Function at 0x4c96ae
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
mov edi, 0x5836b2
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.004c95f6
push 0x57fe40
push str._s.log
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
push 0xb
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0
push 0x184
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
lea eax, [ebp - 0x170]
push eax
push edi
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c972f
mov dword [ebp - 8], 1
jmp 0x4c9734
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x4c9800
test byte [ebp - 0x170], 0x10
je 0x4c9768
lea ecx, [ebp - 0x170]
push ecx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9800
mov dword [ebp - 8], 1
jmp 0x4c9800
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x144]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [0x56866c], 6
jne 0x4c97ce
push edi
push 0x57fe40
push 0x568861
push 0x57ac8f
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
push 0x57ac8f
call fcn.00552870
add esp, 8
test eax, eax
je 0x4c97d3
xor edx, edx
mov dword [ebp - 0x16], edx
jmp 0x4c97d3
xor ecx, ecx
mov dword [ebp - 0x16], ecx
push dword [ebp - 0x16]
push edi
push dword [ebp - 4]
call fcn.004c6a50
mov ebx, eax
test ebx, ebx
je 0x4c97e8
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x170]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9800
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x4c973e
cmp esi, 0xffffffff
je 0x4c9815
push esi
call sub.KERNEL32.dll_FindClose
push 0
push 5
push dword [ebp - 4]
call fcn.0050afb3
mov dword [ebp - 4], eax
push edi
push 0x3e7
push 0xd
push 0x66
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c98a3
mov esi, 1
cmp byte [edi], 0
je 0x4c987b
push 0x568867
push edi
call fcn.0054c58c
add esp, 8
test eax, eax
je 0x4c986d
push 1
push 0
push dword [ebx]
push edi
call fcn.0051d2f8
test eax, eax
jne 0x4c987b
xor esi, esi
jmp 0x4c987b
push edi
push dword [ebx]
call fcn.0042d3c0
test eax, eax
jne 0x4c987b
xor esi, esi
test esi, esi
je 0x4c989c
push dword [ebx]
push 0
push 0x180
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4c98a3
cmp eax, 0xfffffffe
je 0x4c98a3
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4c983d
lea eax, [ebp - 4]
push eax
call fcn.004c6e81
push 1
push 0x56886b
push 0x67
push dword [ebp + 8]
call fcn.0051f9e7
push 0
push 1
push 0x185
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 1
push 0xb
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0xc]
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4