Function at 0x442580
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d4fd
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x678], ebx
mov dword [ebp - 4], ebx
xor ecx, ecx
nop
movzx eax, word [ecx + str.C:Users_]
mov word [ebp + ecx - 0x424], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4425c0
lea ecx, [ebp - 0x424]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4425e0
mov eax, dword [0x4915cc]
mov dword [ecx], eax
mov ax, word [0x4915d0]
mov word [ecx + 4], ax
xor ecx, ecx
nop
movzx eax, word [ecx + str.C:Users_]
mov word [ebp + ecx - 0x21c], ax
add ecx, 2
test ax, ax
jne 0x442600
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x442620
mov eax, dword [0x49485c]
mov dword [edi], eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x67c], edx
cmp edx, 0xffffffff
je 0x442a6e
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x21c]
mov word [ebp + ecx - 0x424], ax
add ecx, 2
test ax, ax
jne 0x442660
lea eax, [ebp - 0x674]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x442a01
lea ecx, [ebp - 0x648]
call fcn.00460ce0
test eax, eax
je 0x4426a5
mov edx, dword [ebp - 0x67c]
jmp 0x442678
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ecx + str.C:Users_]
mov word [ebp + ecx - 0x21c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4426b0
lea edx, [ebp - 0x648]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4426d0
sub edx, esi
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4426e6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebp - 0x674], 0x10
je 0x442a6e
push 0x48a188
lea ecx, [ebp - 0x680]
call fcn.0045d100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x690]
call fcn.004652a0
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x680]
lea ecx, [ebp - 0x684]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x690]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44276b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x680]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442791
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, str.C:UsersManageLocal
lea eax, [ebp - 0x21c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4427c6
test dx, dx
je 0x4427c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4427c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4427a0
xor eax, eax
jmp 0x4427cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x44294a
mov ecx, str.C:UsersDefault_User
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442806
test dx, dx
je 0x442802
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442806
add eax, 4
add ecx, 4
test dx, dx
jne 0x4427e0
xor eax, eax
jmp 0x44280b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44294a
mov ecx, str.C:UsersDefault
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442846
test dx, dx
je 0x442842
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442846
add eax, 4
add ecx, 4
test dx, dx
jne 0x442820
xor eax, eax
jmp 0x44284b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44294a
mov ecx, str.C:UsersAll_Users
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442886
test dx, dx
je 0x442882
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442886
add eax, 4
add ecx, 4
test dx, dx
jne 0x442860
xor eax, eax
jmp 0x44288b
sbb eax, eax
or eax, 1
test eax, eax
je 0x44294a
mov ecx, str.C:UsersPublic
lea eax, [ebp - 0x21c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4428c6
test dx, dx
je 0x4428c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4428c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4428a0
xor eax, eax
jmp 0x4428cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x44294a
lea ecx, [ebp - 0x68c]
call fcn.004652a0
mov byte [ebp - 4], 8
or ebx, 1
mov dword [ebp - 0x678], ebx
push eax
mov edx, str.C:Users_
lea ecx, [ebp - 0x688]
call fcn.0045c620
add esp, 4
mov dword [ebp - 4], 9
or ebx, 2
mov dword [ebp - 0x678], ebx
mov eax, dword [eax]
lea ecx, [ebp - 0x21c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x44293d
test dx, dx
je 0x442939
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x44293d
add ecx, 4
add eax, 4
test dx, dx
jne 0x442917
xor eax, eax
jmp 0x442942
sbb eax, eax
or eax, 1
test eax, eax
je 0x44294a
xor bl, bl
jmp 0x44294c
mov bl, 1
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x678]
test cl, 2
je 0x442996
and ecx, 0xfffffffd
mov dword [ebp - 0x678], ecx
mov dword [ebp - 4], 0xa
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x688]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442996
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x678]
mov dword [ebp - 4], 6
test cl, 1
je 0x4429d1
and ecx, 0xfffffffe
mov dword [ebp - 0x678], ecx
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x68c]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4429d1
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
test bl, bl
je 0x442a0c
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x684]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4429fb
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, dword [ebp - 0x678]
mov edx, dword [ebp - 0x67c]
jmp 0x442678
lea ecx, [ebp - 0x21c]
call fcn.004606f0
mov byte [ebp - 4], 0xd
jmp 0x4429d9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret