Function at 0x4479b0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b481c
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
call fcn.00406f10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x280]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [ebp + 8]
push ecx
push edx
push eax
call fcn.004470e0
mov ecx, 1
lea edx, [ebp - 0x294]
mov esi, eax
call fcn.00447180
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov eax, dword [ebp - 0x280]
mov eax, dword [eax]
mov edi, dword [ebp - 0x294]
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x26c], eax
mov ebx, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov esi, dword [ebp - 0x280]
test edi, edi
je 0x447a5b
cmp edi, dword [ebp - 0x294]
je 0x447a60
call fcn.0048b3f2
cmp dword [ebp - 0x26c], esi
je 0x447f74
mov eax, dword [0x4e47ac]
test eax, eax
je 0x447a82
push 0
push eax
call ebx
test eax, eax
je 0x447f14
mov eax, dword [0x4e47b0]
test eax, eax
je 0x447aa1
push 0
push eax
call ebx
test eax, eax
je 0x447f14
cmp eax, 0xffffffff
je 0x447f14
test edi, edi
jne 0x447b14
call fcn.0048b3f2
xor eax, eax
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax + 0x14]
jne 0x447abc
call fcn.0048b3f2
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx + 8]
sub eax, 0x10
push eax
call fcn.00406650
add eax, 0x10
add esp, 4
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 2
mov eax, dword [0x4e7008]
test eax, eax
jne 0x447af1
call fcn.00449cf0
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x447b18
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x447b18
mov eax, dword [eax + 0x80]
jmp 0x447b1a
mov eax, dword [edi]
jmp 0x447aac
xor eax, eax
test eax, eax
je 0x447b29
mov edx, dword [ebp - 0x278]
push edx
call eax
jmp 0x447b36
mov eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x447eb6
push 0x250
lea ecx, [ebp - 0x264]
push 0
push ecx
call fcn.0048f0a0
add esp, 0xc
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x2a0]
push eax
mov edi, 0x4c1ce8
call fcn.00406590
add esp, 8
mov byte [ebp - 4], 3
mov esi, dword [eax]
mov eax, dword [0x4e7008]
test eax, eax
jne 0x447b88
call fcn.00449cf0
mov dword [0x4e7008], eax
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x447ba7
mov eax, dword [0x4e7008]
mov edx, dword [eax + 0x140]
cmp edx, ecx
jne 0x447ba7
mov eax, dword [eax + 0x64]
jmp 0x447ba9
xor eax, eax
test eax, eax
je 0x447bb9
lea ecx, [ebp - 0x264]
push ecx
push esi
call eax
jmp 0x447bc7
lea edx, [ebp - 0x264]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x274], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2a0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447bf3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2a4]
push ecx
mov esi, 0x4bef2c
call fcn.00403c50
mov byte [ebp - 4], 4
or dword [ebp - 0x268], 1
mov eax, dword [eax]
lea ecx, [ebp - 0x238]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x447c3d
test dx, dx
je 0x447c39
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x447c3d
add eax, 4
add ecx, 4
test dx, dx
jne 0x447c17
xor eax, eax
jmp 0x447c42
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x447c99
lea edx, [ebp - 0x29c]
push edx
mov esi, 0x4c1cf0
call fcn.00403c50
or dword [ebp - 0x268], 2
mov eax, dword [eax]
lea ecx, [ebp - 0x238]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x447c8c
test dx, dx
je 0x447c88
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x447c8c
add eax, 4
add ecx, 4
test dx, dx
jne 0x447c66
xor eax, eax
jmp 0x447c91
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x447c99
xor bl, bl
jmp 0x447c9b
mov bl, 1
test byte [ebp - 0x268], 2
je 0x447ccd
mov eax, dword [ebp - 0x29c]
and dword [ebp - 0x268], 0xfffffffd
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447ccd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 2
test byte [ebp - 0x268], 1
je 0x447d06
mov eax, dword [ebp - 0x2a4]
and dword [ebp - 0x268], 0xfffffffe
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447d06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x447dbf
lea ecx, [ebp - 0x278]
push ecx
lea edx, [ebp - 0x2a8]
push edx
mov edi, 0x4bd884
call fcn.00406590
push eax
lea eax, [ebp - 0x298]
push eax
lea edi, [ebp - 0x238]
mov byte [ebp - 4], 5
call fcn.00406590
add esp, 0x10
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2a8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447d66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x280]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [ebp - 0x298]
push ecx
push edx
push eax
call fcn.004470e0
mov ecx, 1
lea edx, [ebp - 0x294]
mov esi, eax
call fcn.00447180
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x298]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447dbf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x4e7008]
test eax, eax
jne 0x447e19
push eax
push 1
push 0x4e700c
call dword [sym.imp.KERNEL32.DLL_InterlockedCompareExchange]
test eax, eax
jne 0x447deb
call fcn.00449c80
mov dword [0x4e700c], 2
jmp 0x447e14
mov ecx, dword [0x4e700c]
cmp ecx, 2
je 0x447e0f
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
lea esp, [esp]
push 1
call esi
mov edx, dword [0x4e700c]
cmp edx, 2
jne 0x447e00
call fcn.00449c80
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x447e39
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x447e39
mov eax, dword [eax + 0x6c]
jmp 0x447e3b
xor eax, eax
lea edx, [ebp - 0x264]
push edx
test eax, eax
je 0x447e51
mov ecx, dword [ebp - 0x274]
push ecx
call eax
jmp 0x447e5e
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x447bf3
mov eax, dword [0x4e7008]
test eax, eax
jne 0x447e79
call fcn.00449cf0
mov dword [0x4e7008], eax
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x447e98
mov eax, dword [0x4e7008]
mov edx, dword [eax + 0x140]
cmp edx, ecx
jne 0x447e98
mov eax, dword [eax + 0x70]
jmp 0x447e9a
xor eax, eax
test eax, eax
je 0x447ea9
mov ecx, dword [ebp - 0x274]
push ecx
call eax
jmp 0x447eb6
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447edc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x270]
test eax, eax
jne 0x447f10
call fcn.0048b3f2
xor eax, eax
mov esi, dword [ebp - 0x26c]
cmp esi, dword [eax + 0x14]
jne 0x447efd
call fcn.0048b3f2
mov ecx, dword [esi]
mov edi, dword [ebp - 0x270]
mov dword [ebp - 0x26c], ecx
jmp 0x447a43
mov eax, dword [eax]
jmp 0x447eed
lea ebx, [ebp - 0x294]
call fcn.00447080
mov edx, dword [ebp - 0x280]
push edx
call fcn.00480ff0
mov eax, dword [ebp - 0x294]
add esp, 4
push eax
mov dword [ebp - 0x280], 0
call fcn.00480ff0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447f6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x448271
mov ecx, dword [ebp - 0x280]
mov ebx, dword [ebp - 0x294]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x280]
mov esi, dword [edx]
xor edi, edi
cmp ebx, edi
je 0x447f9c
cmp ebx, dword [ebp - 0x294]
je 0x447fa1
call fcn.0048b3f2
cmp dword [ebp - 0x26c], esi
je 0x4480d1
mov eax, dword [0x4e47ac]
cmp eax, edi
je 0x447fc6
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, edi
je 0x447f14
mov eax, dword [0x4e47b0]
cmp eax, edi
je 0x447fe8
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, edi
je 0x447f14
cmp eax, 0xffffffff
je 0x447f14
mov eax, dword [ebp - 0x26c]
mov edi, ebx
mov dword [ebp - 0x2ac], eax
test ebx, ebx
jne 0x447fff
call fcn.0048b3f2
mov ecx, dword [ebp - 0x26c]
mov esi, dword [ecx + 4]
test edi, edi
je 0x448010
mov eax, dword [edi]
jmp 0x448012
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x44801c
call fcn.0048b3f2
test edi, edi
jne 0x4480b5
call fcn.0048b3f2
cmp esi, dword [edi + 0x14]
jne 0x448033
call fcn.0048b3f2
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.00406650
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2ac], eax
mov edx, dword [ebp + 0x10]
push edx
push ecx
lea esi, [eax - 0x10]
mov dword [ebp - 0x274], esp
mov edi, esp
push esi
mov byte [ebp - 4], 8
call fcn.00406650
mov ecx, dword [ebp + 0xc]
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00447790
add esp, 8
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x448095
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
test ebx, ebx
jne 0x44809e
call fcn.0048b3f2
mov ecx, dword [ebp - 0x26c]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x26c], ecx
test ebx, ebx
je 0x4480bc
mov eax, dword [ebx]
jmp 0x4480be
mov edi, dword [edi]
jmp 0x448029
xor eax, eax
cmp ecx, dword [eax + 0x14]
jne 0x447f86
call fcn.0048b3f2
jmp 0x447f86
mov eax, dword [0x4e7008]
mov esi, dword [ebp + 8]
cmp eax, edi
jne 0x4481d9
push edi
push 1
push 0x4e700c
call dword [sym.imp.KERNEL32.DLL_InterlockedCompareExchange]
test eax, eax
jne 0x448157
test byte [0x4e6ea0], 1
jne 0x44814b
or dword [0x4e6ea0], 1
push 0x13c
push edi
push 0x4e6eac
mov dword [0x4e6ea8], 0x4c1d74
mov dword [0x4e6ff0], edi
call fcn.0048f0a0
add esp, 0xc
mov dword [0x4e6fe8], edi
push 0x4b78a0
mov dword [0x4e6fec], edi
mov dword [0x4e6ff8], edi
mov dword [0x4e6ff4], edi
call fcn.0048be6a
add esp, 4
mov dword [0x4e700c], 2
jmp 0x4481cf
mov ecx, dword [0x4e700c]
cmp ecx, 2
je 0x448177
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
call ebx
mov edx, dword [0x4e700c]
cmp edx, 2
jne 0x448168
test byte [0x4e6ea0], 1
jne 0x4481cf
or dword [0x4e6ea0], 1
push 0x13c
push edi
push 0x4e6eac
mov dword [0x4e6ea8], 0x4c1d74
mov dword [0x4e6ff0], edi
call fcn.0048f0a0
add esp, 0xc
mov dword [0x4e6fe8], edi
push 0x4b78a0
mov dword [0x4e6fec], edi
mov dword [0x4e6ff8], edi
mov dword [0x4e6ff4], edi
call fcn.0048be6a
add esp, 4
mov eax, 0x4e6ea8
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x4481fc
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x4481fc
mov eax, dword [eax + 0x88]
jmp 0x4481fe
xor eax, eax
push esi
cmp eax, edi
je 0x448207
call eax
jmp 0x44820d
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edx, edx
cmp eax, edi
sete dl
lea ebx, [ebp - 0x294]
mov esi, edx
call fcn.00447080
mov eax, dword [ebp - 0x280]
push eax
call fcn.00480ff0
mov ecx, dword [ebp - 0x294]
add esp, 4
push ecx
mov dword [ebp - 0x280], 0
call fcn.00480ff0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44826f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret