Function at 0x442dc0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x260], ebx
mov edi, dword [ebx + 0xf4]
mov esi, edi
mov dword [ebp - 0x264], edi
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x442df0
push 0x250
lea eax, [ebp - 0x258]
sub esi, ecx
push 0
push eax
call fcn.00689b00
add esp, 0xc
sar esi, 1
jne 0x442e23
mov dword [ebp - 0x25c], 0x76e930
jmp 0x442e46
movzx eax, word [edi + esi*2 - 2]
cmp eax, 0x2f
je 0x442e3c
mov dword [ebp - 0x25c], 0x76e940
cmp eax, 0x5c
jne 0x442e46
mov dword [ebp - 0x25c], 0x76e938
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x442e73
mov dword [ebx + 0x48], 0xfffff02c
mov dword [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret
lea eax, [esi*2 + 8]
push eax
call fcn.006a66fd
mov edi, eax
add esp, 4
test edi, edi
jne 0x442eab
mov dword [ebx + 0x48], 0xfffff027
mov dword [ebx + 0xf0], 0xe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x264]
lea eax, [esi + 3]
push dword [ebp - 0x25c]
push eax
push edi
call fcn.00438790
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
push edi
mov dword [ebp - 0x26c], esi
call fcn.006a389b
add esp, 4
cmp esi, 0xffffffff
jne 0x442f0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [ebx + 0xf0], eax
call fcn.0044c110
mov dword [ebx + 0x48], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret
xor ebx, ebx
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x264], ecx
cmp word [ebp - 0x22c], 0x2e
jne 0x442f4e
mov eax, dword [ebp - 0x22a]
test ax, ax
je 0x443036
cmp ax, 0x2e
jne 0x442f4e
cmp word [ebp - 0x228], 0
je 0x443036
cmp edi, ecx
jl 0x442f7a
add ecx, 0x20
mov dword [ebp - 0x264], ecx
lea eax, [ecx*4]
push eax
push ebx
call fcn.006acd62
add esp, 8
test eax, eax
je 0x443053
mov dword [ebp - 0x25c], eax
lea esi, [ebp - 0x22c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x442f83
push 0
push 0
push 0
push 0
sub esi, ecx
lea eax, [ebp - 0x22c]
sar esi, 1
push esi
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x4430c8
lea ecx, [eax + 9]
push ecx
call fcn.006a66fd
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x443053
push 0
push 0
push dword [ebp - 0x268]
lea ecx, [ebx + 4]
push ecx
push esi
lea eax, [ebp - 0x22c]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4430bf
mov byte [ebx + eax + 4], 0
mov eax, dword [ebp - 0x258]
test al, 0x10
je 0x443015
mov dword [ebx], 2
jmp 0x443024
and eax, 0x400
or eax, 0x200
shr eax, 9
mov dword [ebx], eax
mov esi, dword [ebp - 0x25c]
mov dword [esi + edi*4], ebx
mov ebx, esi
mov esi, dword [ebp - 0x26c]
inc edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x44306c
mov ecx, dword [ebp - 0x264]
jmp 0x442f21
mov esi, dword [ebp - 0x260]
mov dword [esi + 0x48], 0xfffff027
mov dword [esi + 0xf0], 0xe
jmp 0x4430e4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x260]
test ebx, ebx
je 0x443084
or dword [esi + 0xec], 8
mov dword [esi + 0x108], 0
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], edi
cmp edi, 0xffffffff
jne 0x443109
call fcn.006a3906
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.0044c110
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret
push ebx
call fcn.006a389b
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x260]
mov ecx, eax
mov dword [esi + 0xf0], eax
call fcn.0044c110
mov dword [esi + 0x48], eax
sub edi, 1
mov esi, dword [ebp - 0x25c]
js 0x443100
nop
push dword [esi + edi*4]
call fcn.006a389b
add esp, 4
sub edi, 1
jns 0x4430f0
push esi
call fcn.006a389b
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret