Function at 0x414cb0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa4
mov eax, dword [0x5052a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
push edi
mov dword [ebp - 0xa64], ecx
push 0x4dd89c
lea ecx, [ebp - 8]
call fcn.00403da0
xor eax, eax
mov word [ebp - 0x810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call fcn.0043ef50
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xa68], edx
lea eax, [ebp - 0x810]
mov dword [ebp - 0xa6c], eax
mov ecx, dword [ebp - 0xa6c]
mov dword [ebp - 0xa70], ecx
mov edx, dword [ebp - 0xa68]
mov ax, word [edx]
mov word [ebp - 0xa72], ax
mov ecx, dword [ebp - 0xa6c]
mov dx, word [ebp - 0xa72]
mov word [ecx], dx
mov eax, dword [ebp - 0xa68]
add eax, 2
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa6c]
add ecx, 2
mov dword [ebp - 0xa6c], ecx
cmp word [ebp - 0xa72], 0
jne 0x414d17
lea edx, [ebp - 0x810]
add edx, 0xfffffffe
mov dword [ebp - 0xa78], edx
mov eax, dword [ebp - 0xa78]
mov cx, word [eax + 2]
mov word [ebp - 0xa7a], cx
add dword [ebp - 0xa78], 2
cmp word [ebp - 0xa7a], 0
jne 0x414d6e
mov edi, dword [ebp - 0xa78]
mov edx, dword [str..]
mov dword [edi], edx
mov eax, dword [0x4dd8a8]
mov dword [edi + 4], eax
mov cx, word [0x4dd8ac]
mov word [edi + 8], cx
lea edx, [ebp - 0xa60]
push edx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x414df7
push 0x4dd8b0
call fcn.00437af7
add esp, 4
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404bd0
lea ecx, [ebp - 8]
call fcn.00403e20
mov eax, dword [ebp + 8]
jmp 0x414f8b
mov dword [ebp - 0xa80], 0x4dd8bc
lea edx, [ebp - 0xa34]
mov dword [ebp - 0xa84], edx
mov eax, dword [ebp - 0xa84]
mov cx, word [eax]
mov word [ebp - 0xa86], cx
mov edx, dword [ebp - 0xa80]
cmp cx, word [edx]
jne 0x414e73
cmp word [ebp - 0xa86], 0
je 0x414e67
mov eax, dword [ebp - 0xa84]
mov cx, word [eax + 2]
mov word [ebp - 0xa88], cx
mov edx, dword [ebp - 0xa80]
cmp cx, word [edx + 2]
jne 0x414e73
add dword [ebp - 0xa84], 4
add dword [ebp - 0xa80], 4
cmp word [ebp - 0xa88], 0
jne 0x414e0d
mov dword [ebp - 0xa8c], 0
jmp 0x414e7e
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0xa8c], eax
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp - 0xa90], ecx
cmp dword [ebp - 0xa90], 0
je 0x414f33
mov dword [ebp - 0xa94], 0x4dd8c0
lea edx, [ebp - 0xa34]
mov dword [ebp - 0xa98], edx
mov eax, dword [ebp - 0xa98]
mov cx, word [eax]
mov word [ebp - 0xa9a], cx
mov edx, dword [ebp - 0xa94]
cmp cx, word [edx]
jne 0x414f13
cmp word [ebp - 0xa9a], 0
je 0x414f07
mov eax, dword [ebp - 0xa98]
mov cx, word [eax + 2]
mov word [ebp - 0xa9c], cx
mov edx, dword [ebp - 0xa94]
cmp cx, word [edx + 2]
jne 0x414f13
add dword [ebp - 0xa98], 4
add dword [ebp - 0xa94], 4
cmp word [ebp - 0xa9c], 0
jne 0x414ead
mov dword [ebp - 0xaa0], 0
jmp 0x414f1e
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0xaa4], ecx
cmp dword [ebp - 0xaa4], 0
jne 0x414f35
jmp 0x414f51
mov edx, dword [ebp - 0xa60]
and edx, 0x10
je 0x414f51
lea eax, [ebp - 0xa34]
push eax
lea ecx, [ebp - 8]
call fcn.00403e40
jmp 0x414f6a
lea ecx, [ebp - 0xa60]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414df7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404bd0
lea ecx, [ebp - 8]
call fcn.00403e20
mov eax, dword [ebp + 8]
pop edi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00434ee7
mov esp, ebp
pop ebp
ret 8