Function at 0x413fb0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51058b
mov eax, dword fs:[0]
push eax
sub esp, 0x610
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x620]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
je 0x4142d7
cmp dword [eax + 8], ebx
je 0x4142d7
mov byte [esp + 0x20], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x628], ebx
mov edi, dword [eax + 8]
mov edx, dword [edi + 0x10]
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x20], edx
cmp ecx, 0xf
je 0x414252
cmp ecx, 0x16
jne 0x4142ca
lea eax, [esp + 0x3c]
push eax
call fcn.00476b00
add edi, 0x38
push edi
lea ecx, [esp + 0x60]
call fcn.00439010
push 0x521964
push 0x51f1f4
lea edx, [esp + 0x64]
call fcn.00439710
add esp, 8
lea eax, [esp + 0x68]
cmp byte [esp + 0x178], bl
jne 0x414079
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x2ac]
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x414230
xor eax, eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov word [esp + 0x32], ax
lea eax, [esp + 0x24]
xor edx, edx
push eax
mov word [esp + 0x28], dx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x14]
push 1
push ebx
push ebx
push eax
call fcn.004d6e80
mov ecx, dword [esp + 0x10]
mov esi, edx
mov edi, eax
xor edx, edx
add edi, ecx
mov dword [esp + 0x34], edi
adc esi, edx
jmp 0x414102
xor ebx, ebx
cmp dword [esp + 0x2ac], 0x10
je 0x414215
lea eax, [esp + 0x2d8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x414120
sub eax, edx
sar eax, 1
push 0x2e
lea eax, [esp + eax*2 + 0x2dc]
push eax
lea ecx, [esp + 0x2e0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x414215
push str..png
push eax
call fcn.004ccbed
add esp, 8
test eax, eax
jne 0x414215
mov edx, dword [esp + 0x2bc]
push 1
push ebx
push ebx
push edx
call fcn.004d6e80
mov ecx, dword [esp + 0x2b8]
xor ebx, ebx
add eax, ecx
adc edx, ebx
cmp esi, edx
jb 0x414215
ja 0x414195
cmp edi, eax
jbe 0x414215
mov ecx, edi
sub ecx, eax
mov eax, esi
sbb eax, edx
mov dword [esp + 0x58], eax
jne 0x4141ab
cmp ecx, 0x28e44000
jbe 0x414215
lea ecx, [esp + 0x5c]
push ecx
lea edi, [esp + 0x188]
call fcn.00438f90
push 0x51f14c
push 0x51f1f4
mov edx, edi
call fcn.00439710
lea edx, [esp + 0x2e0]
push edx
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esp, 0x10
mov eax, edi
call fcn.00439670
mov ebx, eax
lea edi, [esp + 0x4fc]
call fcn.004024b0
call fcn.00401890
mov eax, edi
call fcn.00402520
lea ecx, [esp + 0x184]
call fcn.00439080
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x2ac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414100
lea ecx, [esp + 0x5c]
call fcn.00439080
lea esi, [esp + 0x3c]
call fcn.00414d40
lea ecx, [esp + 0x1c]
call fcn.004382a0
mov al, 1
jmp 0x4142d9
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x1c]
call fcn.0041ad70
test al, al
jne 0x414286
test dword [esi + 0x20], 0x100000
je 0x4142ca
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4142ca
mov eax, dword [esi + 0x1c]
push ebx
push ebx
push 0xce2a
push eax
jmp 0x4142c4
test byte [esi + 0x20], 1
je 0x414291
call fcn.00414300
test byte [esi + 0x20], 0x10
je 0x41429c
call fcn.00414740
test dword [esi + 0x20], 0x100000
je 0x4142ca
call fcn.00414980
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4142ca
mov edx, dword [esi + 0x1c]
push ebx
push 1
push 0xce2a
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x1c]
call fcn.004382a0
mov al, 1
jmp 0x4142d9
xor al, al
mov ecx, dword [esp + 0x620]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.004cc2b1
mov esp, ebp
pop ebp
ret