Function at 0x5607d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6161d9
mov eax, dword fs:[0]
push eax
sub esp, 0x3e8
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3e8], eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00579910
add esp, 4
push 0x15
push str.vmsoperationRecords_
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0
call fcn.004245a0
push 0x665d38
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x5c]
call fcn.00425c20
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3e4]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov ebx, eax
mov dword [ebp - 0x3ec], ebx
cmp ebx, 0xffffffff
je 0x560c3c
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp word [ebp - 0x3b8], ax
jne 0x5608a1
xor ecx, ecx
jmp 0x5608bf
lea ecx, [ebp - 0x3b8]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5608b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00413650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov esi, 1
mov ebx, dword [ebp - 0x1c]
cmp edx, 8
cmovae ecx, dword [ebp - 0x2c]
cmp ebx, esi
cmovb esi, ebx
test esi, esi
je 0x56090a
mov edx, 0x644cf8
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x56091a
add ecx, 2
add edx, 2
dec esi
jne 0x5608f6
mov edx, dword [ebp - 0x18]
xor eax, eax
test eax, eax
jne 0x560935
cmp ebx, 1
jae 0x56092b
or eax, 0xffffffff
jmp 0x560933
movzx eax, word [ecx]
cmp ax, word [edx]
mov edx, dword [ebp - 0x18]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x56090c
xor eax, eax
cmp ebx, 1
setne al
test eax, eax
sete al
test al, al
jne 0x560c08
cmp edx, 8
lea ecx, [ebp - 0x2c]
mov esi, 2
cmovae ecx, dword [ebp - 0x2c]
cmp ebx, esi
cmovb esi, ebx
test esi, esi
je 0x560974
mov edx, 0x644cfc
lea ecx, [ecx]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x560984
add ecx, 2
add edx, 2
dec esi
jne 0x560960
mov edx, dword [ebp - 0x18]
xor eax, eax
test eax, eax
jne 0x56099f
cmp ebx, 2
jae 0x560995
or eax, 0xffffffff
jmp 0x56099d
movzx eax, word [ecx]
cmp ax, word [edx]
mov edx, dword [ebp - 0x18]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x560976
xor eax, eax
cmp ebx, 2
setne al
test eax, eax
sete al
test al, al
jne 0x560c08
test byte [ebp - 0x3e4], 0x10
jne 0x560c08
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x44]
call fcn.00464270
add esp, 4
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00578d00
add esp, 8
push 7
push str..record
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c]
push dword [ebp - 0x7c]
push 0
call fcn.00417250
test eax, eax
jne 0x560bb4
lea ecx, [ebp - 0x194]
call fcn.0047b7b0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x74]
call fcn.004e5e10
mov esi, eax
lea eax, [ebp - 0x178]
cmp eax, esi
je 0x560a69
cmp dword [ebp - 0x164], 8
jb 0x560a40
push dword [ebp - 0x178]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x164], 7
push esi
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x168], 0
mov word [ebp - 0x178], ax
call fcn.00417ff0
cmp dword [ebp - 0x60], 8
jb 0x560a77
push dword [ebp - 0x74]
call edi
add esp, 4
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x190]
call fcn.00413280
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00578b30
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x160]
cmp eax, esi
je 0x560ae5
cmp dword [ebp - 0x14c], 8
jb 0x560abc
push dword [ebp - 0x160]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x14c], 7
push esi
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x150], 0
mov word [ebp - 0x160], ax
call fcn.00417ff0
cmp dword [ebp - 0x60], 8
jb 0x560af3
push dword [ebp - 0x74]
call edi
add esp, 4
push 7
push str..record
lea ecx, [ebp - 0x118]
call fcn.00413650
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00574210
mov esi, eax
add esp, 8
lea eax, [ebp - 0x148]
cmp eax, esi
je 0x560b89
cmp dword [ebp - 0x134], 8
jb 0x560b60
push dword [ebp - 0x148]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x134], 7
push esi
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], 0
mov word [ebp - 0x148], ax
call fcn.00417ff0
cmp dword [ebp - 0x60], 8
jb 0x560b97
push dword [ebp - 0x74]
call edi
add esp, 4
mov ecx, dword [ebp - 0x3e8]
lea eax, [ebp - 0x194]
push eax
call fcn.004825a0
lea ecx, [ebp - 0x194]
call fcn.0047afe0
cmp dword [ebp - 0x78], 8
jb 0x560bc5
push dword [ebp - 0x8c]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x78], 7
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x7c], 0
mov word [ebp - 0x8c], ax
jb 0x560bea
push dword [ebp - 0x44]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
jmp 0x560c0f
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x560c19
push dword [ebp - 0x2c]
call edi
add esp, 4
mov ebx, dword [ebp - 0x3ec]
lea eax, [ebp - 0x3e4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x560880
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push dword [ebp - 0x3e8]
call fcn.0047b280
cmp dword [ebp - 0x48], 8
jb 0x560c57
push dword [ebp - 0x5c]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x48], 7
cmp dword [ebp - 0x90], 8
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
jb 0x560c7f
push dword [ebp - 0xa4]
call edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret 4