Function at 0x43b450
Capabilities:
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x527957
mov eax, dword fs:[0]
push eax
sub esp, 0x620
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x630]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, ebx
mov dword [esp + 0x10], ebx
call fcn.0043b300
mov eax, dword [ebx + 4]
xor edi, edi
cmp eax, edi
je 0x43b4be
mov edx, dword [ebx + 0x24]
cmp eax, edx
je 0x43b4be
lea ecx, [ecx]
mov ecx, dword [eax + 0x12c]
cmp ecx, edx
je 0x43b4c0
mov eax, ecx
jmp 0x43b4b0
xor eax, eax
mov esi, eax
cmp eax, edi
je 0x43b4e9
mov ecx, dword [esi + 0x124]
cmp ecx, edi
je 0x43b4d8
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea eax, [ebx + 4]
push eax
mov edx, esi
call fcn.0043a7d0
mov esi, eax
cmp esi, edi
jne 0x43b4c6
mov eax, dword [ebx + 4]
add ebx, 4
cmp eax, dword [ebx + 0x20]
je 0x43b4fc
push eax
mov ecx, ebx
call fcn.0043aec0
mov eax, dword [ebx + 0xc]
mov dword [ebx + 4], edi
cmp eax, edi
je 0x43b517
mov esi, dword [eax]
push eax
mov eax, dword [ebx + 0x1c]
call eax
add esp, 4
mov eax, esi
cmp esi, edi
jne 0x43b506
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0x20]
add eax, 0x30
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], edi
mov dword [ebx], ecx
cmp word [eax], di
je 0x43b90e
push eax
lea ecx, [esp + 0x2b0]
call fcn.00411610
push 0x564b78
push 0x55d15c
lea edx, [esp + 0x2b4]
mov dword [esp + 0x640], edi
call fcn.00411e80
push 0x24c
lea edx, [esp + 0x3e4]
push edi
push edx
mov dword [esp + 0x3e8], edi
call fcn.004ff6c0
add esp, 0x14
cmp byte [esp + 0x3c8], 0
lea eax, [esp + 0x2b8]
jne 0x43b591
mov eax, dword [esp + 0x2b4]
lea ecx, [esp + 0x3d4]
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x43b7f5
mov ecx, 0x559500
lea eax, [esp + 0x400]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43b5e6
cmp dx, di
je 0x43b5e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43b5e6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x43b5c0
xor eax, eax
jmp 0x43b5eb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x43b7d3
mov ecx, 0x55db1c
lea eax, [esp + 0x400]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43b626
cmp dx, di
je 0x43b622
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43b626
add eax, 4
add ecx, 4
cmp dx, di
jne 0x43b600
xor eax, eax
jmp 0x43b62b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x43b7d3
test byte [esp + 0x3d4], 0x10
je 0x43b7d3
lea eax, [esp + 0x400]
lea edx, [eax + 2]
jmp 0x43b650
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43b650
push 0xc
sub eax, edx
push str._RECYCLE.BIN
sar eax, 1
push eax
lea edx, [esp + 0x40c]
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x43b7d3
lea ecx, [esp + 0x184]
call fcn.004114e0
mov eax, dword [esp + 0x10]
add eax, 0x30
lea edx, [esp + 0x184]
mov byte [esp + 0x638], 1
call fcn.00411710
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0x78]
call fcn.0040e250
cmp byte [esp + 0x17c], 0
lea eax, [esp + 0x6c]
jne 0x43b6d4
mov eax, dword [esp + 0x68]
cmp word [eax + 4], 0x2e
jne 0x43b6ee
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x188]
call fcn.0040f590
jmp 0x43b6ff
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x188]
call fcn.0040e8e0
cmp byte [esp + 0x17c], 0
mov ebx, vtable.t_str.0
mov dword [esp + 0x60], ebx
jne 0x43b727
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x6c]
cmp eax, ecx
je 0x43b727
push eax
call fcn.004faac5
add esp, 4
push 0x65c4
mov byte [esp + 0x63c], 2
call fcn.004faf1d
add esp, 4
cmp eax, edi
je 0x43b767
cmp byte [esp + 0x2a0], 0
lea ecx, [esp + 0x190]
jne 0x43b758
mov ecx, dword [esp + 0x18c]
add ecx, 4
push ecx
mov esi, eax
call fcn.004404e0
mov esi, eax
jmp 0x43b769
xor esi, esi
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
mov ecx, esi
call eax
test al, al
je 0x43b79d
call fcn.00402030
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov edx, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x14]
push 1
push eax
push esi
call edx
jmp 0x43b7a7
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [esp + 0x2a0], 0
mov dword [esp + 0x184], ebx
jne 0x43b7d3
mov eax, dword [esp + 0x18c]
lea ecx, [esp + 0x190]
cmp eax, ecx
je 0x43b7d3
push eax
call fcn.004faac5
add esp, 4
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x3d4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43b5b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x30], fcn.004faba2
mov dword [esp + 0x34], fcn.004fac96
mov dword [esp + 0x38], fcn.004faac5
mov eax, dword [esp + 0x10]
add eax, 4
mov bl, 3
push eax
lea edi, [esp + 0x1c]
mov byte [esp + 0x63c], bl
call fcn.0043fbb0
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov edx, edi
push edx
lea edi, [esi + 4]
push edi
call eax
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0xa
mov dword [esp + 0x54], fcn.004faba2
mov dword [esp + 0x58], fcn.004fac96
mov dword [esp + 0x5c], fcn.004faac5
lea ecx, [esp + 0x3c]
push ecx
mov ecx, edi
mov byte [esp + 0x63c], 4
call fcn.0043fab0
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0x3c]
push eax
push edi
call edx
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push edi
call edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x638], bl
call fcn.0043a3a0
lea ecx, [esp + 0x18]
mov byte [esp + 0x638], 0
call fcn.00432370
cmp byte [esp + 0x3c8], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x43b90e
mov eax, dword [esp + 0x2b4]
lea ecx, [esp + 0x2b8]
cmp eax, ecx
je 0x43b90e
push eax
call fcn.004faac5
add esp, 4
mov ecx, dword [esp + 0x630]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x618]
xor ecx, esp
call fcn.004fa259
mov esp, ebp
pop ebp
ret 4