Function at 0x4e4d28
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x4e4d31
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4e54dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x4e54f4
mov edx, dword [ebp - 4]
call fcn.00404b74
mov eax, dword [ebp - 0x158]
call fcn.00404d28
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4e548b
mov bl, 1
jmp 0x4e548b
mov eax, dword [0x55c098]
cmp byte [eax], 1
je 0x4e5493
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048da60
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404ad8
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404be8
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.00408dd0
mov eax, dword [ebp - 0x15c]
push eax
lea edx, [ebp - 0x164]
mov eax, 0x4e5510
call fcn.00408dd0
mov eax, dword [ebp - 0x164]
pop edx
call fcn.00404e6c
test eax, eax
jg 0x4e5499
mov eax, dword [ebp - 0x154]
cmp eax, 0x10
je 0x4e4e54
cmp eax, 2
je 0x4e4e54
cmp eax, 4
je 0x4e4e54
cmp eax, 0x80
je 0x4e4e54
cmp eax, 0x100
je 0x4e4e54
cmp eax, 0x13
je 0x4e4e54
cmp eax, 0x20
je 0x4e4e54
cmp eax, 0x16
jne 0x4e4f18
mov eax, dword [0x55c440]
inc dword [eax]
mov eax, dword [0x55c440]
mov eax, dword [eax]
mov ecx, 0xc8
cdq
idiv ecx
test edx, edx
jne 0x4e4e97
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00404be8
mov edx, dword [ebp - 0x168]
mov eax, dword [ebp - 0xc]
call fcn.0046d0e8
call fcn.004d27bc
mov eax, dword [ebp - 0x10]
mov edx, 0x4e5520
call fcn.00404c74
je 0x4e4f18
mov eax, dword [ebp - 0x10]
mov edx, 0x4e552c
call fcn.00404c74
je 0x4e4f18
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00404be8
mov eax, dword [ebp - 0x16c]
call fcn.0040992c
test al, al
je 0x4e4f18
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404be8
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004e4d28
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 0x10]
call fcn.00409bdc
mov eax, dword [ebp - 0x174]
mov edx, 0x4e5538
call fcn.00404c74
jne 0x4e5478
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00404be8
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x14]
call fcn.004e4ad0
cmp dword [ebp - 0x14], 0
je 0x4e5478
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 0x14]
call fcn.00408dd0
mov eax, dword [ebp - 0x17c]
push eax
lea edx, [ebp - 0x180]
mov eax, 0x4e5548
call fcn.00408dd0
mov eax, dword [ebp - 0x180]
pop edx
call fcn.00404e6c
test eax, eax
jne 0x4e5478
mov eax, dword [0x55bdac]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
call fcn.004d1820
test al, al
je 0x4e5478
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x188]
mov edx, 3
call fcn.00404be8
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.00408dd0
mov eax, dword [ebp - 0x184]
push eax
lea edx, [ebp - 0x18c]
mov eax, 0x4e5510
call fcn.00408dd0
mov eax, dword [ebp - 0x18c]
pop edx
call fcn.00404e6c
test eax, eax
jne 0x4e5478
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 0x14]
call fcn.00409bdc
cmp dword [ebp - 0x190], 0
jne 0x4e525b
mov eax, dword [ebp - 0x14]
call fcn.0040992c
test al, al
jne 0x4e5478
mov edx, dword [ebp - 0x14]
mov eax, 0x4e5554
call fcn.00404e6c
test eax, eax
jne 0x4e5478
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x194]
mov edx, 3
call fcn.00404be8
mov ecx, dword [ebp - 0x194]
mov eax, dword [0x55bd98]
mov eax, dword [eax]
mov edx, 0x4e5560
call fcn.004d1dfc
cmp al, 1
je 0x4e5499
mov eax, dword [ebp + 8]
call fcn.0048f650
mov ebx, eax
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
mov edx, dword [0x55bf60]
mov dl, byte [edx + 0xf]
mov byte [eax + 0xc], dl
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x12
mov edx, 3
call fcn.00404be8
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x16
mov edx, 3
call fcn.00404be8
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x1a
mov edx, dword [ebp - 0x14]
call fcn.004048bc
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x1e
call fcn.00404868
push 0x4e557c
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x2e
mov edx, 4
call fcn.00404be8
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x32
mov ecx, dword [ebp - 0x14]
mov edx, 0x4e5590
call fcn.00404b74
push 0x4e55a4
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x36
mov edx, 4
call fcn.00404be8
push 0x4e55b4
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
push 0x4e55cc
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x3a
mov edx, 5
call fcn.00404be8
mov eax, dword [0x55c4c4]
inc dword [eax]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
mov edx, dword [0x55c4c4]
mov edx, dword [edx]
mov dword [eax + 0x2a], edx
push 0x4e55e4
push dword [ebp - 0x10]
push 0x4e55fc
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
push 0x4e5614
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x3e
mov edx, 7
call fcn.00404be8
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x42
mov edx, 0x4e563c
call fcn.004048bc
lea eax, [ebp - 0x198]
push eax
mov eax, dword [ebp + 8]
call fcn.0041bcc4
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 0
lea edx, [ebp - 0x1a0]
xor ecx, ecx
mov eax, 0x4e5658
call fcn.0040a4d0
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp + 0xc]
call fcn.0046d0e8
jmp 0x4e5478
mov edx, dword [ebp - 0x14]
mov eax, 0x4e5554
call fcn.00404e6c
test eax, eax
jne 0x4e5478
mov eax, dword [ebp - 0x14]
call fcn.004e4998
test al, al
jne 0x4e5478
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
lea eax, [ebp - 0x1a4]
mov edx, 3
call fcn.00404be8
mov ecx, dword [ebp - 0x1a4]
mov edx, 0x4e5560
mov eax, dword [0x55bd98]
mov eax, dword [eax]
call fcn.004d1dfc
cmp al, 1
je 0x4e5499
mov eax, dword [ebp + 8]
call fcn.0048f650
mov ebx, eax
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
mov edx, dword [0x55bf60]
mov dl, byte [edx + 0xf]
mov byte [eax + 0xc], dl
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x12
mov edx, 3
call fcn.00404be8
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x16
mov edx, 3
call fcn.00404be8
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x1a
mov edx, dword [ebp - 0x14]
call fcn.004048bc
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x1e
call fcn.00404868
push 0x4e557c
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x2e
mov edx, 4
call fcn.00404be8
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x32
mov ecx, dword [ebp - 0x14]
mov edx, 0x4e5590
call fcn.00404b74
push 0x4e55a4
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x36
mov edx, 4
call fcn.00404be8
push 0x4e5664
push dword [ebp - 0x14]
push 0x4e5678
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x3a
mov edx, 3
call fcn.00404be8
mov eax, dword [0x55c4c4]
inc dword [eax]
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
mov edx, dword [0x55c4c4]
mov edx, dword [edx]
mov dword [eax + 0x2a], edx
push 0x4e55e4
push dword [ebp - 0x10]
push 0x4e55fc
push dword [ebp - 4]
push 0x4e5504
push dword [ebp - 0x10]
push 0x4e5614
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x3e
mov edx, 7
call fcn.00404be8
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0048f664
add eax, 0x42
mov edx, 0x4e563c
call fcn.004048bc
lea eax, [ebp - 0x1a8]
push eax
mov eax, dword [ebp + 8]
call fcn.0041bcc4
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 0
lea edx, [ebp - 0x1a0]
xor ecx, ecx
mov eax, 0x4e5658
call fcn.0040a4d0
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp + 0xc]
call fcn.0046d0e8
lea eax, [ebp - 0x154]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4e4d9a
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e54e3
lea eax, [ebp - 0x1a8]
mov edx, 2
call fcn.0040488c
lea eax, [ebp - 0x198]
mov edx, 0x11
call fcn.0040488c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040488c
lea eax, [ebp - 4]
call fcn.00404868
ret