Function at 0x4159c4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1a4
mov eax, dword [ecx + 4]
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp + 8]
lea esi, [eax + 0x4000]
mov dword [ebp - 0x190], eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x194], eax
call fcn.004152c1
add esp, 0x10
mov dword [ebp - 0x19c], eax
test eax, eax
je 0x415b72
push eax
push eax
push 0x44446e
push dword [ebx + 0x58]
call fcn.00405368
add esp, 0x10
mov ecx, str._for
mov edi, eax
test eax, eax
jne 0x415a34
mov ecx, 0x44481b
mov edi, ecx
push eax
push eax
push 0x444485
push dword [ebx + 0x58]
mov dword [ebp - 0x1a0], ecx
call fcn.00405368
add esp, 0x10
mov ecx, dword [ebp - 0x1a0]
test eax, eax
mov edx, eax
jne 0x415a5f
mov edx, 0x44481b
jmp 0x415a64
mov ecx, str._for
push eax
push eax
lea eax, [ebp - 0x198]
push edx
push edi
push ecx
push esi
push str._a_nametop___a__h2_Statistics.__h2___s_event_s_s__s___center__ul__n
push eax
mov dword [ebp - 0x1a0], edx
call fcn.0042ce14
add esp, 0x20
mov eax, str._n______X_X_____li__a_href__s___s__a_
cmp dword [ebp + 0x10], 0xff
mov ecx, str._li__a_href____admin__state_n_ut_u_s___s__a_
mov edx, dword [ebp - 0x1a0]
cmove ecx, eax
xor esi, esi
mov eax, dword [esi*4 + 0x438d60]
test eax, eax
je 0x415ade
mov dword [ebp - 0x1a4], edx
push edx
push edx
push eax
push eax
lea eax, [ebp - 0x198]
push esi
inc esi
push dword [ebp + 0x14]
push ecx
push eax
mov dword [ebp - 0x1a0], ecx
call fcn.0042ce14
mov ecx, dword [ebp - 0x1a0]
mov edx, dword [ebp - 0x1a4]
add esp, 0x20
jmp 0x415aa0
push eax
xor esi, esi
push eax
push edx
push edi
lea edi, [ebp - 0x198]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [0x4331d8]
push edi
call fcn.0042ce14
add esp, 0x20
cmp dword [ebp + 0x10], 0xff
je 0x415b3a
mov eax, dword [ebp + 0x10]
sub esp, 0xc
mov ecx, ebx
movzx eax, byte [eax + 0x444ba0]
push eax
mov eax, dword [ebp + 0x10]
push dword [eax*4 + 0x438d60]
push edi
push dword [eax*4 + 0x444be0]
push dword [ebp - 0x19c]
call fcn.00414d62
add esp, 0xc
jmp 0x415b72
mov eax, dword [esi*4 + 0x438d60]
test eax, eax
je 0x415b72
movzx edx, byte [esi + 0x444ba0]
sub esp, 0xc
mov ecx, ebx
push edx
push eax
lea eax, [ebp - 0x198]
push eax
push dword [esi*4 + 0x444be0]
inc esi
push dword [ebp - 0x19c]
call fcn.00414d62
add esp, 0xc
jmp 0x415b3a
lea esi, [ebp - 0x198]
push eax
push dword [0x433150]
push 0x4448b9
push esi
call fcn.0042ce14
mov eax, dword [0x46d99c]
add esp, 0x10
test eax, eax
je 0x415cf4
mov edi, dword [ebp + 8]
push ecx
push eax
lea ebx, [edi + 0x2000]
push 0x4448bd
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
pop edi
pop eax
push 0x2e
push ebx
call fcn.00403476
add esp, 0x10
test eax, eax
je 0x415bc8
mov dword [eax], 0x2a
lea edi, [ebp - 0x158]
push eax
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
pop eax
pop edx
cmp ebx, 0xffffffff
je 0x415cf4
mov ecx, 0x30
xor edx, edx
lea eax, [ebp - 0x188]
call fcn.00413b93
test byte [ebp - 0x158], 0x10
jne 0x415c85
sub esp, 0xc
lea edx, [ebp - 0x12c]
push edx
call fcn.0042d5c4
add esp, 0x10
lea edx, [ebp - 0x12c]
cmp byte [ebp + eax - 0x12d], 0x2e
lea ecx, [eax - 1]
cmove eax, ecx
cmp eax, 4
jle 0x415c63
sub esp, 0xc
lea eax, [edx + eax - 4]
push eax
call fcn.0041244e
add esp, 0x10
test eax, eax
je 0x415c63
mov ecx, 0x64
cdq
idiv ecx
dec eax
mov ecx, edx
cmp eax, 0xb
ja 0x415c85
mov edx, 1
shl edx, cl
or dword [ebp + eax*4 - 0x188], edx
jmp 0x415c85
test byte [ebp - 0x188], 1
jne 0x415c85
push eax
push dword [ebp + 0x10]
push str._a_href___admin__state_n0t_u_today__a__nbsp_
push esi
call fcn.0042ce14
or dword [ebp - 0x188], 1
add esp, 0x10
push eax
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop edx
pop ecx
test eax, eax
jne 0x415bf7
sub esp, 0xc
push ebx
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0xc
imul edi, ebx, 0x64
mov ecx, 1
mov eax, 1
shl eax, cl
and eax, dword [ebp + ebx*4 - 0x18c]
je 0x415ce8
push eax
push eax
lea eax, [ecx + edi]
push ecx
push ebx
push dword [ebp + 0x10]
push eax
push str._a_href___admin__state_n_ut_u__u__u__a__nbsp_
push esi
mov dword [ebp - 0x19c], ecx
call fcn.0042ce14
mov ecx, dword [ebp - 0x19c]
add esp, 0x20
inc ecx
cmp ecx, 0x20
jne 0x415cb3
inc ebx
cmp ebx, 0xd
jne 0x415cab
push ebx
push dword [0x4330f8]
push 0x4441f5
push esi
call fcn.0042ce14
mov edx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x190]
add esp, 0x10
sub eax, edx
je 0x415d2b
push ecx
push eax
push edx
push dword [ebp - 0x198]
call dword [ebp - 0x18c]
add esp, 0x10
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10