Function at 0x43c280
Capabilities:
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f64b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x517748]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push esi
push edi
mov eax, dword [0x517748]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
lea eax, [esp + 0x8c]
push eax
push str.C:WindowsPrefetch
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x43c2fe
mov edx, str.Failed_to_open_directory.
mov ecx, 0x669378
call fcn.00410f30
push eax
call fcn.004113f0
add esp, 4
mov eax, 1
jmp 0x43c7c5
xorps xmm0, xmm0
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0043d120
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1e0], 0
call fcn.0043c0d0
mov byte [esp + 0x1e0], 1
mov ebx, dword [esp + 0x10]
test byte [esp + 0x8c], 0x10
jne 0x43c4fa
mov eax, dword [esp + 0xa0]
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x5c]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x28], eax
call fcn.0043bd70
mov byte [esp + 0x1e0], 2
lea ecx, [esp + 0x2c]
cmp dword [esp + 0x40], 0x10
lea edx, [esp + 0x5c]
mov edi, dword [esp + 0x3c]
mov esi, edi
cmovae ecx, dword [esp + 0x2c]
cmp dword [esp + 0x70], 0x10
mov ebx, dword [esp + 0x6c]
cmovae edx, dword [esp + 0x5c]
cmp ebx, edi
cmovb esi, ebx
test esi, esi
je 0x43c400
sub esi, 4
jb 0x43c3c1
lea ecx, [ecx]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x43c3c6
add edx, 4
add ecx, 4
sub esi, 4
jae 0x43c3b0
cmp esi, 0xfffffffc
je 0x43c3fa
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x43c3f3
cmp esi, 0xfffffffd
je 0x43c3fa
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x43c3f3
cmp esi, 0xfffffffe
je 0x43c3fa
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x43c3f3
cmp esi, 0xffffffff
je 0x43c3fa
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x43c3fa
sbb eax, eax
or eax, 1
jmp 0x43c3fc
xor eax, eax
test eax, eax
jne 0x43c412
cmp ebx, edi
jae 0x43c409
or eax, 0xffffffff
jmp 0x43c410
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
sete al
test al, al
je 0x43c4db
lea edx, [esp + 0x24]
lea ecx, [esp + 0x74]
call fcn.0043bf40
mov byte [esp + 0x1e0], 3
cmp byte [esp + 0xb8], 0
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jne 0x43c455
xor ecx, ecx
jmp 0x43c469
lea ecx, [esp + 0xb8]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43c460
sub ecx, edx
push ecx
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x4c]
call fcn.00401970
lea eax, [esp + 0x44]
mov byte [esp + 0x1e0], 4
push eax
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x24]
call fcn.0043cbb0
mov ecx, eax
call fcn.0040b020
cmp dword [esp + 0x58], 0x10
jb 0x43c4b0
push dword [esp + 0x44]
call fcn.00440f10
add esp, 4
cmp dword [esp + 0x88], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x43c4db
push dword [esp + 0x74]
call fcn.00440f10
add esp, 4
mov byte [esp + 0x1e0], 1
cmp dword [esp + 0x70], 0x10
jb 0x43c4f6
push dword [esp + 0x5c]
call fcn.00440f10
add esp, 4
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x8c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43c340
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x1c]
mov esi, dword [ebx]
cmp esi, ebx
je 0x43c77a
jmp 0x43c530
mov ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
sub ecx, dword [esi + 0x28]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 3
jb 0x43c72f
mov edi, dword [esi + 0x28]
cmp edi, dword [esi + 0x2c]
je 0x43c72b
lea esp, [esp]
push 3
push ecx
push 0x5074a4
mov ecx, edi
call fcn.0040cbd0
cmp eax, 0xffffffff
jne 0x43c595
push 4
push ecx
push str.WMIC
mov ecx, edi
call fcn.0040cbd0
cmp eax, 0xffffffff
jne 0x43c595
add edi, 0x18
cmp edi, dword [esi + 0x2c]
jne 0x43c560
jmp 0x43c72b
mov edx, str.Files_created_at
mov ecx, 0x6692d0
call fcn.00410f30
lea edx, [esi + 0x10]
mov ecx, eax
call fcn.004114a0
mov edx, 0x5074a0
mov ecx, eax
call fcn.00410f30
mov edi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
call fcn.00402730
push eax
mov byte [esp + 0x1e4], 5
call fcn.00410d80
mov byte [esp + 0x1e4], 1
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x43c603
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x43c603
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
push 0xa
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
movzx eax, al
mov ecx, edi
push eax
call fcn.00411ad0
mov ecx, edi
call fcn.0040ece0
mov edi, dword [esi + 0x28]
cmp edi, dword [esi + 0x2c]
je 0x43c6bc
mov edi, edi
mov edx, 0x5074f8
mov ecx, 0x6692d0
call fcn.00410f30
mov edx, edi
mov ecx, eax
call fcn.004114a0
mov ebx, eax
lea eax, [esp + 0x18]
push eax
mov ecx, dword [ebx]
mov ecx, dword [ecx + 4]
add ecx, ebx
call fcn.00402730
push eax
mov byte [esp + 0x1e4], 6
call fcn.00410d80
mov byte [esp + 0x1e4], 1
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x43c691
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x43c691
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
push 0xa
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
movzx eax, al
mov ecx, ebx
push eax
call fcn.00411ad0
mov ecx, ebx
call fcn.0040ece0
add edi, 0x18
cmp edi, dword [esi + 0x2c]
jne 0x43c630
mov eax, dword [0x6692d0]
mov ecx, dword [eax + 4]
lea eax, [esp + 0x24]
add ecx, 0x6692d0
push eax
call fcn.00402730
push eax
mov byte [esp + 0x1e4], 7
call fcn.00410d80
mov byte [esp + 0x1e4], 1
add esp, 4
mov ecx, dword [esp + 0x24]
mov edi, eax
test ecx, ecx
je 0x43c708
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x43c708
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [edi]
mov ecx, edi
push 0xa
mov eax, dword [eax + 0x20]
call eax
movzx eax, al
mov ecx, 0x6692d0
push eax
call fcn.00411ad0
mov ecx, 0x6692d0
call fcn.0040ece0
mov ebx, dword [esp + 0x1c]
cmp byte [esi + 0xd], 0
jne 0x43c772
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x43c754
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x43c772
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x43c748
jmp 0x43c772
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x43c770
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x43c770
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x43c760
mov esi, eax
cmp esi, ebx
jne 0x43c530
cmp dword [esp + 0x40], 0x10
jb 0x43c791
push dword [esp + 0x2c]
call fcn.00440f10
mov ebx, dword [esp + 0x20]
add esp, 4
push ebx
mov dword [esp + 0x44], 0xf
lea eax, [esp + 0x28]
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 0
push dword [ebx]
push eax
call fcn.0043cca0
push dword [esp + 0x1c]
call fcn.00440f10
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.004c0564
mov esp, ebp
pop ebp
ret