dword [esp], 0x418aa0
call sub.msvcrt.dll_swprintf_s
jmp 0x406c8c