Function at 0x4014d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea edi, [eax + 0x40]
sub esp, 0x27c
mov esi, dword [eax + 0x40]
mov dword [ebp - 0x278], edi
cmp esi, edi
mov dword [ebp - 0x26c], esi
je 0x401678
lea esi, [ebp - 0x268]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x26c]
mov ebx, dword [eax + 8]
mov dword [esp + 4], 0x405302
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
je 0x401718
mov eax, dword [ebp - 0x274]
mov edi, dword [eax + 4]
movzx edx, word [edi]
test dx, dx
je 0x40170e
mov eax, edi
nop
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401540
sub eax, edi
sar eax, 1
add eax, 1
cmp word [ebx], 0
je 0x401707
mov ecx, ebx
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x401560
sub ecx, ebx
sar ecx, 1
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x270], edx
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
mov ecx, eax
je 0x4016fd
mov edx, dword [ebp - 0x270]
jmp 0x401597
movzx edx, word [edi]
add eax, 2
add edi, 2
test dx, dx
mov word [eax - 2], dx
jne 0x401594
mov dword [esp], ecx
mov dword [ebp - 0x270], ecx
call dword [sym.imp.shlwapi.dll_PathAddBackslashW]
mov ecx, dword [ebp - 0x270]
sub esp, 4
cmp word [ecx], 0
mov eax, ecx
je 0x4015e0
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x4015d0
lea esi, [esi]
add ebx, 2
movzx edx, word [ebx - 2]
add eax, 2
test dx, dx
mov word [eax - 2], dx
jne 0x4015e0
mov dword [esp], ecx
mov dword [ebp - 0x270], ecx
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x270]
sub esp, 8
mov ebx, eax
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 0xffffffff
je 0x4016fd
mov eax, dword [ebp - 0x23c]
cmp eax, 0x2e
je 0x40163e
cmp eax, 0x2e002e
je 0x401685
test byte [ebp - 0x268], 0x10
je 0x4016a0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401623
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x26c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x278]
mov dword [ebp - 0x26c], eax
jne 0x401502
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [ebp - 0x238], 0
je 0x40163e
test byte [ebp - 0x268], 0x10
jne 0x40163e
nop
lea esi, [esi]
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x40163e
mov dword [esp + 4], str..idt
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40163e
mov eax, dword [ebp - 0x274]
lea ecx, [ebp - 0x23c]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call sym._import_table.isra.4
test eax, eax
jne 0x40163e
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x40156d
mov eax, 1
jmp 0x401550
mov dword [esp], ebx
call dword [sym.imp.shlwapi.dll_PathFindExtensionW]
sub esp, 4
test eax, eax
je 0x401740
mov dword [esp + 4], str..idt
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x40175e
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._.8s.idt
mov ebx, esi
mov dword [esp + 4], 0x104
mov dword [esp], esi
call sym._swprintf.constprop.12
mov eax, dword [ebp - 0x274]
mov ecx, ebx
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call sym._import_table.isra.4
test eax, eax
jne 0x40165e
jmp 0x4016fd