Function at 0x537e10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a681f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0xb6d0
call fcn.00587e30
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
call fcn.0043f300
test eax, eax
jne 0x537e76
mov eax, dword [0x60ed98]
push 0x1b
push 0xa5
push eax
call fcn.00421f30
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0xb6e4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00444980
lea ecx, [esp + 0x20]
call fcn.00459e30
push 0
push 0x45a120
lea ecx, [esp + 0x28]
mov dword [esp + 0xb6f4], 0
call fcn.004580e0
mov ecx, 0x64
sub ecx, eax
mov dword [esp + 0x1c], ecx
xor eax, eax
mov ecx, 0x64
lea edi, [esp + 0x60]
push eax
rep stosd dword es:[edi], eax
call fcn.0043f2e0
mov edi, eax
add esp, 4
mov ecx, edi
call fcn.00446ce0
mov ebx, eax
mov ebp, 0x64
push edi
call fcn.00404810
add esp, 4
test eax, eax
je 0x537ef9
mov eax, dword [edi + 0x40]
cmp eax, 0x2ae
jl 0x537ef9
cmp eax, 0x312
jge 0x537ef9
mov dword [esp + eax*4 - 0xa58], 1
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x14]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
add ebx, 0x128
add edi, 0x1c8
dec ebp
jne 0x537ed0
push fcn.00446c20
push fcn.00446c00
push 0x64
push 0x1c8
lea ecx, [esp + 0x4d0]
push ecx
xor ebp, ebp
call fcn.00587658
push str..S9P
mov byte [esp + 0xb6f0], 1
call fcn.00441be0
add esp, 4
lea edx, [esp + 0x1f0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], edi
call fcn.00424820
cmp edi, 0xffffffff
je 0x53806c
lea ebx, [esp + 0x4c0]
lea esp, [esp]
test byte [esp + 0x1f0], 0x10
jne 0x538046
lea eax, [esp + 0x21c]
push eax
call fcn.00441be0
add esp, 4
mov edi, eax
push edi
mov ecx, esi
call fcn.005377f0
test eax, eax
je 0x538046
cmp ebp, 0x64
jge 0x53803f
push ebp
push 1
push edi
mov ecx, ebx
call fcn.00447280
mov ecx, dword [ebx + 0x128]
mov dword [esp + ebp*4 + 0x330], ecx
mov ecx, ebx
call fcn.0043b260
push eax
lea edx, [esp + 0x64]
push edx
mov ecx, esi
call fcn.005379c0
mov esi, eax
push esi
mov ecx, ebx
mov dword [esp + esi*4 - 0xa54], 1
call fcn.00438ab0
push ebp
call fcn.0043f2e0
add esp, 4
mov edi, eax
push 0xffffffffffffffff
mov ecx, edi
call fcn.00446d90
push 0xffffffffffffffff
mov ecx, edi
call fcn.00438b20
mov ecx, edi
call fcn.00446ce0
mov edi, eax
push 0xffffffffffffffff
mov ecx, edi
call fcn.00438b20
push esi
mov ecx, edi
call fcn.00438ab0
push edi
lea ecx, [esp + 0x24]
call fcn.00457d50
mov esi, dword [esp + 0x18]
inc ebp
add ebx, 0x1c8
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1f0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x537f80
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebp, ebp
jg 0x5380dd
push 0x1b
push 0xa5
push 0
push 0x1d01
call fcn.0053f010
add esp, 8
push eax
call fcn.00421f30
add esp, 0xc
call fcn.00444850
push fcn.00446c20
push 0x64
push 0x1c8
lea ecx, [esp + 0x4cc]
push ecx
mov byte [esp + 0xb6fc], 0
call fcn.005875f8
lea ecx, [esp + 0x20]
mov dword [esp + 0xb6ec], 0xffffffff
call fcn.00459e50
xor eax, eax
mov ecx, dword [esp + 0xb6e4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebp, 0x64
jl 0x538101
push 0x1b
push 0xa5
push 0
push 0x205f
call fcn.0053f010
add esp, 8
push eax
call fcn.00421f30
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push edx
xor ebx, ebx
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.SanCalc.dll_int___cdecl_min_int__int_]
add esp, 8
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.00459e30
lea ecx, [esp + 0x40]
mov byte [esp + 0xb6ec], 2
call fcn.00424820
push ebx
push 1
push 0x610310
push 0x1f76
push esi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.00548360
add esp, 0x1c
test eax, eax
je 0x5381ce
mov edi, dword [esp + 0x44]
test edi, edi
je 0x5381ce
lea ebp, [esp + 0x4c0]
lea esp, [esp]
mov eax, edi
mov esi, dword [eax + 8]
test esi, esi
mov edi, dword [edi]
je 0x538196
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x538196
push 0x5b3d3c
mov ecx, esi
call fcn.00591e20
test eax, eax
jne 0x538198
xor esi, esi
push esi
call fcn.00404810
add esp, 4
test eax, eax
je 0x5381c6
push esi
mov ecx, ebp
call fcn.00447580
mov ecx, esi
call fcn.00434030
mov ecx, dword [esp + eax*4 - 0x7c0]
mov dword [esp + ebx*4 + 0x60], ecx
inc ebx
add ebp, 0x1c8
test edi, edi
jne 0x538170
mov dword [esp + 0x14], ebx
call fcn.00444850
test ebx, ebx
mov dword [esp + 0x18], 0
jle 0x5382bb
lea edi, [esp + 0x4c0]
lea ebx, [ebx]
call fcn.0043f300
mov esi, eax
mov ecx, esi
call fcn.00433ff0
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00434030
push edi
mov ecx, esi
mov ebx, eax
call fcn.00439030
mov edx, dword [edi + 0x128]
mov dword [esi + 0x128], edx
mov eax, dword [edi + 0x12c]
mov ebp, edi
mov dword [esi + 0x12c], eax
lea eax, [esi + 0x130]
sub ebp, esi
mov ecx, 0x98
lea ebx, [ebx]
mov dl, byte [eax + ebp]
mov byte [eax], dl
inc eax
dec ecx
jne 0x538240
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00434000
push ebx
mov ecx, esi
call fcn.00434050
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + ebp*4 + 0x60]
push ecx
mov ecx, esi
call fcn.00446cf0
mov ecx, esi
call fcn.00447040
lea edx, [ebx + 0x2bc]
push edx
mov ecx, esi
call fcn.00543a80
add ebx, 0x320
push ebx
mov ecx, esi
call fcn.00438aa0
push 0xffffffffffffffff
mov ecx, esi
call fcn.00438b20
push 0xffffffffffffffff
mov ecx, esi
call fcn.00446d90
mov eax, dword [esp + 0x14]
inc ebp
add edi, 0x1c8
cmp ebp, eax
mov dword [esp + 0x18], ebp
jl 0x5381f0
mov ebx, eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xb6ec], 1
call fcn.00459e50
push fcn.00446c20
push 0x64
push 0x1c8
lea eax, [esp + 0x4cc]
push eax
mov byte [esp + 0xb6fc], 0
call fcn.005875f8
lea ecx, [esp + 0x20]
mov dword [esp + 0xb6ec], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0xb6e4]
pop edi
mov eax, ebx
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret