Function at 0x4097b9
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
push ebx
push esi
push edi
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x594]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.004189f0
mov edi, dword [ebp + 8]
push 0x42ba70
push edi
call fcn.00419ff8
add esp, 0x14
cmp dword [ebp + 0x10], ebx
je 0x409818
push edi
mov esi, 0x200
push dword [ebp + 0x10]
lea eax, [ebp - 0x248]
push 0x42cca8
push esi
push eax
call fcn.00418916
add esp, 0x14
jmp 0x409915
cmp dword [ebp + 0x14], ebx
push edi
je 0x4098fb
call fcn.00418970
mov byte [eax + edi - 1], bl
push edi
mov esi, 0x200
push 0x42cc68
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0x14
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
push edi
push 0x42cc3c
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
push edi
call fcn.00418970
push 0x3c
push 0x96
mov byte [eax + edi], 0x2a
push 0xe6
push 0x42cba0
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0x1c
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
push 0x42cb74
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0xc
jmp 0x409915
mov esi, 0x200
push 0x42cb60
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
cmp dword [ebp + 0x14], ebx
je 0x4099ad
push dword [ebp + 0x14]
call fcn.00418970
cmp eax, 2
pop ecx
jbe 0x4099ad
push dword [ebp + 0x14]
call fcn.00418970
sub eax, 3
pop ecx
je 0x409961
mov ecx, dword [ebp + 0x14]
cmp byte [eax + ecx], 0x2f
je 0x409961
dec eax
jne 0x409955
inc eax
push eax
lea eax, [ebp - 0x594]
push dword [ebp + 0x14]
push eax
call fcn.00419e20
lea eax, [ebp - 0x594]
push eax
push 0x42cb0c
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0x1c
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
lea eax, [ebp - 0x388]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x388]
mov dword [ebp + 8], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x409d9e
mov edi, 0x1ff
cmp dword [ebp - 0x388], ebx
je 0x409d86
lea eax, [ebp - 0x35c]
push 0x42cb08
push eax
call fcn.00419c00
pop ecx
test eax, eax
pop ecx
je 0x409d86
lea eax, [ebp - 0x35c]
push 0x429e28
push eax
call fcn.00419c00
pop ecx
test eax, eax
pop ecx
je 0x409d86
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [ebp - 0x10]
mov ecx, 0x42cb04
cmp ax, 0xc
ja 0x409a4e
mov ecx, 0x42cb00
cmp ax, 0xc
movzx eax, ax
jbe 0x409a5a
sub eax, 0xc
push ecx
movzx ecx, word [ebp - 0xe]
push ecx
push eax
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x16]
push eax
lea eax, [ebp - 0x48]
push 0x42cae0
push eax
call fcn.00418f47
add esp, 0x20
test byte [ebp - 0x388], 0x10
je 0x409c07
inc dword [ebp - 8]
cmp dword [ebp + 0x10], ebx
je 0x409adb
lea eax, [ebp - 0x35c]
push eax
push 0x42cad8
lea eax, [ebp - 0x490]
push 0x106
push eax
call fcn.00418916
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 0x10]
push 0x42cabc
push esi
push eax
call fcn.00418916
add esp, 0x28
jmp 0x409d57
cmp dword [ebp + 0x14], ebx
je 0x409bc5
push 0xe6
push 0x42ca9c
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00418916
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 0x14]
push 0x42ca94
push edi
push eax
call fcn.00418916
add esp, 0x14
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
lea eax, [ebp - 0x35c]
push eax
call fcn.00418970
cmp eax, 0x1e
pop ecx
lea eax, [ebp - 0x35c]
push eax
jbe 0x409b7b
push 0x42ca74
jmp 0x409b80
push 0x42ca5c
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00418916
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
lea eax, [ebp - 0x48]
push 0x3c
push eax
push 0x96
push 0x42c9f4
push edi
jmp 0x409d48
lea eax, [ebp - 0x35c]
push eax
push 0x42cad8
lea eax, [ebp - 0x490]
push 0x106
push eax
call fcn.00418916
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x490]
push eax
push 0x42c9e4
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00418916
add esp, 0x24
jmp 0x409d57
inc dword [ebp - 4]
cmp dword [ebp + 0x10], ebx
je 0x409c31
push ebx
push dword [ebp - 0x368]
call fcn.004077b2
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x35c]
push eax
push dword [ebp + 0x10]
push 0x42c9bc
jmp 0x409bf2
cmp dword [ebp + 0x14], ebx
je 0x409d31
push 0xe6
push 0x42ca9c
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00418916
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 0x14]
push 0x42bc80
push edi
push eax
call fcn.00418916
add esp, 0x14
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
lea eax, [ebp - 0x35c]
push eax
call fcn.00418970
cmp eax, 0x1f
pop ecx
lea eax, [ebp - 0x35c]
push eax
jbe 0x409cd1
push 0x42c99c
jmp 0x409cd6
push 0x42c984
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00418916
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
mov eax, dword [ebp - 0x368]
shr eax, 0xa
push eax
lea eax, [ebp - 0x48]
push 0x3c
push eax
push 0x96
push 0x42c91c
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00418916
add esp, 0x1c
jmp 0x409d57
push dword [ebp - 0x368]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x35c]
push eax
push 0x42c900
push esi
lea eax, [ebp - 0x248]
push eax
call fcn.00418916
add esp, 0x18
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
cmp dword [ebp + 0x10], ebx
je 0x409d86
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x388]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4099d9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x10], ebx
je 0x409de1
mov eax, dword [ebp - 8]
cdq
push edx
push eax
call fcn.004077b2
pop ecx
pop ecx
push eax
mov eax, dword [ebp - 4]
cdq
push edx
push eax
call fcn.004077b2
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 0x10]
push 0x42c8d0
push eax
call fcn.00418f47
add esp, 0x14
jmp 0x409e15
cmp dword [ebp + 0x14], ebx
je 0x409dfb
lea eax, [ebp - 0x248]
push 0x42c888
push eax
call fcn.00418f47
pop ecx
pop ecx
jmp 0x409e15
push dword [ebp - 8]
lea eax, [ebp - 0x248]
push dword [ebp - 4]
push 0x42c860
push eax
call fcn.00418f47
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00418970
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [fcn.00442298]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret