Function at 0x413e00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50a29b
mov eax, dword fs:[0]
push eax
sub esp, 0x610
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push esi
push edi
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x620]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
je 0x414127
cmp dword [eax + 8], ebx
je 0x414127
mov byte [esp + 0x20], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x628], ebx
mov edi, dword [eax + 8]
mov edx, dword [edi + 0x10]
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x20], edx
cmp ecx, 0xf
je 0x4140a2
cmp ecx, 0x16
jne 0x41411a
lea eax, [esp + 0x3c]
push eax
call fcn.004765b0
add edi, 0x38
push edi
lea ecx, [esp + 0x60]
call fcn.00438c10
push 0x51ba8c
push 0x5192f4
lea edx, [esp + 0x64]
call fcn.004392f0
add esp, 8
lea eax, [esp + 0x68]
cmp byte [esp + 0x178], bl
jne 0x413ec9
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x2ac]
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x414080
xor eax, eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov word [esp + 0x32], ax
lea eax, [esp + 0x24]
xor edx, edx
push eax
mov word [esp + 0x28], dx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x14]
push 1
push ebx
push ebx
push eax
call fcn.004d0d70
mov ecx, dword [esp + 0x10]
mov esi, edx
mov edi, eax
xor edx, edx
add edi, ecx
mov dword [esp + 0x34], edi
adc esi, edx
jmp 0x413f52
xor ebx, ebx
cmp dword [esp + 0x2ac], 0x10
je 0x414065
lea eax, [esp + 0x2d8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x413f70
sub eax, edx
sar eax, 1
push 0x2e
lea eax, [esp + eax*2 + 0x2dc]
push eax
lea ecx, [esp + 0x2e0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x414065
push str..png
push eax
call fcn.004c6a30
add esp, 8
test eax, eax
jne 0x414065
mov edx, dword [esp + 0x2bc]
push 1
push ebx
push ebx
push edx
call fcn.004d0d70
mov ecx, dword [esp + 0x2b8]
xor ebx, ebx
add eax, ecx
adc edx, ebx
cmp esi, edx
jb 0x414065
ja 0x413fe5
cmp edi, eax
jbe 0x414065
mov ecx, edi
sub ecx, eax
mov eax, esi
sbb eax, edx
mov dword [esp + 0x58], eax
jne 0x413ffb
cmp ecx, 0x28e44000
jbe 0x414065
lea ecx, [esp + 0x5c]
push ecx
lea edi, [esp + 0x188]
call fcn.00438b90
push 0x51924c
push 0x5192f4
mov edx, edi
call fcn.004392f0
lea edx, [esp + 0x2e0]
push edx
push 0x5192f4
mov edx, edi
call fcn.004392f0
add esp, 0x10
mov eax, edi
call fcn.00439250
mov ebx, eax
lea edi, [esp + 0x4fc]
call fcn.004024b0
call fcn.00401890
mov eax, edi
call fcn.00402520
lea ecx, [esp + 0x184]
call fcn.00438c80
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x2ac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x413f50
lea ecx, [esp + 0x5c]
call fcn.00438c80
lea esi, [esp + 0x3c]
call fcn.00414b90
lea ecx, [esp + 0x1c]
call fcn.00437e60
mov al, 1
jmp 0x414129
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x1c]
call fcn.0041ac00
test al, al
jne 0x4140d6
test dword [esi + 0x20], 0x100000
je 0x41411a
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41411a
mov eax, dword [esi + 0x1c]
push ebx
push ebx
push 0xce2a
push eax
jmp 0x414114
test byte [esi + 0x20], 1
je 0x4140e1
call fcn.00414150
test byte [esi + 0x20], 0x10
je 0x4140ec
call fcn.00414590
test dword [esi + 0x20], 0x100000
je 0x41411a
call fcn.004147d0
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41411a
mov edx, dword [esi + 0x1c]
push ebx
push 1
push 0xce2a
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x1c]
call fcn.00437e60
mov al, 1
jmp 0x414129
xor al, al
mov ecx, dword [esp + 0x620]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.004c60f4
mov esp, ebp
pop ebp
ret