Function at 0x41d110
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x12a0
call fcn.00436370
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x129c], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x40e
lea eax, [esp + 0xe96]
push 0
push eax
mov dword [esp + 0x14], esi
mov word [esp + 0xe9c], 0
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0xa92]
push 0
push ecx
mov word [esp + 0xa98], 0
call fcn.00429d70
push 0x442408
push esi
push 0x441ab4
push 0x410
lea edx, [esp + 0xeb8]
push 0x208
push edx
call fcn.00425032
add esp, 0x30
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xe94]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41d1bd
push eax
jmp 0x41d5f3
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x41d5ee
mov ecx, 0x442410
lea eax, [esp + 0x3c]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d206
test dx, dx
je 0x41d202
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d206
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d1e0
xor eax, eax
jmp 0x41d20b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d5d6
mov ecx, 0x442414
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d246
test dx, dx
je 0x41d242
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d246
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d220
xor eax, eax
jmp 0x41d24b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d5d6
mov ecx, str.QQMusic
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d286
test dx, dx
je 0x41d282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d286
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d260
xor eax, eax
jmp 0x41d28b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d5d6
mov ecx, str.QQPhotoDrawEx
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d2c6
test dx, dx
je 0x41d2c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d2c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d2a0
xor eax, eax
jmp 0x41d2cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d5d6
mov ecx, 0x445324
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d306
test dx, dx
je 0x41d302
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d306
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d2e0
xor eax, eax
jmp 0x41d30b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea eax, [esp + 0x3c]
jne 0x41d370
push eax
push ebx
push 0x441ab4
push 0x410
lea ecx, [esp + 0x270]
push 0x208
push ecx
call fcn.00425032
lea edx, [esp + 0x54]
push edx
push esi
push 0x441ab4
push 0x410
lea eax, [esp + 0x698]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x6a0]
push ecx
lea edx, [esp + 0x294]
push edx
call fcn.0041d110
add esp, 0x38
jmp 0x41d5d6
mov ecx, str.Com.Tencent.QQMusic
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d39b
test dx, dx
je 0x41d397
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d39b
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d375
xor eax, eax
jmp 0x41d3a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea eax, [esp + 0x3c]
jne 0x41d405
push eax
push ebx
push 0x441ab4
push 0x410
lea ecx, [esp + 0x680]
push 0x208
push ecx
call fcn.00425032
lea edx, [esp + 0x54]
push edx
push esi
push 0x441ab4
push 0x410
lea eax, [esp + 0x288]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x290]
push ecx
lea edx, [esp + 0x6a4]
push edx
call fcn.0041d110
add esp, 0x38
jmp 0x41d5d6
mov ecx, str.Com.Tencent.Qzone
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d436
test dx, dx
je 0x41d432
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d436
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d410
xor eax, eax
jmp 0x41d43b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea eax, [esp + 0x3c]
jne 0x41d4a0
push eax
push ebx
push 0x441ab4
push 0x410
lea ecx, [esp + 0x680]
push 0x208
push ecx
call fcn.00425032
lea edx, [esp + 0x54]
push edx
push esi
push 0x441ab4
push 0x410
lea eax, [esp + 0x288]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x290]
push ecx
lea edx, [esp + 0x6a4]
push edx
call fcn.0041d110
add esp, 0x38
jmp 0x41d5d6
mov ecx, str.Plugin
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d4cb
test dx, dx
je 0x41d4c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d4cb
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d4a5
xor eax, eax
jmp 0x41d4d0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea eax, [esp + 0x3c]
push eax
push ebx
push 0x441ab4
push 0x410
push 0x208
jne 0x41d535
lea ecx, [esp + 0x684]
push ecx
call fcn.00425032
lea edx, [esp + 0x54]
push edx
push esi
push 0x441ab4
push 0x410
lea eax, [esp + 0x288]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x290]
push ecx
lea edx, [esp + 0x6a4]
push edx
call fcn.0041d110
add esp, 0x38
jmp 0x41d5d6
lea ecx, [esp + 0xa94]
push ecx
call fcn.00425032
add esp, 0x18
lea edx, [esp + 0xa80]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d5d6
test byte [esp + 0x10], 0x10
je 0x41d60d
lea esi, [esp + 0xa80]
call fcn.0041b9a0
test eax, eax
jne 0x41d5d2
lea eax, [esp + 0x3c]
push eax
push ebx
push 0x441ab4
push 0x410
lea ecx, [esp + 0x680]
push 0x208
push ecx
call fcn.00425032
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x54]
push edx
push eax
push 0x441ab4
push 0x410
lea ecx, [esp + 0x288]
push 0x208
push ecx
call fcn.00425032
lea edx, [esp + 0x290]
push edx
lea eax, [esp + 0x6a4]
push eax
call fcn.0041d110
add esp, 0x38
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41d1d1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x12a4]
pop esi
pop ebx
xor ecx, esp
call fcn.00424e88
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xa80]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41d5d6