Function at 0x43883d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x270
lea ebp, [esp - 4]
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp + 0x270], eax
push 0x68
mov eax, 0x46e000
call fcn.0045d47b
mov esi, dword [ebp + 0x27c]
mov ecx, dword [ebp + 0x280]
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], ecx
cmp esi, edi
jne 0x4388cb
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x4388a6
test byte [eax + 0x1c], 1
je 0x4388a6
cmp byte [eax + 0x19], 2
jb 0x4388a6
push 0x473228
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x270]
xor ecx, ebp
call fcn.00459871
add ebp, 0x274
leave
ret
call fcn.004367ba
push esi
call fcn.0043640c
pop ecx
test al, al
jne 0x4388e2
push esi
call fcn.004380bf
pop ecx
push edi
or ebx, 0xffffffff
push ebx
push 0x497ce0
lea ecx, [ebp - 0x60]
call fcn.004478d7
mov eax, dword [0x497cbc]
sub eax, dword [0x497cb8]
push 0xc
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], edi
test eax, eax
jbe 0x438951
mov esi, 0x497cac
push dword [ebp - 0x14]
mov ecx, esi
push edi
call fcn.00435f60
mov ecx, eax
call fcn.00409c25
test eax, eax
jne 0x43893b
push edi
mov ecx, esi
call fcn.00435f60
mov ecx, dword [ebp - 0x28]
add eax, 4
push eax
call fcn.00437424
mov eax, dword [0x497cbc]
sub eax, dword [0x497cb8]
push 0xc
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x438911
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
sar ecx, 1
lea ecx, [ebp - 0x60]
je 0x43896d
call fcn.004478fe
mov al, 1
jmp 0x4388a8
mov dword [ebp - 4], ebx
call fcn.004478fe
push 0x497a28
lea ecx, [ebp - 0x1c]
call fcn.004037fc
push 0x47de90
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], 1
call fcn.0042e630
add esp, 0xc
test al, al
jne 0x4389e1
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x4389d1
test byte [eax + 0x1c], 1
je 0x4389d1
cmp byte [eax + 0x19], 2
jb 0x4389d1
push dword [ebp - 0x14]
push 0x473228
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004347c2
add esp, 0x14
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x4388a6
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jne 0x438a20
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x4389d1
test byte [eax + 0x1c], 1
je 0x4389d1
cmp byte [eax + 0x19], 2
jb 0x4389d1
push dword [ebp - 0x14]
push 0x473228
push 0xc
jmp 0x4389c3
test byte [ebp], 0x10
je 0x438d41
cmp word [ebp + 0x2c], 0x2e
jne 0x438a47
cmp word [ebp + 0x2e], 0x2e
je 0x438d41
cmp word [ebp + 0x2e], 0
je 0x438d41
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040533e
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 3
mov byte [ebp - 4], 2
jg 0x438d32
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x18]
call fcn.00414958
test eax, eax
je 0x438d32
lea eax, [ebp - 0x24]
push eax
push 0x480b70
push dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x24], esi
call fcn.0045bcce
add esp, 0xc
cmp eax, 1
jne 0x438d32
push 0x497a28
lea ecx, [ebp - 0x20]
call fcn.004037fc
lea eax, [ebp + 0x2c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.0042e630
add esp, 0xc
test al, al
jne 0x438b17
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x438afc
test byte [eax + 0x1c], 1
je 0x438afc
cmp byte [eax + 0x19], 2
jb 0x438afc
lea ecx, [ebp + 0x2c]
push ecx
push dword [ebp - 0x14]
push 0x473228
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00403134
add esp, 0x18
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x4389d1
lea ecx, [ebp - 0x54]
call fcn.0042a635
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 5
call fcn.00457d6b
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.004376e3
pop ecx
pop ecx
test al, al
je 0x438b76
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x60]
sar eax, 1
cmp esi, eax
jae 0x438b76
push esi
lea ecx, [ebp - 0x6c]
call fcn.0042d288
mov ax, word [eax]
mov ecx, dword [ebp - 0x28]
shl ax, 0xa
or ax, word [ebp - 0x24]
movzx eax, ax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00437424
inc esi
jmp 0x438b41
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.004385c3
pop ecx
pop ecx
test al, al
je 0x438b9a
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00437424
lea ecx, [ebp - 0x6c]
call fcn.00457462
push dword [ebp - 0x6c]
call fcn.0041cd48
pop ecx
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x54]
call fcn.0042a5f3
test al, al
je 0x438d1f
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x438bfd
test byte [eax + 0x1c], 1
je 0x438bfd
cmp byte [eax + 0x19], 2
jb 0x438bfd
lea ecx, [ebp - 0x54]
call fcn.0042a611
push eax
mov eax, dword [0x497644]
push 0x473228
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004347c2
add esp, 0x14
lea ecx, [ebp - 0x54]
call fcn.0042a615
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00403af7
xor bl, bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
jmp 0x4388a8
lea ecx, [ebp - 0x54]
call fcn.0042a615
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00403af7
lea eax, [ebp]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x438a20
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
jmp 0x438c1d