Function at 0x416820
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x194]
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp + 0x10]
mov byte [ebp - 0x18c], dl
mov byte [ebp - 0x190], cl
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x188], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x184], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
mov eax, 1
lea edx, [ebp - 0x16c]
lea ecx, [ebp - 0x154]
call fcn.0040f240
call fcn.00410d60
push eax
test eax, eax
jne 0x416aa2
mov dword [ebp - 0x174], 0
lea eax, [ebp - 0x174]
push eax
mov edx, 0x447284
mov eax, dword [ebp - 0x184]
mov ecx, 1
call fcn.0040e360
mov eax, ebx
test ebx, ebx
je 0x4168cf
mov eax, dword [eax - 4]
mov al, byte [ebx + eax - 1]
cmp al, 0x2f
je 0x4168db
cmp al, 0x5c
jne 0x4168e7
mov edx, ebx
lea eax, [ebp - 4]
call fcn.0040af50
jmp 0x4168f8
push 0
mov ecx, 0x4472c4
mov edx, ebx
lea eax, [ebp - 4]
call fcn.0040b050
mov eax, esi
test esi, esi
je 0x416904
mov eax, dword [eax - 4]
add eax, 1
test eax, eax
jle 0x416921
mov edx, 0x4472d4
mov eax, dword [esi]
call fcn.0040b9c0
test eax, eax
jne 0x416921
mov byte [ebp - 0x194], 1
jmp 0x416928
mov byte [ebp - 0x194], 0
push 0x140
lea eax, [ebp - 0x148]
push eax
call fcn.00415270
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x178]
call fcn.004063e0
push 0
mov ecx, 0x4472d4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x178]
call fcn.0040b050
mov eax, dword [ebp - 0x178]
test eax, eax
jne 0x41696f
mov eax, 0x4523a0
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
test ebx, ebx
je 0x416a9c
nop
mov eax, dword [ebp - 0x148]
and eax, 2
seta al
test al, al
je 0x41699e
mov al, byte [ebp - 0x188]
test al, al
je 0x416a87
mov al, byte [ebp - 0x18c]
test al, al
je 0x4169da
push 0
push 1
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x11c]
mov cx, 0
mov edx, 0x103
call fcn.0040b910
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
call fcn.0040b050
jmp 0x416a05
push 1
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x11c]
mov cx, 0
mov edx, 0x103
call fcn.0040b910
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 8]
call fcn.0040af50
mov eax, dword [ebp - 0x148]
and eax, 0x10
seta al
test al, al
je 0x416a2f
mov al, byte [ebp - 0x190]
test al, al
je 0x416a87
mov eax, dword [ebp - 0x184]
mov edx, dword [ebp - 8]
call fcn.00415320
jmp 0x416a87
mov al, byte [ebp - 0x194]
test al, al
jne 0x416a79
lea eax, [ebp - 0x17c]
call fcn.004063e0
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 8]
call fcn.00416480
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 0x17c]
call fcn.0040af50
push esi
mov eax, dword [ebp - 0x17c]
call fcn.004153c0
cmp eax, 0xffffffff
setg al
test al, al
je 0x416a87
mov eax, dword [ebp - 0x184]
mov edx, dword [ebp - 8]
call fcn.00415320
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x416980
push ebx
call sub.kernel32.dll_FindClose
call fcn.0040f4c0
lea eax, [ebp - 0x180]
call fcn.004063e0
lea eax, [ebp - 0x17c]
call fcn.004063e0
lea eax, [ebp - 0x178]
call fcn.004063e0
lea eax, [ebp - 4]
call fcn.004063e0
lea eax, [ebp - 8]
call fcn.004063e0
pop eax
test eax, eax
je 0x416ae2
call fcn.0040f5f0
pop edi
pop esi
pop ebx
leave
ret 0xc