Function at 0x419355
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2fc
mov eax, 0x444f13
call fcn.0041f670
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
push 0x2bc
push dword [0x45f650]
mov dword [ebp - 0x2d8], ebx
call fcn.00401c41
test eax, eax
je 0x4193dc
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x84]
call fcn.00401ac7
mov edx, str.Dumps_folder_cleanup_started:_max_dumps_count_
call fcn.00401c16
mov edx, ebx
mov ecx, eax
call fcn.00405c89
xor ebx, ebx
mov edx, str.__required_free_space_
push ebx
push 0xc8
mov ecx, eax
call fcn.00401c16
mov ecx, eax
call fcn.00418ef8
pop ecx
pop ecx
mov edx, 0x45652c
mov ecx, eax
call fcn.00401c16
mov ecx, eax
call fcn.00401afb
jmp 0x4193de
xor ebx, ebx
test esi, esi
je 0x41974a
cmp word [esi], bx
je 0x41974a
push esi
lea ecx, [ebp - 0x64]
call fcn.0040739d
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x64]
cmp dword [ebp - 0x50], 8
jb 0x419407
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x54]
push 0x5c
pop edx
cmp word [ecx + eax*2 - 2], dx
je 0x41941d
push edx
lea ecx, [ebp - 0x64]
call fcn.00418484
push edi
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x7c]
call fcn.00413dfb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
mov edx, eax
mov dword [esp], str..dmp
call fcn.00409f18
pop ecx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 3
call fcn.00403b3f
push 0x2bc
push dword [0x45f650]
lea ecx, [ebp - 0x24]
call fcn.00401c41
test eax, eax
je 0x4194ab
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00401ac7
mov edx, str.Search_file_mask:_
call fcn.00401c16
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x4c]
mov esi, eax
jb 0x419489
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x3c]
push ecx
push ecx
mov ecx, esi
call fcn.00415cb8
add esp, 0xc
mov edx, 0x4565a8
mov ecx, esi
call fcn.00401c16
mov ecx, eax
call fcn.00401afb
push ebx
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.004197cd
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
jb 0x4194cb
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x2d4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, 0xffffffff
je 0x41963c
mov ecx, dword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
mov byte [ebp - 0x70], dl
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ebx
mov byte [ebp - 4], 5
test byte [ebp - 0x2d4], 0x51
jne 0x419615
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2d4]
push eax
mov edi, dword [ebx + 4]
push edi
push ebx
call fcn.004198f3
push ecx
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00419804
mov dword [ebx + 4], esi
mov dword [edi], esi
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax + 4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2a8]
push str.__._._i._i._i._i__02d._02d__02d._02d__u.__0_9__d.
push eax
call fcn.0040b22e
add esp, 0x10
cmp eax, 2
je 0x419575
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2a8]
push str.__._._i._i._i._i______02d._02d__02d._02d__u.__0_9__d.
push eax
call fcn.0040b22e
add esp, 0x10
cmp eax, 2
jne 0x419581
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x2c], eax
push 0x2bc
push dword [0x45f650]
lea ecx, [ebp - 0x34]
call fcn.00401c41
test eax, eax
je 0x419612
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00401ac7
push dword [ebp - 0x2b8]
mov edx, str.Previous_dump_file_found:_
push dword [ebp - 0x2b4]
call fcn.00401c16
lea edx, [ebp - 0x2a8]
mov ecx, eax
call fcn.00411971
mov edx, str.__size_:
mov ecx, eax
call fcn.00401c16
mov ecx, eax
call fcn.00418ef8
pop ecx
pop ecx
mov edx, str._bytes__pid:
mov ecx, eax
call fcn.00401c16
mov edx, dword [esi + 0x28]
mov ecx, eax
call fcn.00405c89
mov edx, str.__indexInSequence:
mov ecx, eax
call fcn.00401c16
mov edx, dword [esi + 0x2c]
mov ecx, eax
call fcn.0040b2a6
mov ecx, eax
call fcn.00401afb
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x2d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4194fc
push ebx
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 4
jmp 0x419673
push 0x2bc
push dword [0x45f650]
lea ecx, [ebp - 0x34]
call fcn.00401c41
test eax, eax
je 0x419673
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00401ac7
mov edx, str.No_dump_files_were_found
call fcn.00401c16
mov ecx, eax
call fcn.00401afb
cmp dword [ebp - 0x18], 0
je 0x419698
push dword [ebp - 0x18]
mov al, byte [ebp - 0x14]
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x1c]
push ecx
push eax
lea ecx, [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x20]
push eax
call fcn.00419953
lea eax, [ebp - 0x64]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x2f8], ebx
mov dword [ebp - 0x2f4], ebx
call fcn.00408b25
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2e8], 0xc800000
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e0], eax
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 7
call fcn.00418f20
lea ecx, [ebp - 0x308]
mov bl, al
call fcn.00403b3f
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov edi, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
cmp edi, eax
je 0x41972c
mov esi, dword [edi]
lea ecx, [edi + 0x10]
call fcn.00403b3f
push 0x30
push edi
call fcn.004041a1
mov eax, dword [ebp - 0x1c]
mov edi, esi
pop ecx
pop ecx
cmp esi, eax
jne 0x41970f
push 0x30
push eax
call fcn.004041a1
pop ecx
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.00403b3f
lea ecx, [ebp - 0x64]
call fcn.00403b3f
mov al, bl
jmp 0x419783
push 0x12c
push dword [0x45f650]
lea ecx, [ebp - 0x34]
call fcn.00401c41
test eax, eax
je 0x419781
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00401ac7
mov edx, str.Folder_name_not_specified
call fcn.00401c16
mov ecx, eax
call fcn.00401afb
xor al, al
call fcn.0041f61a
ret