Function at 0x405010
Capabilities:
Enumerate files on windows

Disassembly:
push 8
push 0x320
mov eax, 0x42c768
call fcn.0042c0e6
mov eax, ecx
mov dword [ebp - 0x2fc], eax
lea edi, [eax + 0x1c]
mov dword [ebp - 0x30c], eax
xor ecx, ecx
mov dword [ebp - 0x2f4], edi
mov dword [ebp - 0x300], ecx
mov ecx, edi
mov esi, dword [edi]
mov dword [ebp - 0x308], edi
push dword [esi + 4]
push edi
call fcn.004022ac
xor eax, eax
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2ec]
push eax
push str..dll
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x304], 0x20c
cmp eax, 0xffffffff
je 0x4053e8
lea edx, [ebp - 0x2c0]
mov edi, edx
mov dword [ebp - 0x314], edx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4050b5
mov esi, dword [0x43cc70]
sub edi, ecx
mov dword [ebp - 0x310], edi
cmp esi, dword [0x43cc74]
je 0x405123
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4050dc
mov eax, dword [esi]
cmp edi, dword [esi + 0x10]
jne 0x4050f6
push edi
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.0040e65d
add esp, 0xc
test eax, eax
je 0x405101
add esi, 0x18
cmp esi, dword [0x43cc74]
jne 0x4050d2
lea edx, [ebp - 0x2c0]
cmp esi, dword [0x43cc74]
je 0x405123
push edx
push edi
push str.SyringeDebugger::FindDLLs:_Ignoring_DLL:___.s_
call fcn.00401253
add esp, 0xc
jmp 0x4053a2
push edi
push edx
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 2
call fcn.00403105
mov byte [ebp - 4], 3
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
push 0x20
call fcn.0040cc03
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
or dword [ebp - 0x24], 0xffffffff
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], eax
push ecx
push ecx
mov eax, esp
mov byte [ebp - 4], 4
push 8
pop esi
lea ecx, [ebp - 0x1a8]
mov dword [eax], str..syhks00
mov dword [eax + 4], esi
call fcn.0040289c
test eax, eax
je 0x405329
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00405867
test al, al
je 0x405329
lea eax, [ebp - 0x2c0]
push eax
push edi
push str.SyringeDebugger::FindDLLs:_Recognized_DLL:___.s_
call fcn.00401253
pop ecx
mov eax, esp
lea ecx, [ebp - 0x1a8]
mov dword [eax], str..syhks01
mov dword [eax + 4], esi
call fcn.0040289c
test eax, eax
je 0x4051ff
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x320]
push ecx
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004059e3
test al, al
je 0x4051ff
lea eax, [ebp - 0x2c0]
push eax
push edi
push str.SyringeDebugger::FindDLLs:_Found_Override_Hook_Section_:___.s_
call fcn.00401253
add esp, 0xc
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x1a8]
cmp dword [ebp - 0x194], 0xf
not eax
push eax
push dword [ebp - 0x20]
cmova ecx, dword [ebp - 0x1a8]
push ecx
push ecx
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx], ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405225
sub ecx, esi
mov esi, dword [ebp - 0x2fc]
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00405c99
test al, al
jne 0x405279
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 0x1a8]
mov dword [eax], str..syexe00
mov dword [eax + 4], 8
call fcn.0040289c
test eax, eax
je 0x405279
push eax
lea eax, [ebp - 0x1a8]
mov ecx, esi
push eax
call fcn.00405775
test al, al
je 0x405329
mov esi, dword [ebp - 0x2c]
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
jne 0x405344
mov ecx, dword [ebp - 0x2f4]
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.00409468
lea ecx, [ebp - 0x328]
mov edi, dword [eax]
mov eax, dword [edi + 0x24]
and dword [edi + 0x24], 0
mov dword [ebp - 0x328], eax
mov eax, dword [edi + 0x28]
and dword [edi + 0x28], 0
mov dword [ebp - 0x324], eax
call fcn.004012de
mov byte [edi + 0x14], 0
lea ecx, [edi + 0x18]
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
cdq
idiv dword [ebp - 0x304]
push eax
push dword [esi + 0x14]
push dword [edi + 0x1c]
call fcn.0040a47f
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x40530a
mov eax, dword [esi + 4]
jmp 0x4052fd
cmp esi, dword [eax + 8]
jne 0x405303
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4052f3
mov esi, eax
jmp 0x40527e
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x40527e
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x405318
jmp 0x40527e
cmp dword [ebp - 0x28], 0
je 0x405344
lea eax, [ebp - 0x2c0]
push eax
push edi
push str.SyringeDebugger::FindDLLs:_DLL_load_was_prevented:___.s_
call fcn.00401253
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.004075d9
lea ecx, [ebp - 0x1a8]
call fcn.00404f3b
mov dword [ebp - 4], 1
jmp 0x4053a2
mov eax, dword [ebp - 0x2f0]
cmp eax, 0xffffffff
je 0x4053e8
lea ecx, [ebp - 0x2ec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053dd
mov ecx, dword [ebp - 0x2f0]
or eax, 0xffffffff
mov dword [ebp - 0x2f0], eax
cmp ecx, eax
je 0x40509b
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x2f0]
jmp 0x40509b
mov edi, dword [ebp - 0x2fc]
mov byte [ebp - 4], 0
mov eax, dword [edi + 0x24]
cmp eax, dword [edi + 0x28]
je 0x4053fd
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0x308]
lea edx, [ebp - 0x320]
call fcn.0040562f
mov eax, dword [ebp - 0x2f4]
mov esi, dword [eax]
mov esi, dword [esi]
mov dword [ebp - 0x308], esi
jmp 0x4055d2
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2f8], ecx
cmp eax, ecx
je 0x405590
mov esi, eax
lea eax, [esi + 0x104]
mov dword [ebp - 0x2f4], eax
mov edi, dword [esi]
push ecx
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 6
call fcn.004063a0
push edi
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 7
call fcn.004064b0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xd8]
call fcn.00408259
mov ecx, dword [ebp - 0x300]
or ecx, 3
mov dword [ebp - 0x300], ecx
lea ecx, [ebp - 0x88]
call fcn.00406371
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 8
push eax
mov dword [ebp - 0x88], 0x437818
call fcn.0040c24d
pop ecx
mov ecx, dword [ebp - 0x2f4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x24]
inc eax
lea edx, [ecx + 0x104]
mov dword [ebp - 0x310], edx
lea edi, [ecx - 0x100]
cmp eax, 8
je 0x4054f5
push dword [edx]
push ecx
push dword [esi]
push edi
push str.SyringeDebugger::FindDLLs:_Found_Hook_with_less_or_more_than_8_characters___it_maybe_invalid_one___s__0x_x____s____d_.
call fcn.00401253
mov ecx, dword [ebp - 0x2f4]
add esp, 0x14
mov edx, dword [ebp - 0x310]
cmp dword [edx], 0
jne 0x405507
push 0
push ecx
push dword [esi]
push edi
push str.SyringeDebugger::FindDLLs:_Found_Hook_with_0_num_overriden___it_maybe_better_to_explicitly_put_the_correct_num_overriden___s__0x_x____s____d_.
jmp 0x405529
cmp dword [edx], 5
jae 0x405519
push dword [edx]
push ecx
push dword [esi]
push edi
push str.SyringeDebugger::FindDLLs:_Found_Hook_with_less_than_5_bytes_num_overriden___it_maybe_better_to_move_the_hook_location_if_possible___s__0x_x____s____d_.
jmp 0x405529
cmp dword [edx], 0xa
jbe 0x405531
push dword [edx]
push ecx
push dword [esi]
push edi
push str.SyringeDebugger::FindDLLs:_Found_Hook_with_num_overriden_more_than_10___s__0x_x____s____d_.
call fcn.00401253
add esp, 0x14
mov edi, dword [ebp - 0x2fc]
mov dword [ebp - 0x310], esi
mov eax, dword [edi + 0x28]
cmp eax, dword [edi + 0x2c]
je 0x40554d
mov dword [eax], esi
add dword [edi + 0x28], 4
jmp 0x40555d
lea ecx, [ebp - 0x310]
push ecx
push eax
lea ecx, [edi + 0x24]
call fcn.0040a709
and dword [ebp - 0x300], 0xfffffffe
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.00401ec6
mov ecx, dword [ebp - 0x304]
add esi, ecx
add dword [ebp - 0x2f4], ecx
cmp esi, dword [ebp - 0x2f8]
jne 0x40544b
mov esi, dword [ebp - 0x30c]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
sub eax, ecx
cdq
idiv dword [ebp - 0x304]
cmp eax, 1
jbe 0x4055c1
push eax
push dword [ecx + 0x208]
lea eax, [ecx + 0x104]
push eax
push dword [ecx]
push str.SyringeDebugger::FindDLLs:_0x_x____s____d__Is_Hooked_by__d_function__.
call fcn.00401253
add esp, 0x14
lea ecx, [ebp - 0x308]
call fcn.004085cb
mov esi, dword [ebp - 0x308]
cmp byte [esi + 0xd], 0
mov dword [ebp - 0x30c], esi
je 0x405423
mov ecx, dword [ebp - 0x2fc]
mov eax, dword [ecx + 0x28]
sub eax, dword [ecx + 0x24]
sar eax, 2
push eax
push str.SyringeDebugger::FindDLLs:_Done___d_hooks_added_.
call fcn.00401253
pop ecx
pop ecx
call fcn.0040123c
lea ecx, [ebp - 0x320]
call fcn.00402382
mov ecx, dword [ebp - 0x1c]
call fcn.0042c057
ret