Function at 0x4014a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x27c
mov esi, dword [eax + 0x40]
mov dword [ebp - 0x26c], eax
add eax, 0x40
mov dword [ebp - 0x278], eax
cmp eax, esi
je 0x401676
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [esi + 8]
mov dword [esp + 4], 0x405302
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
je 0x401693
mov eax, dword [ebp - 0x26c]
mov edx, dword [eax + 4]
movzx ecx, word [edx]
test cx, cx
je 0x401710
mov eax, edx
add eax, 2
cmp word [eax], 0
jne 0x401503
sub eax, edx
sar eax, 1
add eax, 1
cmp word [ebx], 0
je 0x40152f
mov edi, ebx
lea esi, [esi]
nop
add edi, 2
cmp word [edi], 0
jne 0x401520
sub edi, ebx
sar edi, 1
add eax, edi
lea eax, [eax + eax + 2]
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x270], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x4016fe
mov edx, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x274]
jmp 0x401563
movzx ecx, word [edx]
add eax, 2
add edx, 2
mov word [eax - 2], cx
test cx, cx
jne 0x401560
mov dword [esp], edi
call dword [sym.imp.shlwapi.dll_PathAddBackslashW]
mov edx, edi
sub esp, 4
cmp word [edi], 0
je 0x401599
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x401590
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4015a0
lea eax, [ebp - 0x268]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov ebx, eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 0xffffffff
je 0x4016fe
lea edi, [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
cmp eax, 0x2e
je 0x401642
cmp eax, 0x2e002e
je 0x401683
test byte [ebp - 0x268], 0x10
jne 0x401642
mov dword [esp], edi
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x401642
mov dword [esp + 4], str..idt
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x401642
mov eax, dword [ebp - 0x26c]
mov ecx, edi
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call fcn.00401350
test eax, eax
je 0x40171a
lea eax, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x4015e0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov esi, dword [esi]
cmp esi, dword [ebp - 0x278]
jne 0x4014d0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [ebp - 0x238], 0
jne 0x4015f6
jmp 0x401642
mov dword [esp], ebx
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x4016bb
mov dword [esp + 4], str..idt
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x4016e3
lea eax, [ebp - 0x268]
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x268]
mov dword [esp + 8], str._.8s.idt
mov dword [esp + 4], 0x104
mov dword [esp], eax
call fcn.00401450
mov eax, dword [ebp - 0x26c]
mov ecx, ebx
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call fcn.00401350
test eax, eax
jne 0x401668
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
jmp 0x401513
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
jmp 0x4016fe