Function at 0x49a690
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x34c
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x104
lea eax, [esp + 0x158]
mov esi, edx
push ebp
push eax
mov dword [esp + 0x1c], esi
call sub.storm.dll_Ordinal_501
lea ecx, [esp + 0x154]
push 0x5c
push ecx
call sub.storm.dll_Ordinal_572
test eax, eax
je 0x49a6cf
mov cl, byte [eax + 1]
test cl, cl
je 0x49a6e6
push 0x104
lea edx, [esp + 0x158]
push 0x4f15bc
push edx
call sub.storm.dll_Ordinal_503
push 0x104
lea eax, [esp + 0x158]
push esi
push eax
call sub.storm.dll_Ordinal_503
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x154]
push ecx
push edx
call edi
mov esi, eax
mov ebx, dword [esp + 0x370]
cmp esi, 0xffffffff
je 0x49a797
mov al, byte [esp + 0x14]
test al, 2
jne 0x49a768
test al, 0x10
je 0x49a74e
cmp byte [esp + 0x40], 0x2e
jne 0x49a743
mov al, byte [esp + 0x41]
test al, al
je 0x49a768
cmp al, 0x2e
jne 0x49a743
mov al, byte [esp + 0x42]
test al, al
je 0x49a768
mov eax, dword [esp + 0x364]
test eax, eax
je 0x49a768
mov eax, dword [esp + 0x36c]
push ebx
push eax
lea edx, [esp + 0x1c]
mov ecx, ebp
call dword [esp + 0x368]
test eax, eax
je 0x49a77a
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x49a790
jmp 0x49a71c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x368]
test esi, esi
je 0x49a90d
push 0x104
lea edx, [esp + 0x158]
push ebp
push edx
call sub.storm.dll_Ordinal_501
lea eax, [esp + 0x154]
push 0x5c
push eax
call sub.storm.dll_Ordinal_572
test eax, eax
je 0x49a7d3
mov cl, byte [eax + 1]
test cl, cl
je 0x49a7ea
push 0x104
lea ecx, [esp + 0x158]
push 0x4f15bc
push ecx
call sub.storm.dll_Ordinal_503
push 0x104
lea edx, [esp + 0x158]
push 0x4f18c0
push edx
call sub.storm.dll_Ordinal_503
lea eax, [esp + 0x14]
lea ecx, [esp + 0x154]
push eax
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x49a90d
mov al, byte [esp + 0x14]
test al, 2
jne 0x49a8db
test al, 0x10
je 0x49a8db
cmp byte [esp + 0x40], 0x2e
jne 0x49a852
mov al, byte [esp + 0x41]
test al, al
je 0x49a8db
cmp al, 0x2e
jne 0x49a852
mov al, byte [esp + 0x42]
test al, al
je 0x49a8db
push 0x104
lea edx, [esp + 0x25c]
push ebp
push edx
call sub.storm.dll_Ordinal_501
lea eax, [esp + 0x258]
push 0x5c
push eax
call sub.storm.dll_Ordinal_572
test eax, eax
je 0x49a87f
mov cl, byte [eax + 1]
test cl, cl
je 0x49a896
push 0x104
lea ecx, [esp + 0x25c]
push 0x4f15bc
push ecx
call sub.storm.dll_Ordinal_503
lea edx, [esp + 0x40]
push 0x104
lea eax, [esp + 0x25c]
push edx
push eax
call sub.storm.dll_Ordinal_503
mov ecx, dword [esp + 0x36c]
mov edx, dword [esp + 0x364]
mov eax, dword [esp + 0x360]
push ebx
push ecx
push esi
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x26c]
call fcn.0049a690
test eax, eax
je 0x49a8f0
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x49a906
jmp 0x49a81b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 0x14
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34c
ret 0x14