Function at 0x436740
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509c5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x334
mov eax, dword [0x56b44c]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
xor esi, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.004db3a1
mov dword [ebp - 0x44], 0x51af4c
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.004db3a1
mov al, byte [0x575484]
mov dword [ebp - 0x2c], esi
test al, 1
jne 0x4367d8
mov dl, al
mov eax, dword [0x56b44c]
or dl, 1
push 0x436fd0
mov byte [0x575484], dl
mov dword [0x575480], eax
call fcn.004be617
add esp, 4
mov al, byte [0x575484]
test al, 2
jne 0x436805
mov ecx, dword [0x56b44c]
mov dl, al
or dl, 2
push 0x436fc0
mov byte [0x575484], dl
mov dword [0x57547c], ecx
call fcn.004be617
add esp, 4
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 7
call fcn.004e1fbe
mov eax, dword [ebp + 0x1c]
push 0x2fe
mov dword [eax], esi
mov eax, dword [0x5762a0]
cmp eax, esi
je 0x436837
push 0x575480
call fcn.0041a380
add esp, 8
jmp 0x436841
mov ecx, 0x575480
call fcn.004e2fed
mov eax, dword [0x5762a0]
push 0x313
cmp eax, esi
je 0x43685e
push 0x57547c
call fcn.0041a380
add esp, 8
jmp 0x436868
mov ecx, 0x57547c
call fcn.004e2fed
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
mov ax, word [eax + ecx*2 - 2]
cmp ax, 0x5c
je 0x436883
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004e223f
add edi, 0x270
lea ecx, [ebp + 8]
push edi
call fcn.004e1b94
lea ecx, [ebp - 0x20]
push 2
push ecx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.004d6f0d
mov edx, dword [eax]
push 0x55c42c
push edx
call fcn.004bdb15
add esp, 8
cmp eax, esi
lea ecx, [ebp - 0x20]
sete bl
call fcn.004e1e27
test bl, bl
je 0x436917
lea eax, [ebp - 0x20]
push 2
push eax
lea ecx, [ebp + 8]
call fcn.004d6dd8
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 9
call fcn.004e1f6e
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.004e1e27
lea ecx, [ebp + 8]
lea edx, [ebp - 0x20]
push ecx
push 0x5762b0
push edx
call fcn.004e2066
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xa
call fcn.004e1f6e
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.004e1e27
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.004bdb15
add esp, 8
cmp eax, esi
jne 0x436932
mov dword [ebp - 0x2c], 1
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push edx
call fcn.004e1f6e
push 0x55c784
lea ecx, [ebp - 0x14]
call fcn.004e2218
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x340]
push eax
push ecx
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x88], eax
mov edi, dword [edx + 0x5dc]
dec edi
neg edi
sbb edi, edi
and edi, 2
add edi, 0x10
cmp eax, 0xffffffff
je 0x436b08
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push ecx
mov dword [ebp - 0x18], eax
call fcn.004ad640
add esp, 4
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x340]
test edi, eax
jne 0x436a67
lea edx, [ebp - 0x314]
lea ecx, [ebp - 0x1c]
push edx
call fcn.004e1fbe
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push eax
call fcn.004e1f6e
lea ecx, [ebp - 0x6c]
push 4
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004d6e91
mov edx, dword [eax]
push 0x55c7ec
push edx
call fcn.004bda36
add esp, 8
cmp eax, esi
lea ecx, [ebp - 0x6c]
sete bl
call fcn.004e1e27
test bl, bl
je 0x436a30
mov ecx, dword [ebp - 0x60]
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x30]
push eax
push ecx
lea ecx, [ebp - 0x68]
call fcn.004db676
mov esi, dword [ebp - 0x3c]
push 0xffffffffffffffff
lea ecx, [ebp - 0x44]
lea edx, [esi + 1]
push edx
call fcn.00411ba0
mov eax, dword [ebp - 0x40]
mov dword [eax + esi*4], ebx
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
inc edx
inc ecx
mov dword [ebp - 0x18], edx
mov dword [eax], ecx
xor esi, esi
jmp 0x436ad2
lea ecx, [ebp - 0x84]
push 4
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004d6e91
mov edx, dword [eax]
push 0x55c7b4
push edx
call fcn.004bdb15
add esp, 8
cmp eax, esi
lea ecx, [ebp - 0x84]
sete bl
call fcn.004e1e27
test bl, bl
je 0x436ad2
jmp 0x4369f0
test al, 0x10
je 0x436ad2
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x5dc], 1
je 0x436a7b
test al, 2
jne 0x436ad2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [ebp - 0x314]
push 0x55c780
push edx
call ebx
test eax, eax
je 0x436ad2
lea eax, [ebp - 0x314]
push 0x55c778
push eax
call ebx
test eax, eax
je 0x436ad2
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x314]
push ecx
push edx
call fcn.004bdb15
add esp, 8
cmp eax, esi
je 0x436ad2
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x314]
push eax
push ecx
lea ecx, [ebp - 0x80]
call fcn.004db64a
inc dword [ebp - 0x20]
mov ebx, dword [ebp - 0x88]
lea edx, [ebp - 0x340]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x436998
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.004e1e27
mov eax, dword [0x56b44c]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], esi
lea ecx, [ebp - 0x14]
mov bl, 0xc
push ecx
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004487e0
cmp eax, esi
je 0x436c8d
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx - 8]
mov edx, dword [ecx - 8]
cmp eax, edx
jle 0x436b72
mov eax, edx
lea ecx, [ebp - 0x24]
inc eax
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004d6dd8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xd
call fcn.004e1f6e
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], bl
call fcn.004e1e27
jmp 0x436b7f
push 0x5705d0
lea ecx, [ebp - 0x14]
call fcn.004e1fbe
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.004724e0
cmp eax, esi
je 0x436c8d
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp - 0x98]
jge 0x436c90
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
mov eax, dword [edx + eax*4]
shl eax, 5
mov edx, dword [eax + ecx + 0x18]
lea ecx, [ebp - 0x1c]
push edx
call fcn.004e1fe5
mov edi, dword [ebp - 0x2c]
xor esi, esi
mov dword [ebp + 0x1c], esi
cmp esi, dword [ebp - 0x60]
jge 0x436c2d
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x436c2d
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x1c]
push eax
mov edx, dword [ecx + esi*4]
push edx
call fcn.004bda36
add esp, 8
test eax, eax
jne 0x436c2a
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x64]
push ecx
mov ecx, dword [edx + esi*4]
mov edx, dword [ebp + 0x18]
mov eax, dword [eax + esi*4]
push ecx
mov ecx, dword [ebp - 0x24]
push ebx
push edi
push edx
push ecx
mov ecx, dword [ebp - 0x28]
push eax
mov dword [ebp + 0x1c], 1
call fcn.0044eb30
mov edx, dword [ebp - 0x64]
lea ecx, [edx + esi*4]
call fcn.004e1daf
inc esi
jmp 0x436bd1
xor esi, esi
cmp esi, dword [ebp - 0x78]
jge 0x436c81
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x436c81
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x1c]
push eax
mov edx, dword [ecx + esi*4]
push edx
call fcn.004bda36
add esp, 8
test eax, eax
jne 0x436c7e
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 0x18]
mov eax, dword [eax + esi*4]
push edx
mov edx, dword [ebp - 0x24]
push ebx
push edi
push ecx
mov ecx, dword [ebp - 0x28]
push edx
push eax
call fcn.0044e610
mov eax, dword [ebp - 0x7c]
lea ecx, [eax + esi*4]
call fcn.004e1daf
inc esi
jmp 0x436c2f
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
jmp 0x436b9e
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x20]
xor edi, edi
cmp edi, dword [ebp - 0x78]
jge 0x436cc5
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ecx + edi*4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x436cc2
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x18]
push esi
push edx
mov edx, dword [ebp + 0x18]
push ebx
push ecx
mov ecx, dword [ebp - 0x24]
push edx
push ecx
mov ecx, dword [ebp - 0x28]
push eax
call fcn.0044e610
inc edi
jmp 0x436c95
mov edi, dword [ebp - 0x28]
xor esi, esi
cmp esi, dword [ebp - 0x60]
jge 0x436cff
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x436cfc
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 0x40]
push ecx
mov ecx, dword [edx + esi*4]
mov edx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0x18]
push ebx
push edx
mov edx, dword [ebp - 0x24]
push ecx
push edx
push eax
mov ecx, edi
call fcn.0044eb30
inc esi
jmp 0x436cca
mov eax, dword [0x57616c]
test eax, eax
jne 0x436d12
push 2
push ebx
mov ecx, edi
call fcn.00444370
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x436df8
mov eax, dword [ebp + 0x20]
cmp dword [eax], 2
je 0x436df8
mov edx, dword [edi + 0x1494]
lea ecx, [edi + 0x1494]
lea eax, [ebp - 0x54]
push eax
push 0
call dword [edx + 0xe0]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
sub eax, edx
mov dword [ebp - 0xf0], 0x50
cmp eax, 0x16
mov dword [ebp - 0xec], 0x320
mov dword [ebp - 0xbc], 0x8062
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0x16
jl 0x436d86
mov dword [ebp - 0xc8], eax
mov ecx, dword [edi + 0x14b0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x418
push ecx
call esi
test eax, eax
jle 0x436dc1
lea edx, [ebp - 0x54]
dec eax
push edx
push eax
mov eax, dword [edi + 0x14b0]
push 0x41d
push eax
call esi
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0xac], ecx
jmp 0x436dcb
mov dword [ebp - 0xac], 2
mov edx, dword [edi + 0xda8]
push 0
push 0x8062
push 0x410
push edx
call esi
mov edx, dword [edi + 0xda8]
lea ecx, [ebp - 0xf0]
push ecx
push eax
push 0x40b
push edx
call esi
jmp 0x436dfe
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x436ed0
mov eax, dword [edi + 0x1530]
lea ecx, [edi + 0x1530]
lea edx, [ebp - 0x54]
push edx
push 0
call dword [eax + 0xe0]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
sub eax, edx
mov dword [ebp - 0xf0], 0x50
cmp eax, 0x16
mov dword [ebp - 0xec], 0x320
mov dword [ebp - 0xbc], 0x80b9
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0x16
jl 0x436e66
mov dword [ebp - 0xc8], eax
mov eax, dword [edi + 0x154c]
push 0
push 0
push 0x418
push eax
call esi
test eax, eax
jle 0x436e9b
mov edx, dword [edi + 0x154c]
lea ecx, [ebp - 0x54]
dec eax
push ecx
push eax
push 0x41d
push edx
call esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xac], eax
jmp 0x436ea5
mov dword [ebp - 0xac], 2
mov ecx, dword [edi + 0xda8]
push 0
push 0x80b9
push 0x410
push ecx
call esi
lea edx, [ebp - 0xf0]
push edx
push eax
mov eax, dword [edi + 0xda8]
push 0x40b
push eax
call esi
mov eax, dword [ebp - 0x94]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x436efb
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x4118f0
push ecx
push 0x20
push eax
call fcn.004be265
push esi
call fcn.004e2519
add esp, 4
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x436f0e
push eax
call fcn.004e2519
add esp, 4
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 8
call fcn.004e1e27
lea ecx, [ebp + 8]
mov byte [ebp - 4], 7
call fcn.004e1e27
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.004db3d4
mov dword [ebp - 0x44], 0x51af4c
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x10
test eax, eax
je 0x436f5a
push eax
call fcn.004e2519
add esp, 4
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.004db3d4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004e1e27
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004e1e27
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.004e1e27
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004e1e27
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c