Function at 0x401790
Capabilities:
Enumerate files on windows
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x490
movzx ecx, word [edx]
mov dword [ebp - 0x468], eax
mov ebx, dword [eax + 0x14]
test cx, cx
je 0x401a3a
lea edi, [ebp - 0x464]
mov eax, edx
mov dword [ebp - 0x46c], edi
mov edx, edi
lea esi, [esi]
add eax, 2
mov word [edx], cx
add edx, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4017c8
xor eax, eax
mov dword [edx], 0x2a005c
mov word [edx + 4], ax
lea eax, [ebp - 0x25c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x474], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x474]
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x470], eax
je 0x401a2e
lea eax, [ebx + 1]
mov dword [esp + 8], 0x2b0
mov dword [esp + 4], 0
mov dword [ebp - 0x474], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x478], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x47c], eax
call eax
mov dword [ebp - 0x480], eax
sub esp, 0xc
mov ebx, eax
mov dword [eax + 0x2a4], 0
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 0
mov eax, dword [ebp - 0x25c]
lea edi, [ebx + 0x1c]
lea ecx, [ebx + 0x18]
and edi, 0xfffffffc
lea esi, [ebp - 0x25c]
mov dword [ebx + 0x18], eax
sub ecx, edi
mov eax, dword [ebp - 0x10]
sub esi, ecx
add ecx, 0x250
mov dword [ebx + 0x264], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x468]
mov edx, dword [ebp - 0x478]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x2a0], 0
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x474]
mov dword [ebx + 0x29c], 0
mov dword [ebx + 0x14], eax
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebx + eax + 0x44]
mov word [edx + eax + 2], cx
add eax, 2
test cx, cx
jne 0x4018f8
mov eax, dword [ebp - 0x46c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x401983
lea eax, [ebx + 0x268]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetFileInformationByHandle]
sub esp, 8
test eax, eax
je 0x401977
mov dword [ebx + 0x29c], 1
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea eax, [ebp - 0x25c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x470]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x4019f8
mov dword [esp + 8], 0x2b0
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x47c]
call eax
mov dword [eax + 0x2a4], 0
sub esp, 0xc
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 0
mov dword [ebx], eax
mov ebx, eax
jmp 0x401880
mov eax, dword [ebp - 0x470]
mov dword [ebx], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x468]
mov edi, dword [ebp - 0x480]
mov dword [eax + 0x10], 1
mov dword [eax + 4], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x480], 0
jmp 0x401a10
lea eax, [ebp - 0x464]
mov dword [ebp - 0x46c], eax
mov edx, eax
jmp 0x4017d9