Function at 0x41cfb0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
sub esp, 0x4b4
mov eax, dword [0x7fa2d0]
xor eax, esp
mov dword [esp + 0x4ac], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x24c
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x2c], ebx
call fcn.0045d280
push 0x206
lea edx, [esp + 0x2c2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x2c8], cx
call fcn.0045d280
push 0x208
call fcn.00422c15
mov esi, eax
push 0x208
mov dword [esp + 0x3c], esi
call fcn.00422c15
mov edi, eax
push 0x208
mov dword [esp + 0x38], edi
call fcn.00422c15
push 0x208
push ebx
push esi
mov ebp, eax
call fcn.0045d280
push 0x208
push ebx
push edi
call fcn.0045d280
push 0x208
push ebx
push ebp
call fcn.0045d280
mov eax, dword [0x809550]
mov edi, dword [0x809554]
mov esi, dword [0x809548]
add esp, 0x48
lea ecx, [esp + 0x274]
push ecx
mov dword [esp + 0x288], 0x65474853
mov dword [esp + 0x28c], 0x6c6f4674
mov dword [esp + 0x290], 0x50726564
mov dword [esp + 0x294], 0x57687461
mov word [esp + 0x298], bx
mov dword [esp + 0x278], 0x4c454853
mov dword [esp + 0x27c], 0x2e32334c
mov dword [esp + 0x280], 0x4c4c44
mov byte [esp + 0x284], bl
call eax
cmp eax, ebx
jne 0x41d0db
lea edx, [esp + 0x274]
push edx
call esi
cmp eax, ebx
jne 0x41d0db
xor eax, eax
jmp 0x41d0e6
lea ecx, [esp + 0x284]
push ecx
push eax
call edi
lea edx, [esp + 0x2b0]
push edx
push ebx
push ebx
push 0x23
push ebx
call eax
push 0x208
lea eax, [esp + 0x2b4]
push ebx
push eax
call fcn.0045d280
lea eax, [esp + 0x2bc]
mov esi, 0x801768
mov ecx, eax
add esp, 0xc
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41d13e
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x41d13e
mov word [eax], cx
add eax, 2
dec edx
jne 0x41d120
jmp 0x41d142
cmp edx, ebx
jne 0x41d145
sub eax, 2
mov edi, dword [esp + 0x14]
xor edx, edx
mov word [eax], dx
lea esi, [esp + 0x2b0]
mov edx, 0x104
mov eax, edi
sub esi, edi
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41d17e
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x41d17e
mov word [eax], cx
add eax, 2
dec edx
jne 0x41d160
jmp 0x41d182
cmp edx, ebx
jne 0x41d185
sub eax, 2
xor edx, edx
mov word [eax], dx
mov edx, 0x104
mov eax, edi
cmp word [eax], bx
je 0x41d19e
add eax, 2
dec edx
jne 0x41d191
jmp 0x41d1c2
cmp edx, ebx
je 0x41d1c2
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x7cb088
lea ecx, [edi + ecx*2]
mov edx, SysReAllocString
call fcn.00419020
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
push 0x208
push ebx
push ebp
call fcn.0045d280
mov eax, dword [0x809550]
mov edi, dword [0x809554]
mov esi, dword [0x809548]
add esp, 0xc
lea ecx, [esp + 0x274]
push ecx
mov dword [esp + 0x29c], 0x68746150
mov dword [esp + 0x2a0], 0x6f6d6552
mov dword [esp + 0x2a4], 0x69466576
mov dword [esp + 0x2a8], 0x7053656c
mov dword [esp + vtable.CArray_unsigned_long_int__unsigned_long_int_.0], 0x576365
mov byte [esp + 0x2b0], bl
mov dword [esp + 0x278], 0x574c4853
mov dword [esp + 0x27c], 0x2e495041
mov dword [esp + 0x280], 0x4c4c44
mov byte [esp + 0x284], bl
call eax
cmp eax, ebx
jne 0x41d278
lea edx, [esp + 0x274]
push edx
call esi
cmp eax, ebx
jne 0x41d278
xor eax, eax
jmp 0x41d283
lea ecx, [esp + 0x298]
push ecx
push eax
call edi
test byte [esp + 0x20], 0x10
je 0x41d39f
lea edi, [esp + 0x2b0]
mov esi, 0x104
mov ecx, ebp
sub edi, ebp
mov edi, edi
lea edx, [esi + 0x7ffffefa]
test edx, edx
je 0x41d2be
movzx edx, word [edi + ecx]
cmp dx, bx
je 0x41d2be
mov word [ecx], dx
add ecx, 2
dec esi
jne 0x41d2a0
jmp 0x41d2c2
cmp esi, ebx
jne 0x41d2c5
sub ecx, 2
xor edx, edx
push ebp
mov word [ecx], dx
call eax
mov eax, 0x104
mov ecx, ebp
cmp word [ecx], bx
je 0x41d2e1
add ecx, 2
dec eax
jne 0x41d2d4
jmp 0x41d32e
cmp eax, ebx
je 0x41d32e
mov edx, 0x104
sub edx, eax
mov ecx, 0x104
sub ecx, edx
lea eax, [ebp + edx*2]
je 0x41d326
mov edi, 0x7cb08c
lea esi, [ecx + edx + 0x7ffffefb]
sub edi, eax
cmp esi, ebx
je 0x41d322
movzx edx, word [edi + eax]
cmp dx, bx
je 0x41d322
mov word [eax], dx
dec ecx
add eax, 2
dec esi
cmp ecx, ebx
jne 0x41d307
jmp 0x41d326
cmp ecx, ebx
jne 0x41d329
sub eax, 2
xor ecx, ecx
mov word [eax], cx
mov eax, 0x104
mov ecx, ebp
cmp word [ecx], bx
je 0x41d342
add ecx, 2
dec eax
jne 0x41d335
jmp 0x41d38e
cmp eax, ebx
je 0x41d38e
mov edx, 0x104
sub edx, eax
mov ecx, 0x104
sub ecx, edx
lea eax, [ebp + edx*2]
je 0x41d386
lea edi, [esp + 0x4c]
lea esi, [ecx + edx + 0x7ffffefb]
sub edi, eax
cmp esi, ebx
je 0x41d382
movzx edx, word [edi + eax]
cmp dx, bx
je 0x41d382
mov word [eax], dx
dec ecx
add eax, 2
dec esi
cmp ecx, ebx
jne 0x41d367
jmp 0x41d386
cmp ecx, ebx
jne 0x41d389
sub eax, 2
xor edx, edx
mov word [eax], dx
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d39f
push ebp
call fcn.0041d410
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41d1d2
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x41d3c7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045c241
mov eax, dword [esp + 0x18]
push eax
call fcn.0045c241
push ebp
call fcn.0045c241
mov ecx, dword [esp + 0x4c8]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0045a5ed
add esp, 0x4b4
ret