Function at 0x408990
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp byte [esi + 4], 0
jne 0x4089f9
cmp byte [esi + 5], 0
je 0x4089be
mov eax, dword [esi + 0x3ef]
push eax
call sub.KERNEL32.dll_FindClose
mov byte [esi + 5], 0
cmp byte [esi + 7], 0
jne 0x4089cb
xor eax, eax
jmp 0x408b9f
lea edx, [ebp - 0x148]
push edx
lea ecx, [esi + 7]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [esi + 0x3ef], edi
cmp edi, 0xffffffff
jne 0x4089ef
xor eax, eax
jmp 0x408b9f
mov dl, 1
mov byte [esi + 5], dl
mov byte [esi + 4], dl
jmp 0x408a2b
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [esi + 0x3ef]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x408a2b
mov eax, dword [esi + 0x3ef]
push eax
call sub.KERNEL32.dll_FindClose
xor edx, edx
mov byte [esi + 5], dl
mov byte [esi + 4], dl
xor eax, eax
jmp 0x408b9f
xor ecx, ecx
mov dword [ebx], ecx
test byte [ebp - 0x148], 0x10
je 0x408a3b
or dword [ebx], 1
test byte [ebp - 0x148], 2
je 0x408a47
or dword [ebx], 8
test byte [ebp - 0x148], 1
je 0x408a53
or dword [ebx], 4
test byte [ebp - 0x148], 4
je 0x408a5f
or dword [ebx], 2
xor eax, eax
xor edx, edx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x1c], edx
lea eax, [ebp - 8]
lea ecx, [ebp - 0x144]
push eax
push ecx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
test eax, eax
je 0x408af9
lea eax, [ebp - 0x158]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToSystemTime
test eax, eax
je 0x408af9
movzx eax, word [ebp - 0x158]
mov dword [ebx + 0x18], eax
cmp eax, 0x641
jne 0x408ac7
mov dword [ebx + 0x18], 0x7bc
movzx edx, word [ebp - 0x156]
mov dword [ebx + 0x14], edx
movzx ecx, word [ebp - 0x152]
mov dword [ebx + 0x10], ecx
movzx eax, word [ebp - 0x150]
mov dword [ebx + 0xc], eax
movzx edx, word [ebp - 0x14e]
mov dword [ebx + 8], edx
movzx ecx, word [ebp - 0x14c]
mov dword [ebx + 4], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
test eax, eax
je 0x408b6b
lea ecx, [ebp - 0x158]
push ecx
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_FileTimeToSystemTime
test eax, eax
je 0x408b6b
movzx eax, word [ebp - 0x158]
mov dword [ebx + 0x30], eax
cmp eax, 0x641
jne 0x408b39
mov dword [ebx + 0x30], 0x7bc
movzx edx, word [ebp - 0x156]
mov dword [ebx + 0x2c], edx
movzx ecx, word [ebp - 0x152]
mov dword [ebx + 0x28], ecx
movzx eax, word [ebp - 0x150]
mov dword [ebx + 0x24], eax
movzx edx, word [ebp - 0x14e]
mov dword [ebx + 0x20], edx
movzx ecx, word [ebp - 0x14c]
mov dword [ebx + 0x1c], ecx
push 0xc8
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebx + 0x38]
push edx
call fcn.004989f4
mov byte [ebx + 0xff], 0
mov ecx, dword [ebp - 0x12c]
add esp, 0xc
mov eax, ecx
neg ecx
add ecx, dword [ebp - 0x128]
mov al, 1
mov dword [ebx + 0x34], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret