Function at 0x402bb0
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
sub esp, 0x370
push ebp
mov ebp, dword [esp + 0x37c]
push esi
push edi
lea eax, [esp + 0x34]
push 0x104
push eax
push ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
mov eax, dword [0x41007c]
test eax, eax
je 0x402c03
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x40efcc
push 0x40f6c0
call fcn.00404854
add esp, 0x14
lea edx, [esp + 0x34]
push 0x2f
push edx
call fcn.00405560
add esp, 8
test eax, eax
je 0x402c29
mov byte [eax], 0x5c
inc eax
push 0x2f
push eax
call fcn.00405520
add esp, 8
test eax, eax
jne 0x402c16
lea eax, [esp + 0x34]
push 0x5c
push eax
call fcn.00405520
add esp, 8
test eax, eax
je 0x402c9d
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x402c9d
mov esi, eax
lea edx, [esp + 0x34]
sub esi, edx
lea eax, [esp + 0x34]
push esi
lea ecx, [esp + 0x27c]
push eax
push ecx
call fcn.00404f90
mov edi, 0x40efc8
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov byte [esp + esi + 0x278], 0
lea edx, [esp + 0x278]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x402ca5
mov byte [esp + 0x278], 0
lea eax, [esp + 0x34]
push 0x3f
push eax
call fcn.00405560
add esp, 8
test eax, eax
jne 0x402d21
lea ecx, [esp + 0x34]
push 0x2a
push ecx
call fcn.00405560
add esp, 8
test eax, eax
jne 0x402d21
lea edi, [esp + 0x34]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004051f4
add esp, 8
test eax, eax
jne 0x402e82
mov ecx, dword [esp + 0x16]
mov edx, dword [esp + 0x388]
mov eax, dword [esp + 0xc]
pop edi
shr ecx, 0xe
and ecx, 1
pop esi
mov dword [edx], ecx
pop ebp
add esp, 0x370
ret
lea eax, [esp + 0x138]
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, dword [esp + 0x380]
cmp eax, 0xffffffff
mov dword [edx], eax
je 0x402e71
mov al, byte [esp + 0x138]
mov dword [esp + 0xc], 1
test al, 0x10
je 0x402e2f
mov edi, dword [esp + 0x388]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [edi], 1
mov esi, 0x40efc4
lea eax, [esp + 0x164]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402da0
test cl, cl
je 0x402d9c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402da0
add eax, 2
add esi, 2
test cl, cl
jne 0x402d7c
xor eax, eax
jmp 0x402da5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402de2
mov esi, 0x40efc0
lea eax, [esp + 0x164]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402dd9
test cl, cl
je 0x402dd5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402dd9
add eax, 2
add esi, 2
test cl, cl
jne 0x402db5
xor eax, eax
jmp 0x402dde
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402e3e
mov ecx, dword [esp + 0x380]
lea eax, [esp + 0x138]
push eax
mov edx, dword [ecx]
push edx
call ebp
test eax, eax
je 0x402e13
mov eax, dword [esp + 0x138]
and eax, 0xff
shr eax, 4
and eax, 1
mov dword [edi], eax
jmp 0x402d70
mov ecx, dword [esp + 0x384]
xor eax, eax
mov byte [ecx], 0
mov dword [edi], 0
pop edi
pop esi
pop ebp
add esp, 0x370
ret
mov edx, dword [esp + 0x388]
mov dword [edx], 0
jmp 0x402e45
mov ebp, dword [esp + 0x384]
lea eax, [esp + 0x164]
lea ecx, [esp + 0x278]
push eax
push ecx
push 0x40efb8
push ebp
call fcn.00404e06
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x370
ret
mov edx, dword [esp + 0x388]
mov byte [ebp], 0
mov dword [edx], 0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x370
ret