Function at 0x405db0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575b20
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, 0xf
mov edi, ecx
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
mov byte [ebp - 4], 1
push 0x48
mov dword [ebp - 0x25c], ebx
call fcn.00535efc
add esp, 4
cmp eax, ebx
je 0x4064bd
mov dword [ebp - 0x260], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x260]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x260]
mov dword [eax + 8], eax
mov ecx, dword [ebp - 0x260]
mov byte [ecx + 0x44], 1
mov edx, dword [ebp - 0x260]
mov byte [edx + 0x45], 1
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
mov byte [ebp - 4], 3
xor eax, eax
test byte [0x6817b0], 1
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
jne 0x405e9e
or dword [0x6817b0], 1
push ebx
call fcn.00540820
add esp, 4
mov dword [0x6817a8], eax
mov dword [0x6817ac], edx
cmp dword [0x6829a8], 0x3c
jb 0x40644d
lea eax, [ebp - 0x250]
push eax
push edi
call fcn.0040eaf0
cmp eax, ebx
jl 0x406448
mov edi, dword [ebp - 0x250]
push edi
call fcn.0040f410
mov esi, eax
cmp dword [esi], ebx
je 0x405f21
mov ecx, dword [esi + 4]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
lea edx, [edi + 1]
push edx
call fcn.00538174
add esp, 4
push edi
push ebx
push eax
mov dword [ebp - 0x268], eax
call fcn.00534b40
mov eax, dword [ebp - 0x268]
mov ecx, dword [esi + 4]
add esp, 0xc
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [ebp - 0x250]
lea eax, [esi - 0x10]
mov edx, eax
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
jne 0x405f35
call fcn.004125b0
cmp edi, ebx
je 0x405f4d
lea eax, [edi - 0x10]
mov edx, eax
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
jne 0x405f4d
call fcn.004125b0
cmp dword [ebp - 0x268], ebx
je 0x406448
mov eax, dword [ebp - 0x268]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405f62
sub eax, edx
je 0x406448
mov esi, dword [ebp - 0x268]
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.0040a3f0
push esi
call fcn.00535f7c
add esp, 4
lea edx, [ebp - 0x254]
push edx
lea edi, [ebp - 0x7c]
mov byte [ebp - 0x254], 0x5c
call fcn.0040a4f0
cmp eax, 0xffffffff
jne 0x406047
mov esi, 0x10
cmp dword [ebp - 0x30], esi
jb 0x405fbf
mov eax, dword [ebp - 0x44]
push eax
call fcn.00535f7c
add esp, 4
mov edi, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x264]
call fcn.0040b750
mov edx, dword [ebp - 0x260]
push edx
call fcn.00535f7c
add esp, 4
cmp dword [ebp - 0x4c], esi
jb 0x40600d
mov eax, dword [ebp - 0x60]
push eax
call fcn.00535f7c
add esp, 4
cmp dword [ebp - 0x68], esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
jb 0x406027
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.00535f7c
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 4
inc eax
push eax
push ebx
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x7c]
call fcn.00408ae0
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.0040a290
mov byte [ebp - 4], 3
cmp dword [ebp - 0x84], 0x10
jb 0x406082
mov eax, dword [ebp - 0x98]
push eax
call fcn.00535f7c
add esp, 4
push str.WTFAccount_
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.0040c7d0
mov ecx, eax
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 7
call fcn.0040c8b0
mov edi, 0x10
cmp dword [eax + 0x14], edi
jb 0x4060b4
mov eax, dword [eax]
lea ecx, [ebp - 0x24c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0xa0], edi
jb 0x4060df
mov edx, dword [ebp - 0xb4]
push edx
call fcn.00535f7c
add esp, 4
mov esi, 0xf
mov byte [ebp - 4], 3
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xa4], ebx
mov byte [ebp - 0xb4], bl
cmp dword [ebp - 0x84], edi
jb 0x406111
mov eax, dword [ebp - 0x98]
push eax
call fcn.00535f7c
add esp, 4
cmp dword [ebp - 0x250], 0xffffffff
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
jne 0x40616f
push str.Get_Dir_Name_error_
push str.ProcessAnalyser
push 0x67eba0
call fcn.004ebec7
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.00451de0
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.00401990
lea ecx, [ebp - 0x60]
call fcn.00451de0
lea ecx, [ebp - 0x7c]
call fcn.00451de0
jmp 0x406027
mov ecx, 0x65cb44
lea eax, [ebp - 0x220]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4061a0
cmp dl, bl
je 0x40619c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4061a0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x406180
xor eax, eax
jmp 0x4061a5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x406395
mov ecx, 0x65cb48
lea eax, [ebp - 0x220]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4061d8
cmp dl, bl
je 0x4061d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4061d8
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4061b8
xor eax, eax
jmp 0x4061dd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x406395
xor eax, eax
test byte [ebp - 0x24c], 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
je 0x406395
lea eax, [ebp - 0x220]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406210
sub eax, edx
push eax
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x44]
call fcn.0040a3f0
push 1
push ebx
push 0x65cb4c
lea ecx, [ebp - 0x44]
call fcn.00408a00
mov edi, eax
cmp edi, 0xffffffff
je 0x406395
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x244]
push ebx
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.0053b180
mov esi, edx
push esi
push eax
lea edx, [ebp - 0x28]
push 0x65cb50
push edx
mov dword [ebp - 0x26c], eax
call fcn.00535bfb
add esp, 0x10
cmp esi, dword [0x6810fc]
jl 0x406395
jg 0x4062a3
mov eax, dword [ebp - 0x26c]
cmp eax, dword [0x6810f8]
jb 0x406395
lea ecx, [ebp - 0x264]
call fcn.00409350
push edi
push ebx
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00408ae0
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 0x10
jb 0x4062cd
mov ecx, dword [eax]
jmp 0x4062cf
mov ecx, eax
mov eax, ecx
mov dword [ebp - 0xd8], 0xf
mov dword [ebp - 0xdc], ebx
mov byte [ebp - 0xec], bl
lea edi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4062f0
sub eax, edi
push eax
push ecx
lea ecx, [ebp - 0xec]
call fcn.0040a3f0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x28]
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], ebx
mov byte [ebp - 0xd0], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x406326
sub eax, ecx
push eax
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xd0]
call fcn.0040a3f0
push ebx
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0xa
call fcn.0040d560
push eax
lea ecx, [ebp - 0x278]
push ecx
lea ecx, [ebp - 0x264]
call fcn.0040cae0
lea ecx, [ebp - 0xec]
call fcn.0040a160
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 3
call fcn.00451de0
mov edx, dword [ebp - 0x26c]
mov dword [0x6810f8], edx
mov dword [0x6810fc], esi
mov esi, dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40616f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x260]
mov edi, dword [ecx]
lea esi, [edi + 0xc]
cmp dword [esi + 0x30], 0x10
lea eax, [esi + 0x1c]
jb 0x4063ce
mov eax, dword [eax]
push eax
call fcn.00536c12
mov ecx, dword [0x6817a8]
cdq
add esp, 4
sub ecx, eax
mov eax, dword [0x6817ac]
sbb eax, edx
cdq
xor eax, edx
xor ecx, edx
sub ecx, edx
sbb eax, edx
cmp eax, ebx
jg 0x40641a
jl 0x4063fe
cmp ecx, 0x7080
ja 0x40641a
cmp dword [esi + 0x14], 0x10
mov edi, dword [edi + 0x1c]
jb 0x406409
mov esi, dword [esi]
mov edx, dword [ebp - 0x270]
push edi
push esi
push edx
call fcn.00537970
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.00451de0
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.00401990
lea ecx, [ebp - 0x60]
call fcn.00451de0
lea ecx, [ebp - 0x7c]
call fcn.00451de0
mov al, 1
jmp 0x406029
mov esi, 0xf
mov edi, 0x10
cmp dword [ebp - 0x30], edi
jb 0x406463
mov eax, dword [ebp - 0x44]
push eax
call fcn.00535f7c
add esp, 4
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x264]
call fcn.0040b750
mov edx, dword [ebp - 0x260]
push edx
call fcn.00535f7c
add esp, 4
cmp dword [ebp - 0x4c], edi
jb 0x4064ac
mov eax, dword [ebp - 0x60]
push eax
call fcn.00535f7c
add esp, 4
cmp dword [ebp - 0x68], edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
jmp 0x406019
lea edx, [ebp - 0x250]
push edx
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x250], ebx
call fcn.005376e7
push 0x66ee2c
lea eax, [ebp - 0x27c]
push eax
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.00537ad4
int3