Function at 0x4131a0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x127c
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1274], eax
push ebx
push ebp
push esi
mov esi, ecx
mov edx, 0x4b3f64
push edi
push esi
mov ecx, str.FILE
call fcn.00478640
push eax
push 0x400
push 0x4d5840
call fcn.0040a420
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
cmp dword [0x4e5c1c], 2
jne 0x413226
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call edi
cmp eax, 5
jne 0x413226
push 0x4d5840
push 1
push 0x40b
push dword [0x4e5c10]
call edi
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xa88], ax
lea eax, [esp + 0xa8a]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x280], ax
push 0x7fe
push eax
lea eax, [esp + 0x28a]
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0x14], 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
inc eax
mov dword [esp + 0x20], 1
push 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0x1312d00
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x1312d00
push 8
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4135d9
push esi
push ebp
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
xor eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax + eax]
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
lea esi, [eax*2]
add esi, ebp
lea eax, [esp + 0xa80]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push esi
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
inc ecx
add ecx, eax
lea eax, [esp + 0x280]
push 0x4b3508
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x30]
mov esi, 1
push eax
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x413584
test esi, esi
je 0x413580
push 0x4b3510
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x41356a
push 0x4b3514
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x41356a
push 0x4b351c
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x41356a
push str.winsxs
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x41356a
test byte [esp + 0x30], 0x10
je 0x41356a
push str.recycle
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x41356a
push str.wintools
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x41356a
push str.systemindex
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x41356a
push str.prefetch
lea eax, [esp + 0x60]
push eax
call ebx
test eax, eax
jne 0x41356a
lea edx, [esp + 0xa80]
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x413410
sub edx, ecx
lea eax, [esp + 0x5c]
sar edx, 1
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413426
sub eax, esi
sar eax, 1
add eax, 4
add eax, edx
cmp eax, 0x104
jae 0x41356a
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0xa84]
push eax
push 0x4b3544
lea eax, [esp + 0x28c]
push 0x400
push eax
call fcn.0040a420
add esp, 0x14
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [esp + 0x20]
add eax, esi
mov ecx, dword [esp + 0x1c]
lea eax, [eax*2 + 2]
cmp eax, ecx
jb 0x4134b1
add ecx, 0x1312d00
push ecx
push ebp
push 8
push dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
test ebp, ebp
je 0x4135c1
inc dword [esp + 0x18]
lea eax, [esp + 0x280]
push eax
lea eax, [esi*2]
add eax, ebp
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
mov edx, 0x4b3f64
add esi, eax
mov ecx, str.FILE
lea eax, [esp + 0x280]
mov dword [esp + 0x20], esi
push eax
call fcn.00478640
push eax
push 0x400
push 0x4d5840
call fcn.0040a420
add esp, 0x10
cmp dword [0x4e5c1c], 2
jne 0x413551
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
cmp eax, 5
jne 0x413551
push 0x4d5840
push 1
push 0x40b
push dword [0x4e5c10]
call esi
cmp dword [0x4cc1cc], 0
je 0x4135de
lea ecx, [esp + 0x280]
call fcn.00413820
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x413351
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x18]
jne 0x4132d0
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, 1
mov ecx, dword [esp + 0x1284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x127c
ret
push 0x10
push str.Error_23
push str.No_free_memory.
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x4135a8
call fcn.004135f0
int3