Function at 0x4192b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c2f06
mov eax, dword fs:[0]
push eax
sub esp, 0x3e8
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x30]
call fcn.004053e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00405490
push eax
call fcn.005a74ae
add esp, 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x419342
mov dword [ebp - 0x398], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00405410
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405410
mov eax, dword [ebp - 0x398]
jmp 0x41970e
lea ecx, [ebp - 0x30]
call fcn.00405490
mov dword [ebp - 0x2ac], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2ac]
movzx eax, word [edx + ecx*2 - 2]
cmp eax, 0x5c
je 0x4193b1
push str._flags_
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x3b4]
push edx
call fcn.0040b210
add esp, 0xc
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3e8]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00405440
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3b4]
call fcn.00405410
jmp 0x4193fd
push str.flags_
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x3d0]
push eax
call fcn.0040b210
add esp, 0xc
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f0], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x3f0]
push edx
lea ecx, [ebp - 0x30]
call fcn.00405440
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3d0]
call fcn.00405410
push 0x6ecf50
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 4
lea edx, [ebp - 0x28c]
push edx
lea ecx, [ebp - 0x2a8]
call fcn.00405490
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 1
cmp dword [ebp - 0x14], 0xffffffff
je 0x4196d4
cmp dword [ebp - 0x38], 1
jne 0x4196d4
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.004053a0
mov byte [ebp - 4], 5
mov ecx, dword [0x720570]
push ecx
push 0x6ecf5c
lea ecx, [ebp - 0x2ec]
call fcn.00419a70
mov dword [ebp - 0x30c], eax
push 0x6ecf60
lea ecx, [ebp - 0x2c8]
call fcn.004053a0
mov byte [ebp - 4], 6
cmp dword [ebp - 0x30c], 0xffffffff
jne 0x4194dc
lea edx, [ebp - 0x28c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.00405410
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2ec]
call fcn.00405410
jmp 0x41943c
lea ecx, [ebp - 0x2ec]
call fcn.00405490
mov dword [ebp - 0x314], eax
mov ecx, dword [ebp - 0x30c]
mov edx, dword [ebp - 0x314]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x310], eax
push str..png
mov ecx, dword [ebp - 0x310]
push ecx
call fcn.005a741b
add esp, 8
test eax, eax
je 0x419556
lea edx, [ebp - 0x28c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.00405410
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2ec]
call fcn.00405410
jmp 0x41943c
mov ecx, dword [ebp - 0x314]
push ecx
push 0x40
lea edx, [ebp - 0x394]
push edx
call fcn.00419a20
xor eax, eax
mov ecx, dword [ebp - 0x30c]
mov word [ebp + ecx*2 - 0x394], ax
lea edx, [ebp - 0x394]
push edx
call fcn.005a74ae
add esp, 4
cmp eax, 2
je 0x4195c6
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.00405410
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2ec]
call fcn.00405410
jmp 0x41943c
lea edx, [ebp - 0x394]
push edx
lea ecx, [ebp - 0x2c8]
call fcn.00405460
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x308]
push edx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 7
push 0x10
call fcn.005a7c1e
add esp, 4
mov dword [ebp - 0x3d8], eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x3d8], 0
je 0x419626
mov ecx, dword [ebp - 0x3d8]
call fcn.004f49c0
mov dword [ebp - 0x3f4], eax
jmp 0x419630
mov dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp - 0x2d0], ecx
push 0
lea ecx, [ebp - 0x308]
call fcn.00405490
push eax
mov ecx, dword [ebp - 0x2d0]
call fcn.004f4b60
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
je 0x41968e
lea edx, [ebp - 0x2c8]
push edx
mov ecx, dword [ebp - 0x3e0]
call fcn.00419ad0
mov ecx, dword [ebp - 0x2d0]
mov dword [eax], ecx
lea edx, [ebp - 0x28c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x308]
call fcn.00405410
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.00405410
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2ec]
call fcn.00405410
jmp 0x41943c
mov dword [ebp - 0x3dc], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a8]
call fcn.00405410
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00405410
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405410
mov eax, dword [ebp - 0x3dc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret 0x1c