Function at 0x44a8d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16a0
call fcn.005970f0
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 1]
mov dword [ebp - 0x1684], ecx
mov dword [0x6437d4], eax
cmp edx, edi
jle 0x44b5b1
lea eax, [ecx + edi*4]
push eax
mov eax, edx
sub eax, edi
push eax
call fcn.00444f10
dec edi
add esp, 8
add edi, eax
cmp dword [0x637c50], 0
mov dword [ebp - 0x1678], edi
je 0x44a93a
cmp word [0x6436f8], 0
jne 0x44a93a
call fcn.004485c0
mov eax, dword [0x6373b4]
xor esi, esi
mov dword [0x6373bc], eax
xor ebx, ebx
mov eax, dword [0x6437bc]
mov dword [0x637c50], 0
mov dword [ebp - 0x1680], 0
mov dword [ebp - 0x1690], 0
mov dword [ebp - 0x1694], 1
mov dword [ebp - 0x1674], esi
mov dword [ebp - 0x1670], ebx
test eax, eax
je 0x44aaa9
push 0x5c8990
push eax
call fcn.005931b4
add esp, 8
mov dword [ebp - 0x1688], eax
test eax, eax
je 0x44aaa9
push eax
lea eax, [ebp - 0x80c]
push 0x200
push eax
call fcn.005963d8
add esp, 0xc
test eax, eax
je 0x44aa9b
lea eax, [ebp - 0x80c]
dec eax
xor edi, edi
mov dword [ebp - 0x167c], eax
lea ecx, [ebp - 0x80c]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44a9e0
mov eax, dword [ebp - 0x167c]
sub ecx, edx
mov al, byte [ecx + eax]
cmp al, 0xa
je 0x44a9fa
cmp al, 0xd
jne 0x44aa0f
dec ecx
cmp ecx, 0x200
jae 0x44b5e6
mov byte [ebp + ecx - 0x80c], 0
cmp byte [ebp - 0x80c], 0
je 0x44aa73
mov eax, dword [ebp - 0x1674]
cmp dword [ebp - 0x1670], ebx
jl 0x44aa4d
add esi, 0x2580
add ebx, 0x20
push esi
test eax, eax
jne 0x44aa3e
call fcn.00593e38
add esp, 4
jmp 0x44aa47
push eax
call fcn.00593eca
add esp, 8
mov dword [ebp - 0x1674], eax
inc dword [ebp - 0x1670]
lea edx, [edi + eax]
lea ecx, [ebp - 0x80c]
add edi, 0x12c
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44aa66
push dword [ebp - 0x1688]
lea eax, [ebp - 0x80c]
push 0x200
push eax
call fcn.005963d8
add esp, 0xc
test eax, eax
jne 0x44a9d1
mov edi, dword [ebp - 0x1678]
push dword [ebp - 0x1688]
call fcn.00593079
add esp, 4
cmp edi, dword [ebp + 0xc]
jge 0x44adc6
mov esi, dword [ebp - 0x1684]
jmp 0x44aac0
mov eax, dword [esi + edi*4]
mov ecx, 0x5c8994
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44aae8
test dl, dl
je 0x44aae4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44aae8
add eax, 2
add ecx, 2
test dl, dl
jne 0x44aac8
xor eax, eax
jmp 0x44aaed
sbb eax, eax
or eax, 1
test eax, eax
je 0x44aaf7
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x44aac0
mov ecx, dword [ebp - 0x1670]
mov esi, dword [ebp - 0x1674]
mov dword [ebp - 0x1688], edi
sub edi, dword [ebp - 0x1678]
mov dword [ebp - 0x1698], edi
lea eax, [edi + ecx]
cmp eax, ebx
jl 0x44ab51
lea eax, [edi + ecx]
add ebx, eax
imul eax, ebx, 0x12c
push eax
test esi, esi
jne 0x44ab3e
call fcn.00593e38
mov esi, eax
add esp, 4
mov dword [ebp - 0x1674], esi
jmp 0x44ab57
push esi
call fcn.00593eca
mov esi, eax
add esp, 8
mov dword [ebp - 0x1674], esi
jmp 0x44ab57
mov esi, dword [ebp - 0x1674]
mov eax, dword [ebp - 0x1688]
mov ecx, dword [ebp - 0x1678]
cmp ecx, eax
jge 0x44adbf
jmp 0x44ab70
mov eax, dword [ebp - 0x1684]
push 0x5c8998
push dword [eax + ecx*4]
call fcn.00596770
add esp, 8
test eax, eax
jne 0x44abe3
mov eax, dword [ebp - 0x1678]
mov ecx, dword [ebp - 0x1684]
push 0x5c899c
push dword [ecx + eax*4]
call fcn.00596770
add esp, 8
test eax, eax
jne 0x44abe3
mov eax, dword [ebp - 0x1678]
mov ecx, dword [ebp - 0x1684]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x1670]
imul ecx, eax, 0x12c
add ecx, esi
inc eax
mov dword [ebp - 0x1670], eax
mov edi, edi
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x44abd0
jmp 0x44ad9d
mov ecx, dword [ebp - 0x1684]
lea eax, [ebp - 0x1480]
push eax
mov eax, dword [ebp - 0x1678]
push dword [ecx + eax*4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x1684]
lea edx, [ebp - 0x60c]
mov esi, eax
mov eax, dword [ebp - 0x1678]
mov dword [ebp - 0x167c], esi
mov ecx, dword [ecx + eax*4]
sub edx, ecx
mov edi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44ac20
lea eax, [ebp - 0x60c]
push 0x5c
push eax
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44ac5f
lea eax, [ebp - 0x60c]
push 0x2f
push eax
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44ac5f
mov byte [ebp - 0x108], al
jmp 0x44ac7a
mov byte [eax + 1], 0
xor ecx, ecx
mov al, byte [ebp + ecx - 0x60c]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x109], al
test al, al
jne 0x44ac65
cmp esi, 0xffffffff
je 0x44ad97
mov ecx, dword [ebp - 0x1670]
imul eax, ecx, 0x12c
lea esi, [edi + ecx]
mov dword [ebp - 0x16a0], esi
mov dword [ebp - 0x169c], eax
jmp 0x44aca6
mov ecx, dword [ebp - 0x1670]
cmp esi, ebx
jl 0x44acd9
lea eax, [edi + ecx]
mov ecx, dword [ebp - 0x1674]
add ebx, eax
imul eax, ebx, 0x12c
push eax
test ecx, ecx
jne 0x44acca
call fcn.00593e38
add esp, 4
jmp 0x44acd3
push ecx
call fcn.00593eca
add esp, 8
mov dword [ebp - 0x1674], eax
xor ecx, ecx
jmp 0x44ace0
mov al, byte [ebp + ecx - 0x108]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x911], al
test al, al
jne 0x44ace0
lea edx, [ebp - 0x1454]
mov esi, edx
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x44ad00
lea edi, [ebp - 0x910]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44ad10
mov ecx, edx
mov eax, dword [ebp - 0x1674]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x169c]
add eax, edi
push 0
push 0x104
push eax
lea eax, [ebp - 0x910]
push eax
call fcn.0045c8d0
mov esi, dword [ebp - 0x16a0]
lea eax, [ebp - 0x1480]
inc dword [ebp - 0x1670]
add esp, 0x10
inc esi
add edi, 0x12c
mov dword [ebp - 0x16a0], esi
mov dword [ebp - 0x169c], edi
push eax
push dword [ebp - 0x167c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, dword [ebp - 0x1698]
test eax, eax
jne 0x44aca0
push dword [ebp - 0x167c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x1674]
mov ecx, dword [ebp - 0x1678]
dec edi
mov eax, dword [ebp - 0x1688]
inc ecx
mov dword [ebp - 0x1678], ecx
mov dword [ebp - 0x1698], edi
cmp ecx, eax
jl 0x44ab70
inc eax
mov dword [ebp - 0x1678], eax
cmp word [0x643708], 0
je 0x44ae61
cmp word [0x63735c], 0xffff
je 0x44ae61
push str.tiff
call fcn.0045b150
movsx ecx, word [0x63735c]
add esp, 4
cmp ecx, eax
je 0x44ae5a
push 0x5c89a0
call fcn.0045b150
movsx ecx, word [0x63735c]
add esp, 4
cmp ecx, eax
je 0x44ae5a
push 0x5c89a4
call fcn.0045b150
movsx ecx, word [0x63735c]
add esp, 4
cmp ecx, eax
je 0x44ae5a
push 0x5c89a8
call fcn.0045b150
movsx ecx, word [0x63735c]
add esp, 4
cmp ecx, eax
je 0x44ae5a
push 0x5c506c
call fcn.0045b150
movsx ecx, word [0x63735c]
add esp, 4
cmp ecx, eax
jne 0x44ae61
mov eax, 1
jmp 0x44ae63
xor eax, eax
mov word [0x643708], ax
mov dword [ebp - 0x168c], 0
test ax, ax
je 0x44b13a
lea eax, [ebp - 0xbc]
push eax
call fcn.0045a680
movzx eax, word [0x6436fc]
add esp, 4
cmp word [0x63735c], 0xffff
mov word [ebp - 0x60], ax
movzx eax, word [0x63736c]
mov word [ebp - 0x5e], ax
movzx eax, word [0x637370]
mov word [ebp - 0x5c], ax
movzx eax, byte [0x643724]
mov byte [ebp - 0x4a], al
movzx eax, byte [0x6436fa]
mov byte [ebp - 0x49], al
movzx eax, byte [0x6436f6]
mov byte [ebp - 0x47], al
movzx eax, byte [0x6436f7]
mov byte [ebp - 0x48], al
movzx eax, byte [0x64372c]
mov byte [ebp - 0x46], al
jne 0x44aef7
push str.tiff
call fcn.0045b150
add esp, 4
jmp 0x44aefd
mov ax, word [0x63735c]
mov word [ebp - 0xbc], ax
mov eax, dword [0x6373ac]
cmp eax, 0xffffffff
je 0x44af19
mov edi, dword [0x64375c]
sub edi, eax
inc edi
jmp 0x44af6f
cmp word [0x63737c], 0
jle 0x44af2d
mov edx, dword [ebp - 0x1670]
mov edi, edx
jmp 0x44af75
mov eax, dword [ebp - 0x1670]
xor edi, edi
test eax, eax
jle 0x44af6f
mov esi, dword [ebp - 0x1674]
mov ebx, eax
lea eax, [ebp - 0x166c]
push eax
movzx eax, word [0x637358]
push 0
push eax
push esi
call fcn.0045ac90
add esp, 0x10
test ax, ax
jne 0x44af66
add edi, dword [ebp - 0x1648]
add esi, 0x12c
dec ebx
jne 0x44af41
mov edx, dword [ebp - 0x1670]
mov eax, dword [0x643760]
mov ecx, str.output
test eax, eax
cmovne ecx, eax
mov dword [0x643760], ecx
test edx, edx
je 0x44aff9
mov ebx, dword [ebp - 0x1674]
push 0x2f
push ebx
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44afd7
push 0x5c
push ebx
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44afd7
lea edx, [ebp - 0x508]
mov ecx, ebx
sub edx, ebx
lea esp, [esp]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44afc0
mov ecx, dword [0x643760]
mov edx, ebx
jmp 0x44b005
lea ecx, [eax + 1]
lea edx, [ebp - 0x508]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44afe2
mov ecx, dword [0x643760]
mov edx, ebx
jmp 0x44b005
mov byte [ebp - 0x508], 0
mov edx, str.output
movsx eax, word [0x63735c]
push 1
push eax
push 0
push edx
push ecx
lea eax, [ebp - 0x508]
push eax
call fcn.00443450
add esp, 0x18
cmp byte [0x64370a], 0
jne 0x44b0e7
lea eax, [ebp - 0x1340]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.005970a6
add esp, 8
test eax, eax
jne 0x44b0cb
lea eax, [ebp - 0x508]
push 0x2e
push eax
call fcn.00596630
mov edx, eax
add esp, 8
test edx, edx
je 0x44b0b7
xor ecx, ecx
mov al, byte [ebp + ecx - 0x508]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xb11], al
test al, al
jne 0x44b066
mov eax, edx
lea ecx, [ebp - 0x508]
sub eax, ecx
push edx
mov byte [ebp + eax - 0xb10], 0
lea eax, [ebp - 0xb10]
push eax
call fcn.00443b90
add esp, 8
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0xb10]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x509], al
test al, al
jne 0x44b0a0
jmp 0x44b0cb
lea eax, [ebp - 0xb10]
push 0x5c2576
push eax
call fcn.00443b90
add esp, 8
lea eax, [ebp - 0x508]
push 0x628c60
push eax
call fcn.005931b4
add esp, 8
test eax, eax
jne 0x44b564
xor ecx, ecx
lea esp, [esp]
mov al, byte [ebp + ecx - 0x508]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1311], al
test al, al
jne 0x44b0f0
lea eax, [ebp - 0x1310]
mov dword [0x643760], eax
lea eax, [ebp - 0xbc]
push eax
push edi
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x168c]
push eax
call fcn.0045aaa0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x44b581
cmp word [0x63737c], 0xffff
jne 0x44b14c
xor eax, eax
mov word [0x63737c], ax
cmp dword [0x6437a4], 0
jle 0x44b1b5
cmp dword [0x6437a8], 0
jle 0x44b1b5
mov eax, dword [0x5c43c0]
mov dword [ebp - 0x508], eax
mov eax, dword [0x643760]
test eax, eax
je 0x44b18d
push 1
push 0xffffffffffffffff
push 0
push 0x5c43c0
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00443450
add esp, 0x18
lea eax, [ebp - 0x508]
push eax
push 0xffffffffffffffff
push 0x5c43c0
call fcn.00442de0
add esp, 0xc
test eax, eax
je 0x44b4fa
mov ebx, 1
jmp 0x44b500
cmp dword [0x6437ac], 0
je 0x44b20f
mov ax, word [0x5c433c]
movq xmm0, qword [str.clipboard]
mov word [ebp - 0x500], ax
mov eax, dword [0x643760]
movq qword [ebp - 0x508], xmm0
test eax, eax
je 0x44b1ff
push 1
push 0xffffffffffffffff
push 0
push str.clipboard
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00443450
add esp, 0x18
lea eax, [ebp - 0x508]
push eax
push 0xffffffffffffffff
push str.clipboard
jmp 0x44b19b
cmp dword [ebp - 0x1670], 0
jle 0x44b4fa
mov edi, dword [ebp - 0x1674]
lea ebx, [ebp - 0x508]
mov esi, dword [0x6373ac]
sub ebx, edi
mov eax, dword [ebp - 0x1670]
mov dword [ebp - 0x167c], ebx
lea esp, [esp]
cmp esi, 0xffffffff
je 0x44b3c2
cmp esi, dword [0x64375c]
jg 0x44b4db
mov ebx, dword [ebp - 0x1680]
jmp 0x44b260
movsx eax, word [0x63735c]
push 1
push eax
push esi
push edi
lea eax, [ebp - 0xf10]
mov byte [ebp - 0xf10], 0
push edi
push eax
call fcn.00443450
mov edx, dword [0x643760]
add esp, 0x18
test edx, edx
je 0x44b318
lea eax, [ebp - 0xf10]
push 0x2f
push eax
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44b2d7
lea eax, [ebp - 0xf10]
push 0x5c
push eax
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44b2d7
jmp 0x44b2c0
mov cl, byte [ebp + eax - 0xf10]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x509], cl
test cl, cl
jne 0x44b2c0
jmp 0x44b2ef
lea ecx, [eax + 1]
lea edx, [ebp - 0x508]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44b2e2
movsx eax, word [0x63735c]
push 1
push eax
push esi
push edi
push dword [0x643760]
lea eax, [ebp - 0x508]
push eax
call fcn.00443450
mov edx, dword [0x643760]
add esp, 0x18
jmp 0x44b335
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [ebp + ecx - 0xf10]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x509], al
test al, al
jne 0x44b320
mov eax, dword [ebp - 0x168c]
test eax, eax
je 0x44b360
push eax
movsx eax, word [0x63737c]
push edx
push eax
lea eax, [ebp - 0xf10]
push eax
call fcn.00443190
mov edx, dword [ebp - 0x1690]
add esp, 0x10
jmp 0x44b395
cmp word [0x643728], 0
je 0x44b36f
or eax, 0xffffffff
jmp 0x44b376
movsx eax, word [0x63737c]
lea ecx, [ebp - 0x508]
push ecx
push eax
lea eax, [ebp - 0xf10]
push eax
call fcn.00442de0
mov edx, eax
add esp, 0xc
mov dword [ebp - 0x1690], edx
test edx, edx
mov eax, 1
cmovne ebx, eax
add esi, dword [0x6373b0]
cmp esi, dword [0x64375c]
jle 0x44b260
mov dword [ebp - 0x1680], ebx
mov ebx, dword [ebp - 0x167c]
jmp 0x44b4cf
cmp dword [0x643760], 0
je 0x44b44d
push 0x2f
push edi
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44b3ff
push 0x5c
push edi
call fcn.00596630
add esp, 8
test eax, eax
jne 0x44b3ff
mov ecx, edi
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + ebx - 1], al
test al, al
jne 0x44b3f0
jmp 0x44b41d
lea ecx, [eax + 1]
lea edx, [ebp - 0x508]
sub edx, ecx
lea ebx, [ebx]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44b410
movsx eax, word [0x63735c]
mov esi, dword [ebp - 0x1694]
push 1
push eax
push esi
push edi
push dword [0x643760]
lea eax, [ebp - 0x508]
push eax
call fcn.00443450
add esp, 0x18
inc esi
mov dword [ebp - 0x1694], esi
jmp 0x44b45d
mov ecx, edi
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + ebx - 1], al
test al, al
jne 0x44b450
mov eax, dword [ebp - 0x168c]
test eax, eax
je 0x44b48a
push eax
lea eax, [ebp - 0x508]
push eax
movsx eax, word [0x63737c]
push eax
push edi
call fcn.00443190
mov edx, eax
add esp, 0x10
mov dword [ebp - 0x1690], edx
jmp 0x44b4b9
cmp word [0x643728], 0
je 0x44b499
or eax, 0xffffffff
jmp 0x44b4a0
movsx eax, word [0x63737c]
lea ecx, [ebp - 0x508]
push ecx
push eax
push edi
call fcn.00442de0
add esp, 0xc
mov dword [ebp - 0x1690], eax
mov edx, eax
mov ecx, dword [ebp - 0x1680]
test edx, edx
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x1680], ecx
mov eax, dword [ebp - 0x1670]
mov esi, dword [0x6373ac]
sub ebx, 0x12c
add edi, 0x12c
dec eax
mov dword [ebp - 0x167c], ebx
mov dword [ebp - 0x1670], eax
jne 0x44b240
mov ebx, dword [ebp - 0x1680]
mov eax, dword [ebp - 0x168c]
test eax, eax
je 0x44b513
push eax
call fcn.0045a9e0
add esp, 4
mov eax, dword [ebp - 0x1674]
test eax, eax
je 0x44b526
push eax
call fcn.00592c4b
add esp, 4
mov eax, dword [0x6436ec]
test eax, eax
je 0x44b538
push eax
call fcn.00592c4b
add esp, 4
mov edi, dword [ebp - 0x1678]
mov edx, dword [ebp + 0xc]
mov dword [0x6436ec], 0
mov dword [0x6436f0], 0
cmp edi, edx
jge 0x44b5aa
mov ecx, dword [ebp - 0x1684]
jmp 0x44a908
push eax
call fcn.00593079
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
push 0xffffffffffffffff
push 0
push eax
push 0
push dword [0x643760]
call fcn.004431e0
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6437d4]
jmp 0x44b5b7
mov ebx, dword [ebp - 0x1694]
test ebx, ebx
jne 0x44b5d0
test eax, eax
jne 0x44b5d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
call fcn.00592dbb
int3