Function at 0x41bd50
Capabilities:
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4573cd
mov eax, dword fs:[0]
push eax
sub esp, 0x1e8
mov eax, dword [0x470be4]
xor eax, esp
mov dword [esp + 0x1e4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x470be4]
xor eax, esp
push eax
lea eax, [esp + 0x1fc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x210]
mov esi, dword [esp + 0x20c]
mov edi, dword [esp + 0x214]
xor ebx, ebx
mov dword [esp + 0x24], eax
mov eax, esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], edi
mov byte [esp + 0x17], bl
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x41bdc7
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x6c]
call fcn.00401e20
mov eax, dword [esp + 0x78]
lea esi, [eax - 1]
cmp eax, esi
mov dword [esp + 0x204], ebx
ja 0x41bdf4
call fcn.00452451
cmp dword [esp + 0x7c], 0x10
mov eax, dword [esp + 0x68]
jae 0x41be03
lea eax, [esp + 0x68]
mov al, byte [eax + esi]
cmp al, 0x2f
je 0x41be1e
cmp al, 0x5c
je 0x41be1e
push 1
push 0x45dde4
lea ecx, [esp + 0x6c]
call fcn.00401d30
cmp edi, ebx
je 0x41bf96
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x41bf96
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
je 0x41bf96
mov ecx, edi
xor ebp, ebp
call fcn.00401330
test eax, eax
jbe 0x41bf96
mov byte [esp + 0x1c], 0x5c
mov edx, dword [esp + 0x78]
push 1
add edx, 0xfffffffe
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x70]
call fcn.00401650
mov edi, eax
cmp edi, 0xffffffff
je 0x41bf82
mov ecx, dword [esp + 0x18]
push ebp
call fcn.00402ec0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00401b50
mov eax, dword [esp + 0x40]
lea esi, [eax - 1]
cmp eax, esi
mov byte [esp + 0x204], 1
ja 0x41bec7
call fcn.00452451
cmp dword [esp + 0x44], 0x10
mov eax, dword [esp + 0x30]
jae 0x41bed6
lea eax, [esp + 0x30]
mov al, byte [eax + esi]
cmp al, 0x2f
je 0x41bef1
cmp al, 0x5c
je 0x41bef1
push 1
push 0x45dde4
lea ecx, [esp + 0x34]
call fcn.00401d30
mov ecx, dword [esp + 0x78]
sub ecx, edi
add ecx, 1
push ecx
add edi, 1
push edi
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x70]
call fcn.00402130
mov eax, dword [esp + 0x30]
mov esi, 0x10
cmp dword [esp + 0x44], esi
mov byte [esp + 0x204], 2
jae 0x41bf28
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x5c]
push ecx
push eax
push edx
push ebx
lea ecx, [esp + 0x58]
call fcn.004085a0
test eax, eax
je 0x41c2c4
cmp dword [esp + 0x60], esi
jb 0x41bf58
mov eax, dword [esp + 0x4c]
push eax
call fcn.0041c4ad
add esp, 4
cmp dword [esp + 0x44], esi
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov byte [esp + 0x204], bl
jb 0x41bf82
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041c4ad
add esp, 4
mov ecx, dword [esp + 0x18]
add ebp, 1
call fcn.00401330
cmp ebp, eax
jb 0x41be65
push 1
push 0x45e0fc
lea ecx, [esp + 0x6c]
call fcn.00401d30
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0xa8]
mov dword [esp + 0xc0], 0xf
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
call fcn.00401b50
cmp dword [esp + 0xb4], 0x10
mov eax, dword [esp + 0xa0]
mov byte [esp + 0x204], 3
jae 0x41bff3
lea eax, [esp + 0xa0]
lea ecx, [esp + 0xb8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x41c3e8
nop
test byte [esp + 0xb8], 0x10
je 0x41c3cb
mov edi, 0x45dfdc
lea esi, [esp + 0xe4]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x41c3cb
mov edi, 0x45dfd8
lea esi, [esp + 0xe4]
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41c3cb
mov esi, dword [esp + 0x28]
mov eax, esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x41c070
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.00401e20
mov eax, dword [esp + 0x40]
lea esi, [eax - 1]
cmp eax, esi
mov byte [esp + 0x204], 4
ja 0x41c09e
call fcn.00452451
mov eax, dword [esp + 0x30]
mov edi, 0x10
cmp dword [esp + 0x44], edi
jae 0x41c0b1
lea eax, [esp + 0x30]
mov al, byte [eax + esi]
cmp al, 0x2f
je 0x41c0cc
cmp al, 0x5c
je 0x41c0cc
push 1
push 0x45dde4
lea ecx, [esp + 0x34]
call fcn.00401d30
lea eax, [esp + 0xe4]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x41c0d6
sub eax, edx
push eax
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x34]
call fcn.00401d30
mov eax, dword [esp + 0x40]
lea esi, [eax - 1]
cmp eax, esi
ja 0x41c103
call fcn.00452451
cmp dword [esp + 0x44], edi
mov eax, dword [esp + 0x30]
jae 0x41c111
lea eax, [esp + 0x30]
mov al, byte [eax + esi]
cmp al, 0x2f
je 0x41c12c
cmp al, 0x5c
je 0x41c12c
push 1
push 0x45dde4
lea ecx, [esp + 0x34]
call fcn.00401d30
cmp dword [esp + 0x18], ebx
je 0x41c376
mov ecx, dword [esp + 0x18]
call fcn.00401360
test al, al
jne 0x41c376
mov ecx, dword [esp + 0x18]
xor ebp, ebp
call fcn.00401330
test eax, eax
jbe 0x41c2aa
lea ebx, [ebx]
mov edx, dword [esp + 0x40]
push 1
add edx, 0xffffffff
push edx
push 0x45dde4
lea ecx, [esp + 0x70]
call fcn.00401650
mov edi, eax
cmp edi, 0xffffffff
je 0x41c296
mov ecx, dword [esp + 0x18]
push ebp
call fcn.00402ec0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.00401b50
mov eax, dword [esp + 0x5c]
lea esi, [eax - 1]
cmp eax, esi
mov byte [esp + 0x204], 5
ja 0x41c1c2
call fcn.00452451
cmp dword [esp + 0x60], 0x10
mov eax, dword [esp + 0x4c]
jae 0x41c1d1
lea eax, [esp + 0x4c]
mov al, byte [eax + esi]
cmp al, 0x2f
je 0x41c1ec
cmp al, 0x5c
je 0x41c1ec
push 1
push 0x45dde4
lea ecx, [esp + 0x50]
call fcn.00401d30
mov eax, dword [esp + 0x40]
sub eax, edi
add eax, 1
push eax
add edi, 1
push edi
lea ecx, [esp + 0x88]
push ecx
lea ecx, [esp + 0x38]
call fcn.00402130
mov eax, dword [esp + 0x4c]
mov esi, 0x10
cmp dword [esp + 0x60], esi
mov byte [esp + 0x204], 6
jae 0x41c226
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x5c]
push edx
push eax
mov eax, dword [esp + 0x9c]
push eax
push ebx
lea ecx, [esp + 0x90]
call fcn.004085a0
test eax, eax
je 0x41c31b
cmp dword [esp + 0x98], esi
jb 0x41c262
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0041c4ad
add esp, 4
cmp dword [esp + 0x60], esi
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
mov byte [esp + 0x204], 4
jb 0x41c296
mov edx, dword [esp + 0x4c]
push edx
call fcn.0041c4ad
add esp, 4
mov ecx, dword [esp + 0x18]
add ebp, 1
call fcn.00401330
cmp ebp, eax
jb 0x41c160
cmp byte [esp + 0x17], bl
je 0x41c376
cmp byte [esp + 0x17], bl
sete dl
mov byte [esp + 0x17], dl
jmp 0x41c3af
cmp dword [esp + 0x60], esi
jb 0x41c2d7
mov edx, dword [esp + 0x4c]
push edx
call fcn.0041c4ad
add esp, 4
cmp dword [esp + 0x44], esi
mov edi, 0xf
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x41c2fb
mov eax, dword [esp + 0x30]
push eax
call fcn.0041c4ad
add esp, 4
cmp dword [esp + 0x7c], esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x41c443
mov ecx, dword [esp + 0x68]
push ecx
jmp 0x41c43b
cmp dword [esp + 0x98], esi
mov byte [esp + 0x17], 1
jb 0x41c339
mov eax, dword [esp + 0x84]
push eax
call fcn.0041c4ad
add esp, 4
cmp dword [esp + 0x60], esi
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
jb 0x41c2b4
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0041c4ad
add esp, 4
cmp byte [esp + 0x17], bl
sete dl
mov byte [esp + 0x17], dl
jmp 0x41c3af
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00403e10
cmp byte [esp + 0x218], bl
je 0x41c3af
cmp dword [esp + 0x44], 0x10
mov eax, dword [esp + 0x30]
jae 0x41c39e
lea eax, [esp + 0x30]
mov edx, dword [esp + 0x18]
push 1
push edx
push esi
push eax
call fcn.0041bd50
add esp, 0x10
cmp dword [esp + 0x44], 0x10
mov byte [esp + 0x204], 3
jb 0x41c3cb
mov eax, dword [esp + 0x30]
push eax
call fcn.0041c4ad
add esp, 4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xb8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41c010
jmp 0x41c3ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x10
cmp dword [esp + 0xb4], esi
jb 0x41c417
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.0041c4ad
add esp, 4
cmp dword [esp + 0x7c], esi
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x41c443
mov edx, dword [esp + 0x68]
push edx
call fcn.0041c4ad
add esp, 4
mov ecx, dword [esp + 0x1fc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1e4]
xor ecx, esp
call fcn.00438282
add esp, 0x1f4
ret