Function at 0x41eae8
Capabilities:
Enumerate files on windows
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402b60
push 0x45db24
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb7c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 4]
test edx, edx
jne 0x41eb1f
xor eax, eax
jmp 0x41eb27
mov eax, dword [ebx + 8]
sub eax, edx
sar eax, 2
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jge 0x41ec14
mov esi, ecx
shl esi, 2
cmp dword [esi + edx], 0
je 0x41ec14
mov edi, dword [esi + edx]
mov dword [ebp - 0x820], edi
cmp byte [edi], 0x2a
jne 0x41eb60
inc edi
push edi
mov ecx, 0x4776b0
call fcn.004193af
jmp 0x41ee20
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, dword [ebp - 0x820]
cmp byte [ecx + edi - 1], 0x5c
jne 0x41eda9
cmp dword [0x47531c], eax
je 0x41ebbd
push eax
push eax
push 0xbb
call fcn.00424eff
pop ecx
push eax
mov esi, 0x45fc60
mov ecx, esi
call fcn.00412078
push dword [0x5341b4]
mov ecx, esi
call fcn.004120e8
mov ebx, eax
mov ecx, esi
call fcn.004120d4
mov dword [0x47531c], eax
cmp ebx, 1
jne 0x41ec14
or dword [ebp - 0xa68], 0xffffffff
push 0x40aad4
push edi
push 0x40aa14
mov ebx, 0x104
push ebx
lea eax, [ebp - 0xa64]
push eax
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
call edi
add esp, 0x14
and byte [ebp - 0x961], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0xa64]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xa68], eax
cmp eax, 0xffffffff
jne 0x41ec25
or dword [ebp - 4], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
mov esi, 0x40aad0
lea eax, [ebp - 0x934]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41ec52
test cl, cl
je 0x41ec4e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41ec52
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x41ec30
xor eax, eax
jmp 0x41ec57
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ed54
mov esi, 0x40aacc
lea eax, [ebp - 0x934]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41ec8c
test cl, cl
je 0x41ec88
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41ec8c
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x41ec6a
xor eax, eax
jmp 0x41ec91
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ed54
test byte [ebp - 0x960], 0x10
jne 0x41ed54
lea eax, [ebp - 0x934]
push eax
push dword [ebp - 0x820]
push 0x40aa14
push ebx
lea eax, [ebp - 0xb70]
push eax
call edi
add esp, 0x14
and byte [ebp - 0xa6d], 0
lea eax, [ebp - 0xb70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x41ed54
and byte [ebp - 0x818], 0
lea eax, [ebp - 0xb70]
push eax
call fcn.00426f34
pop ecx
test eax, eax
lea eax, [ebp - 0xb70]
push eax
je 0x41ed1f
push 0x800
lea eax, [ebp - 0x818]
push eax
push 0x45fc38
push 0x40aa68
push 0x40aa54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x41ed44
call fcn.00426ed5
pop ecx
test eax, eax
je 0x41ed44
push 0x800
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0xb70]
push eax
call fcn.00427441
add esp, 0xc
push 1
lea eax, [ebp - 0x818]
push eax
call fcn.00420e9b
pop ecx
pop ecx
lea eax, [ebp - 0x960]
push eax
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ec25
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0xa68], 0xffffffff
or dword [ebp - 4], 0xffffffff
jmp 0x41ee20
cmp dword [esi + edx], 0
je 0x41ee20
and byte [ebp - 0x818], 0
push dword [esi + edx]
call fcn.00426f34
pop ecx
test eax, eax
mov eax, dword [ebx + 4]
push dword [esi + eax]
je 0x41edec
push 0x800
lea eax, [ebp - 0x818]
push eax
push 0x45fc38
push 0x40aa68
push 0x40aa54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x41ee10
call fcn.00426ed5
pop ecx
test eax, eax
je 0x41ee10
push 0x800
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ebx + 4]
push dword [esi + eax]
call fcn.00427441
add esp, 0xc
push 0
lea eax, [ebp - 0x818]
push eax
call fcn.00420e9b
pop ecx
pop ecx
push 1
pop eax
jmp 0x41ec16