Function at 0x403391
Capabilities:
Enumerate files on windows
Get session user name
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push ebx
push esi
push edi
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ebx, dword [ebp + 8]
mov dword [0x42397c], eax
push ebx
call fcn.0040121c
cmp dword [0x423800], 0
pop ecx
je 0x4033d5
push 0x424300
push 0x41a
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x41c038], 0
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
push 1
pop edi
je 0x4033f0
push edi
push 0x3f2
push ebx
call esi
cmp dword [0x41c03c], 0
je 0x403402
push edi
push 0x3fc
push ebx
call esi
cmp dword [0x4240ac], 0
push edi
je 0x403413
push 0x410
jmp 0x403418
push 0x424
push ebx
call esi
xor edi, edi
cmp dword [0x4240a4], edi
jne 0x403469
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0x406
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x410
push ebx
call esi
push eax
call edi
push 0
push 0x41a
push ebx
call esi
push eax
call edi
push 0
push 0x424
push ebx
call esi
push eax
call edi
jmp 0x4035c7
push ebx
call fcn.00403311
and byte [ebp - 0x24c], 0
pop ecx
call fcn.00403e1f
test eax, eax
je 0x4034a1
lea eax, [ebp - 8]
push eax
push 0x10
push ebx
call dword [0x420b48]
cmp eax, edi
jl 0x4034a1
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 8]
call dword [0x420b54]
cmp byte [ebp - 0x24c], 0
je 0x4035c7
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
lea eax, [ebp - 0x34f]
push eax
mov byte [ebp - 0x350], 0x5c
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, 0x103
lea eax, [ebp - 0x350]
push esi
push 0x41c534
push eax
call fcn.0040c6bc
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00413290
add esp, 0x14
cmp eax, edi
je 0x4035c7
and byte [eax + 1], 0
push esi
lea eax, [ebp - 0x24c]
push 0x41c530
push eax
call fcn.0040c6bc
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4035c7
test byte [ebp - 0x148], 0x10
je 0x4035aa
test byte [ebp - 0x148], 2
jne 0x4035aa
lea eax, [ebp - 0x11c]
push 0x41c52c
push eax
call fcn.00413a30
pop ecx
test eax, eax
pop ecx
je 0x4035aa
lea eax, [ebp - 0x11c]
push 0x41c528
push eax
call fcn.00413a30
pop ecx
test eax, eax
pop ecx
je 0x4035aa
lea eax, [ebp - 0x11c]
push str.All_Users
push eax
call fcn.00413a30
pop ecx
test eax, eax
pop ecx
je 0x4035aa
lea eax, [ebp - 0x11c]
push eax
push edi
push 0x143
push 0x41a
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40353a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xc8
push 0x3e8
push ebx
call fcn.0040a9ea
push 0xc9
push 0x3f2
push ebx
call fcn.0040a9ea
push 0xca
push 0x3fc
push ebx
call fcn.0040a9ea
push 0xcb
push 0x406
push ebx
call fcn.0040a9ea
push 0xcc
push 0x410
push ebx
call fcn.0040a9ea
push 0xcd
push 0x424
push ebx
call fcn.0040a9ea
add esp, 0x48
push ebx
call fcn.00401287
pop ecx
pop edi
pop esi
pop ebx
leave
ret