Function at 0x4fbdc8
Capabilities:
Enumerate files on windows

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x4fbdf0
test dword [0x7eeab0], 0xffffffff
jne 0x4fbff8
call fcn.006a7fbc
jmp fcn.004fbdc8
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov dword [esp + 4], edx
test ecx, ecx
je 0x4fbe3a
mov esi, 0x700ee0
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fbe06
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fbe27
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fbe12
dec eax
cmp byte [eax + 0x700edf], 0x5c
je 0x4fbe3c
mov byte [eax + 0x700ee0], 0x5c
inc eax
jmp 0x4fbe3c
xor eax, eax
lea edx, [eax + 0x700ee0]
mov byte [eax + 0x700ee0], 0
push 0x6d0b38
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
mov ecx, 0x13e
call fcn.004dc218
mov ebp, eax
push ebp
push 0x700ee0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4fbfde
mov eax, dword [ebp]
xor ecx, ecx
and eax, 0x10
mov edx, 1
cmovne ecx, edx
mov dword [esp], ecx
lea edi, [ebp + 0x2c]
mov dword [esp + 8], edi
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fbebe
test dl, dl
je 0x4fbeba
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fbebe
add edi, 2
add esi, 2
test dl, dl
jne 0x4fbe9e
xor eax, eax
jmp 0x4fbec3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fbefd
mov edi, dword [esp + 8]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fbef0
test dl, dl
je 0x4fbeec
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fbef0
add edi, 2
add esi, 2
test dl, dl
jne 0x4fbed0
xor eax, eax
jmp 0x4fbef5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4fbfa8
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4fbfc4
mov edi, dword [esp + 8]
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fbf37
test dl, dl
je 0x4fbf33
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fbf37
add edi, 2
add esi, 2
test dl, dl
jne 0x4fbf17
xor eax, eax
jmp 0x4fbf3c
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fbf95
mov edi, dword [esp + 8]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fbf69
test dl, dl
je 0x4fbf65
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fbf69
add edi, 2
add esi, 2
test dl, dl
jne 0x4fbf49
xor eax, eax
jmp 0x4fbf6e
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fbf95
mov eax, dword [ebp]
xor edx, edx
and eax, 0x10
mov esi, 1
cmovne edx, esi
mov edi, dword [esp + 0x20]
push edi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
call eax
test eax, eax
je 0x4fbfc4
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fbf0e
jmp 0x4fbfc4
mov eax, dword [esp + 0x20]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov esi, dword [esp + 8]
call esi
cmp eax, 1
je 0x4fbefd
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebp
call fcn.004db958
xor eax, eax
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret 4
mov ecx, ebp
call fcn.004db958
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret 4
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov dword [esp + 4], edx
test ecx, ecx
je 0x4fc042
mov esi, 0x700ee0
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fc00e
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fc02f
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fc01a
dec eax
cmp byte [eax + 0x700edf], 0x5c
je 0x4fc044
mov byte [eax + 0x700ee0], 0x5c
inc eax
jmp 0x4fc044
xor eax, eax
lea edx, [eax + 0x700ee0]
mov byte [eax + 0x700ee0], 0
push 0x6d0b38
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
mov ecx, 0x13e
call fcn.004dc218
mov ebp, eax
push ebp
push 0x700ee0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4fc1e0
mov eax, dword [ebp]
and eax, 0x10
xor edx, edx
test eax, eax
setne dl
mov dword [esp], edx
lea edi, [ebp + 0x2c]
mov dword [esp + 8], edi
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fc0c3
test dl, dl
je 0x4fc0bf
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fc0c3
add edi, 2
add esi, 2
test dl, dl
jne 0x4fc0a3
xor eax, eax
jmp 0x4fc0c8
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fc102
mov edi, dword [esp + 8]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fc0f5
test dl, dl
je 0x4fc0f1
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fc0f5
add edi, 2
add esi, 2
test dl, dl
jne 0x4fc0d5
xor eax, eax
jmp 0x4fc0fa
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4fc1aa
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4fc1c6
mov edi, dword [esp + 8]
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fc13c
test dl, dl
je 0x4fc138
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fc13c
add edi, 2
add esi, 2
test dl, dl
jne 0x4fc11c
xor eax, eax
jmp 0x4fc141
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fc197
mov edi, dword [esp + 8]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fc16e
test dl, dl
je 0x4fc16a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fc16e
add edi, 2
add esi, 2
test dl, dl
jne 0x4fc14e
xor eax, eax
jmp 0x4fc173
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fc197
mov eax, dword [ebp]
and eax, 0x10
xor edx, edx
test eax, eax
setne dl
mov esi, dword [esp + 0x20]
push esi
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 8]
call edi
test eax, eax
je 0x4fc1c6
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fc113
jmp 0x4fc1c6
mov esi, dword [esp + 0x20]
push esi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
call eax
cmp eax, 1
je 0x4fc102
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebp
call fcn.004db958
xor eax, eax
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret 4
mov ecx, ebp
call fcn.004db958
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret 4