Function at 0x4a7b76
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x4c9d33
call fcn.004c7e20
sub esp, 0x2f0
mov eax, dword [0x4ed384]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
lea edi, [ebp - 0x278]
mov dword [ebp - 0x14], eax
call fcn.00402f03
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x278]
mov eax, dword [ecx - 8]
mov ax, word [ecx + eax*2 - 2]
push 0x5c
pop ecx
cmp ax, cx
je 0x4a7bd1
lea eax, [ebp + 0xc]
xor edi, edi
push eax
inc edi
lea eax, [ebp - 0x278]
mov dword [ebp + 0xc], ecx
call fcn.00403377
push dword [ebp + 0x10]
lea edi, [ebp - 0x27c]
call fcn.00402f03
push str.ttp_.dll
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00403120
lea eax, [ebp - 0x274]
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x288], eax
jne 0x4a7c61
lea eax, [esi - 0xc]
cmp eax, dword [0x4f0984]
je 0x4a7c2b
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x27c]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a7c42
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a7c59
push eax
call fcn.004013aa
xor eax, eax
inc eax
jmp 0x4a7e34
test byte [ebp - 0x274], 0x10
jne 0x4a7dbf
mov eax, dword [ebp - 0x27c]
xor ebx, ebx
cmp dword [eax - 8], ebx
je 0x4a7c98
lea eax, [ebp - 0x248]
push eax
xor ecx, ecx
lea esi, [ebp - 0x27c]
call fcn.0040a781
cmp eax, 0xffffffff
jne 0x4a7dbf
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00403120
mov edi, eax
lea eax, [ebp - 0x280]
call fcn.00402f73
mov eax, dword [ebp - 0x29c]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a7cd6
push eax
call fcn.004013aa
push 0x2c
mov dword [ebp - 0x294], ebx
mov byte [ebp - 4], 3
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x4a7cf6
push ebx
mov esi, eax
call fcn.004a546e
jmp 0x4a7cf8
xor eax, eax
xor esi, esi
cmp eax, esi
mov ebx, eax
mov dword [ebp - 0x294], ebx
jne 0x4a7d20
mov dword [ebp - 0x2a0], 0x8007000e
push 0x4dd674
lea eax, [ebp - 0x2a0]
jmp 0x4a7e62
mov ecx, dword [ebp - 0x280]
mov edx, eax
call fcn.004a582e
cmp eax, esi
jge 0x4a7d47
mov dword [ebp - 0x2a8], eax
push 0x4dd674
lea eax, [ebp - 0x2a8]
jmp 0x4a7e62
mov dword [ebp + 0x10], esi
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x10]
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.004a58a9
test eax, eax
jge 0x4a7e68
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a7d7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x4a7e4d
test ebx, ebx
mov dword [ebp + 0xc], ebx
je 0x4a7d96
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
add edi, 0x40
mov byte [ebp - 4], 0xd
call fcn.004ab8d7
test ebx, ebx
mov byte [ebp - 4], 3
je 0x4a7db8
mov esi, ebx
call fcn.004a54a6
mov esi, ebx
call fcn.004a54a6
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x288]
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a7c61
push dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x280]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a7e04
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x27c]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a7e1b
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a7e32
push eax
call fcn.004013aa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004c7b01
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp - 0x2a4], 0x80004001
push 0x4dd674
lea eax, [ebp - 0x2a4]
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0x10
pop edi
push edi
lea eax, [ebp - 0x24]
push 0x4d21e0
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4a7ed4
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x298]
push eax
call fcn.004ab176
push dword [ebp + 0x10]
lea eax, [ebp - 0x2fc]
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0x298]
push eax
call fcn.004a54ff
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 6
call fcn.004ab654
lea esi, [ebp - 0x2fc]
mov byte [ebp - 4], 5
call fcn.004a7778
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x298]
jmp 0x4a8016
push edi
lea eax, [ebp - 0x24]
push 0x4d21f0
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4a7f46
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x290]
push eax
call fcn.004ab198
mov byte [ebp - 4], 7
push dword [ebp - 0x290]
lea eax, [ebp - 0x2b8]
push dword [ebp + 0x10]
push eax
call fcn.004ab2aa
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2b8]
push eax
add ecx, 0x10
mov byte [ebp - 4], 8
call fcn.004ab70b
lea eax, [ebp - 0x2b8]
mov byte [ebp - 4], 7
call fcn.004a554a
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x290]
jmp 0x4a8016
push edi
lea eax, [ebp - 0x24]
push 0x4d2200
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4a7faf
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x284]
push eax
call fcn.004ab1ba
push dword [ebp + 0x10]
lea eax, [ebp - 0x2e4]
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0x284]
push eax
call fcn.004a5578
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x20
mov byte [ebp - 4], 0xa
call fcn.004ab79a
lea esi, [ebp - 0x2e4]
mov byte [ebp - 4], 9
call fcn.004a7b5e
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x284]
jmp 0x4a8016
push edi
lea eax, [ebp - 0x24]
push 0x4d2210
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4a8023
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x28c]
push eax
call fcn.004ab1dc
push dword [ebp + 0x10]
lea eax, [ebp - 0x2cc]
mov byte [ebp - 4], 0xb
mov edi, dword [ebp - 0x28c]
push eax
call fcn.004a55cb
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x30
mov byte [ebp - 4], 0xc
call fcn.004ab866
lea esi, [ebp - 0x2cc]
mov byte [ebp - 4], 0xb
call fcn.004a7b5e
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x28c]
xor esi, esi
inc esi
test eax, eax
je 0x4a8023
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a8034
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp + 0x10]
jmp 0x4a7d4a