Function at 0x10048450
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100852e2
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov eax, esp
mov dword [ebp - 0x264], esp
push str.EnumCredBackup:_in
push eax
call fcn.1003a800
add esp, 4
mov dword [ebp - 4], 0
mov ecx, esp
push 0x100981f8
call fcn.10022bb0
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
call fcn.10039770
add esp, 8
lea ecx, [ebp - 0x264]
push str.EnumCredBackup:_in
call fcn.10022bb0
mov dword [ebp - 4], 1
cmp byte [0x100b0b25], 0
je 0x100484ea
mov edx, dword [ebp - 0x264]
mov ecx, dword [0x100b2f04]
call fcn.10046b20
mov edx, dword [ebp - 0x264]
call fcn.100394f0
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp - 0x264]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1004851e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10093ad0
mov edx, 0x100b2f08
lea ecx, [ebp - 0x26c]
call fcn.10022e60
add esp, 4
lea eax, [ebp - 0x260]
mov dword [ebp - 4], 2
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10048657
jmp 0x10048560
test byte [ebp - 0x260], 0x10
jne 0x10048637
lea eax, [ebp - 0x234]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10048576
sub eax, edx
sar eax, 1
cmp eax, 0x40
jne 0x10048637
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push str.EnumCredBackup:_Found_credential__file____ws_
push eax
call fcn.1003a800
add esp, 0xc
mov byte [ebp - 4], 3
cmp byte [0x100b0b25], 0
je 0x100485c7
mov edx, dword [ebp - 0x264]
mov ecx, dword [0x100b2f04]
call fcn.10046b20
mov edx, dword [ebp - 0x264]
call fcn.100394f0
mov byte [ebp - 4], 2
mov ecx, esi
mov edx, dword [ebp - 0x264]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100485f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
lea eax, [ebp - 0x234]
mov ecx, esp
push eax
lea edi, [ebp - 0x268]
call fcn.10022bb0
xor edx, edx
mov ecx, edi
call fcn.10047bf0
add esp, 4
test eax, eax
jne 0x10048637
mov edi, dword [ebp - 0x268]
push eax
push edi
call fcn.10048730
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x1004864d
or esi, 0xffffffff
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10048560
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
push str.EnumCredBackup:_out
lea ecx, [ebp - 0x268]
call fcn.10022bb0
mov byte [ebp - 4], 4
cmp byte [0x100b0b25], 0
je 0x10048685
mov edx, dword [ebp - 0x268]
mov ecx, dword [0x100b2f04]
call fcn.10046b20
mov edx, dword [ebp - 0x268]
call fcn.100394f0
mov byte [ebp - 4], 2
mov ecx, esi
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100486b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.EnumCredBackup:_out
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
push 0x100981f8
call fcn.10022bb0
xor ecx, ecx
mov byte [ebp - 4], 2
call fcn.10039770
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10048709
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006abfd
mov esp, ebp
pop ebp
ret