Function at 0x41ad98
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword fs:[0x30]
xor ecx, ecx
push ebx
push esi
push edi
push 0x6a
push ecx
mov dword [esp + 0x20], ecx
push dword [eax + 0x18]
mov dword [esp + 0x28], ecx
mov byte [esp + 0x1b], cl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x41ade6
mov esi, 0xc0000017
jmp 0x41b05d
lea edx, [esp + 0x14]
lea ecx, [esp + 0x28]
call fcn.0041aa4a
test eax, eax
jns 0x41afed
push 0x40682c
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x30]
mov dword [esp + 0x38], 0x18
mov dword [esp + 0x40], eax
xor ecx, ecx
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], ecx
push eax
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x4c], 0x40
push eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
call dword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
mov esi, eax
test esi, esi
js 0x41b00f
mov eax, 0x1000
push eax
mov esi, eax
mov dword [esp + 0x24], eax
xor eax, eax
push eax
jmp 0x41aea6
xor ecx, ecx
lea eax, [esp + 0x2c]
push ecx
push eax
push 1
push ecx
push esi
push edi
push dword [esp + 0x30]
mov dword [esp + 0x48], ecx
call dword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov esi, eax
cmp esi, 0x105
jne 0x41aec9
mov eax, dword fs:[0x30]
push edi
xor edi, edi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x20]
add esi, 0x1000
push esi
mov dword [esp + 0x24], esi
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x41ae5e
mov esi, 0xc0000017
jmp 0x41b00f
test esi, esi
jns 0x41aede
cmp esi, 0x8000001a
je 0x41aede
mov edi, dword [esp + 0x10]
jmp 0x41afba
xor eax, eax
mov esi, edi
cmp word [edi], ax
je 0x41afe6
mov edi, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041ad10
test al, al
je 0x41afa3
xor eax, eax
push eax
push dword [esi + 4]
push 0x40683c
push 0x6a
push ebx
call fcn.0041748f
add esp, 0x14
test edi, edi
je 0x41af33
mov eax, dword fs:[0x30]
push edi
xor edi, edi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esp + 0x10], edi
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.0041a620
mov edi, dword [esp + 0x10]
test eax, eax
js 0x41afa3
xor eax, eax
cmp dword [edi], 1
jne 0x41afa5
mov dword [esp + 0x20], eax
cmp dword [edi + 4], eax
jbe 0x41afa5
lea edx, [edi + 0x48]
mov ecx, eax
mov eax, dword [edx + ecx*4 + 8]
mov edi, 0x4062a0
cmp eax, dword [edi + ecx*4]
mov edi, dword [esp + 0x10]
jne 0x41af8c
inc ecx
cmp ecx, 4
jne 0x41af5b
cmp byte [esp + 0xf], 0
jne 0x41afd2
mov eax, dword [esi + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edx]
mov byte [esp + 0xf], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add edx, 0x90
inc eax
cmp eax, dword [edi + 4]
push 0
mov dword [esp + 0x24], eax
pop eax
jb 0x41af59
xor eax, eax
add esi, 0x10
cmp word [esi], ax
jne 0x41aeef
cmp byte [esp + 0xf], 0
je 0x41afe6
xor esi, esi
test esi, esi
js 0x41b00f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41aff1
push dword [esp + 0x14]
push eax
push 0x40683c
jmp 0x41affe
mov ecx, ebx
call fcn.0041aad1
mov esi, eax
test esi, esi
jns 0x41b028
mov esi, 0xc0000451
jmp 0x41b00f
mov esi, 0xc0000452
jmp 0x41b00f
mov edi, dword [esp + 0x10]
push dword [esp + 0x14]
push dword [esp + 0x2c]
push 0x406628
push 0x6a
push ebx
call fcn.0041748f
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x41b028
mov eax, dword fs:[0x30]
push ebx
xor ebx, ebx
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [esp + 0x10]
jmp 0x41b02f
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor ebx, ebx
test edi, edi
je 0x41b044
mov eax, dword fs:[0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41b05d
push eax
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [esp + 0x18], 0
je 0x41b06e
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4