Function at 0x4167e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd838
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 4], 0
call fcn.00452534
test al, al
je 0x416840
dec ebx
shl edx, 6
push es
insb byte es:[edi], dx
mov ch, 0xa7
jl 0x416825
inc ebp
rcl al, 0x33
std
aas
pop ds
dec ecx
add al, 0x1a
jne 0x416827
movsd dword es:[edi], dword [esi]
invalid
cmp dword [ebp + 0x18], 0
jne 0x41684d
xor esi, esi
jmp 0x416c94
call fcn.00452603
test al, al
je 0x416871
add dword [ebx + 0x78], edi
mov eax, dword [0xc4817ea2]
adc byte [ebx + 0x62], ah
fidiv word [0xba120a00]
jns 0x4168d8
invalid
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
lea eax, [ebp + 8]
mov dword [ebp - 0x30], 0
push eax
call fcn.004029b0
push 3
push 0x5e8400
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00405da0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
call fcn.00452465
test al, al
je 0x4168e1
fild dword [esi + edi*4 - 0x7f]
clc
lds edi, [0x3f62abcb]
bound edi, qword [edi]
sar byte [esi + 0x70], 1
out dx, eax
loop 0x41694c
shr al, 0x43
mov eax, 0xc0840003
call fcn.00452129
test al, al
je 0x416905
push edi
mov byte [ebx], dh
test eax, 0xca0b4069
push ebx
xor ah, byte [ecx - 0x6d]
imul eax, dword [eax + 0xb], 0x613253ca
xchg ebx, eax
bound ebp, qword [ecx + ebp]
scasb al, byte es:[edi]
jae 0x416955
sbb eax, 0x7fc8f76c
mov dl, 0x56
push esi
std
jb 0x4168ee
call fcn.00452129
test al, al
pop ds
mov eax, 0xc0840003
je 0x416929
cmp esp, esp
daa
lds edi, [eax + esi*4]
xor ah, al
pop ecx
push cs
mov eax, 0xc20596eb
fmul dword [edi]
dec ebx
rcl esp, 0xa4
jmp 0x697e806f
mov edi, dword [ebp - 0x2ac]
cmp edi, 0xffffffff
je 0x416b7f
call fcn.0045205a
test al, al
je 0x416961
adc al, byte [edx + ecx - 0x1d]
iretd
jns 0x416902
out dx, eax
inc eax
xchg ebp, eax
pop ds
hlt
and dword [edi - 0x1a55e2f5], ecx
movsd dword es:[edi], dword [esi]
or eax, 0xf5742c64
call fcn.004524ef
test al, al
je 0x41698c
out dx, eax
mov al, byte [0x641412af]
invalid
lea eax, [ebp - 0x2a8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x416b7f
mov ax, word [ebp - 0x27c]
cmp ax, 0x2e
je 0x416938
mov cx, word [ebp - 0x27a]
test cx, cx
je 0x416938
cmp cx, 0x2e
jne 0x4169d3
cmp word [ebp - 0x278], 0
je 0x416938
xor ecx, ecx
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], cx
test ax, ax
jne 0x4169f0
xor eax, eax
jmp 0x416a0f
lea eax, [ebp - 0x27c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416a00
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00402ad0
xor eax, eax
mov byte [ebp - 4], 2
test byte [ebp - 0x2a8], 0x10
lea ecx, [ebp - 0x28]
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
push eax
je 0x416aef
call fcn.004029b0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00405c90
push 1
push 0x5e6ba4
lea ecx, [ebp - 0x28]
call fcn.00405da0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x28]
push 0x10000000
push str.Everyone
mov ecx, dword [ebx]
push eax
call fcn.00415ab0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebx]
cmovae eax, dword [ebp - 0x28]
push 0x10000000
push str.ALL_APPLICATION_PACKAGES
push eax
call fcn.00415ab0
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x416ad3
mov eax, dword [ecx]
jmp 0x416ad5
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x28]
push edx
push eax
call fcn.004029b0
mov ecx, ebx
call int.004167e0
jmp 0x416b48
call fcn.004029b0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00405c90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x28]
push 0x10000000
push str.Everyone
mov ecx, dword [ebx]
push eax
call fcn.00415ab0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebx]
cmovae eax, dword [ebp - 0x28]
push 0x10000000
fsubr dword [eax]
add byte [eax], al
adc byte [eax + 0x1c], ch
test byte [esi], bl
add byte [eax], dl
push str.ALL_APPLICATION_PACKAGES
push eax
call fcn.00415ab0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x416b5d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402c20
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x416938
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402c20
jmp 0x416938
call fcn.0045216e
test al, al
je 0x416b9f
and byte [eax], al
dec ecx
loopne 0x416b3b
bound ebx, qword [ebx + 0x5a]
jne 0x416b37
mov edi, 0x2aa7a8d6
cli
pop esi
mov edi, dword [ebp - 0x2ac]
call fcn.004520e4
test al, al
je 0x416bbe
fsub qword [ebp - 0x57d08cd7]
invalid
sub dword [ebx + 0x2f], esi
test al, 0x8f
dec esi
dec eax
invalid
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004524aa
test al, al
je 0x416bde
or byte [eax + 0x238d4bc0], 0x5f
shr byte [edx], 1
sub dword [ebx - 0x59], esp
imul ebx, dword [ecx + 0x15e8cda1], 0xffffffb6
add eax, dword [eax]
call fcn.004521f8
test al, al
je 0x416bfe
sbb dword [esi - 0x16], edi
pop esp
ret
call fcn.004520e4
test al, al
je 0x416c26
fld qword [0xddf198f8]
mov eax, dword [0x92068b06]
sub dword [edx - 0x5989aa1d], 0x8a30f0ee
salc
xor byte [ebx + ebx*4 + 0x67], 0x8b
pushfd
jg 0x416be5
jbe 0x416baa
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov esi, dword [ebp - 0x2b0]
cmovae eax, dword [ebp + 8]
push 0x10000000
push str.Everyone
mov ecx, dword [esi]
push eax
call fcn.00415ab0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov ecx, dword [esi]
cmovae eax, dword [ebp + 8]
push 0x10000000
push str.ALL_APPLICATION_PACKAGES
push eax
call fcn.00415ab0
mov eax, dword [ebp - 0x2c]
mov esi, 1
cmp eax, 8
jb 0x416c80
jge 0x416c45
or byte [ebp - 0x4a74f7bb], cl
push eax
std
invalid
out dx, al
invalid
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402c20
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x416ca9
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00402c20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 0x18