Function at 0x47e0e6
Capabilities:
Enumerate files on windows
Enumerate files recursively
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1bbc
call fcn.004113d0
mov eax, dword [0x4b22d4]
xor eax, esp
mov dword [esp + 0x1bb8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x2c]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x30]
xor ebx, ebx
push 0x13c
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x78]
push ebx
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x7c], ebx
call fcn.00401f80
add esp, 0xc
mov esi, 0x7ff
push esi
lea eax, [esp + 0x3c5]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], ebx
mov byte [esp + 0x3cc], bl
call fcn.00401f80
add esp, 0xc
push esi
lea eax, [esp + 0xbc5]
push ebx
push eax
mov byte [esp + 0xbcc], bl
call fcn.00401f80
add esp, 0xc
push esi
lea eax, [esp + 0x13c5]
push ebx
push eax
mov byte [esp + 0x13cc], bl
call fcn.00401f80
add esp, 0xc
mov edx, edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.00436c5d
test eax, eax
je 0x47e1c6
call fcn.0047e096
xor eax, eax
jmp 0x47ec7a
mov edx, dword [esp + 0x18]
call fcn.00436c5d
test eax, eax
jne 0x47e1ba
push edi
mov ecx, 0x800
lea eax, [esp + 0xbc4]
call fcn.00435b27
mov edx, dword [esp + 0x3c]
pop ecx
call fcn.00436c5d
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [esp + 0x48], edi
cmp dword [esp + 0x38], ebx
jne 0x47e234
cmp dword [ebp + 0x28], ebx
je 0x47e234
xor eax, eax
mov word [esp + 0x60], ax
lea edi, [esp + 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x4c4c9c
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edi, dword [esp + 0x48]
cmp edi, ebx
je 0x47e24d
push dword [esp + 0x38]
lea ecx, [esp + 0xbc4]
call fcn.00436910
jmp 0x47e355
lea esi, [esp + 0xbc0]
call fcn.00436761
cmp byte [esp + 0xbc0], bl
je 0x47e27b
mov eax, esi
push eax
call fcn.00401a80
pop ecx
mov ecx, esi
cmp byte [eax + ecx - 1], 0x5c
jne 0x47e27b
push 0x48d2a0
jmp 0x47e292
lea eax, [esp + 0xbc0]
push eax
call fcn.004732c3
pop ecx
test eax, eax
je 0x47e2a1
push 0x48d2a4
lea eax, [esp + 0xbc4]
push eax
call fcn.00401bb0
pop ecx
pop ecx
push dword [esp + 0x18]
push dword [esp + 0x2c]
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x47e2c2
push dword [esp + 0x18]
call fcn.004732c3
pop ecx
test eax, eax
je 0x47e33e
push dword [esp + 0x18]
mov edi, 0x800
mov ecx, edi
lea eax, [esp + 0x13c4]
call fcn.00435b27
pop ecx
push dword [esp + 0x18]
call fcn.004732c3
pop ecx
test eax, eax
jne 0x47e2f7
push 3
pop eax
lea esi, [esp + 0x13c0]
call fcn.0043789f
push str..ark
mov eax, edi
lea esi, [esp + 0x13c4]
call fcn.00436c1c
mov eax, esi
pop ecx
mov dword [esp + 0x18], eax
xor esi, esi
lea edi, [esp + 0x13c0]
call fcn.00474f3d
test eax, eax
je 0x47e33e
mov eax, edi
push str..ark
push eax
call fcn.00401bb0
inc esi
pop ecx
mov eax, edi
pop ecx
mov dword [esp + 0x18], eax
cmp esi, 0xa
jl 0x47e313
push dword [esp + 0x18]
mov ecx, 0x800
mov eax, 0x4c3c98
call fcn.00435b27
mov edi, dword [esp + 0x4c]
pop ecx
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0xbc4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x47e1ba
mov dword [esp + 0x10], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
lea esi, [esp + 0x9c]
call fcn.004359d7
cmp byte [esp + 0x9c], bl
je 0x47e9bd
test byte [esp + 0x70], 0x10
jne 0x47e9bd
cmp byte [esp + 0x9c], 0x2e
je 0x47e9bd
cmp dword [ebp + 0x18], ebx
jne 0x47e3c8
test byte [esp + 0x70], 2
jne 0x47e9bd
cmp dword [ebp + 0x1c], ebx
jne 0x47e3d8
test byte [esp + 0x70], 4
jne 0x47e9bd
cmp edi, ebx
jne 0x47e4d5
push dword [esp + 0x18]
lea edx, [esp + 0xa0]
call fcn.00436a30
pop ecx
test eax, eax
je 0x47e4d5
mov esi, 0x103
push esi
lea eax, [esp + 0x1b5]
push ebx
push eax
mov byte [esp + 0x1bc], bl
call fcn.00401f80
add esp, 0xc
push esi
lea eax, [esp + 0x2bd]
push ebx
push eax
mov byte [esp + 0x2c4], bl
call fcn.00401f80
add esp, 0xc
lea eax, [esp + 0xbc0]
push eax
inc esi
mov ecx, esi
lea eax, [esp + 0x1b4]
mov dword [esp + 0x60], ebx
call fcn.00435b27
pop ecx
call fcn.00435996
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x1b4]
push eax
call fcn.00401bb0
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x1bc]
push eax
call fcn.00401811
add esp, 0x10
test eax, eax
jne 0x47e49e
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x1b4]
push eax
push esi
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x2bc]
push eax
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [esp + 0x2b8]
push eax
lea eax, [esp + 0x1b4]
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x47e9bd
cmp dword [0x4c3c90], ebx
je 0x47e51a
lea eax, [esp + 0x9c]
push eax
call fcn.00434bdf
pop ecx
test eax, eax
je 0x47e51a
lea eax, [esp + 0x9c]
push eax
call fcn.004347e6
mov esi, dword [0x4c3c90]
pop ecx
call fcn.004345d3
test eax, eax
jg 0x47e9bd
call fcn.0047e096
jmp 0x47e9bd
lea eax, [esp + 0xbc0]
push eax
mov ecx, 0x800
lea eax, [esp + 0x3c4]
call fcn.00435b27
pop ecx
call fcn.00435996
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x3c4]
push eax
call fcn.00401bb0
push 0x865
push str.Archive.c
mov edx, 0x48d1ec
lea ecx, [esp + 0x3d0]
call fcn.00473c34
add esp, 0x10
mov dword [esp + 0x34], eax
cmp eax, ebx
je 0x47e9bd
cmp dword [esp + 0x14], ebx
jne 0x47e63d
mov edi, dword [esp + 0x18]
call fcn.00474f3d
test eax, eax
je 0x47e615
cmp dword [ebp + 0x24], ebx
je 0x47e5b0
push str..exe
mov esi, edi
call fcn.0043783d
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
jne 0x47e615
mov ecx, dword [esp + 0x18]
push 0x86f
push str.Archive.c
mov edx, 0x48d2b0
call fcn.00473c34
mov edi, eax
pop ecx
pop ecx
mov dword [esp + 0x14], edi
cmp edi, ebx
je 0x47ec24
mov esi, dword [esp + 0x18]
push str..exe
call fcn.0043783d
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
jne 0x47e5fd
mov esi, edi
call fcn.0047d8d1
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jl 0x47ec24
push 2
push ebx
push edi
call fcn.0040287c
add esp, 0xc
jmp 0x47e633
mov ecx, dword [esp + 0x18]
push 0x887
push str.Archive.c
mov edx, 0x48d230
call fcn.00473c34
pop ecx
pop ecx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x47ec24
cmp dword [esp + 0x1c], ebx
jne 0x47e65d
push 1
push 0xc366
call fcn.00401a3a
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x47ec24
mov esi, dword [esp + 0x14]
push esi
call fcn.0040278d
pop ecx
mov dword [esp + 0x58], eax
cmp eax, ebx
jl 0x47ec24
sub eax, dword [esp + 0x30]
jne 0x47e717
push esi
xor edi, edi
inc edi
push edi
lea eax, [esp + 0x4c]
push 4
push eax
mov dword [esp + 0x54], ebx
call fcn.0040257f
add esp, 0x10
cmp eax, edi
jb 0x47ec24
push esi
push edi
lea eax, [esp + 0x48]
push 4
push eax
mov dword [esp + 0x50], ebx
call fcn.0040257f
add esp, 0x10
cmp eax, edi
jb 0x47ec24
push 8
push ebx
mov edi, 0x4c4ca4
push edi
call fcn.00401f80
add esp, 0xc
push esi
push 1
push 8
push edi
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jb 0x47ec24
mov esi, str.222PAULAARCHIVE222JesusIAdoreYou
push esi
push 0x48d2b4
push dword [esp + 0x1c]
call fcn.00402261
add esp, 0xc
test eax, eax
jle 0x47ec24
push esi
call fcn.00401a80
pop ecx
mov ecx, dword [esp + 0x30]
lea eax, [eax + ecx + 0x10]
mov dword [esp + 0x58], eax
jmp 0x47e71c
mov edi, 0x4c4ca4
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push 1
push 4
push eax
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jb 0x47ec24
mov esi, dword [esp + 0x50]
cmp esi, ebx
je 0x47e7ac
lea eax, [esp + 0xbc0]
push eax
mov ecx, 0x800
lea eax, [esp + 0x3c4]
call fcn.00435b27
pop ecx
call fcn.00435996
mov eax, esi
call fcn.00435b67
test eax, eax
jne 0x47e77e
lea eax, [esp + 0x3c0]
push eax
call fcn.00435ab2
pop ecx
test eax, eax
jne 0x47e7bd
push ebx
lea eax, [esp + 0x3c4]
push esi
push eax
call fcn.004377f4
add esp, 0xc
lea esi, [esp + 0x3c0]
call fcn.00436b22
mov edx, esi
lea ecx, [esp + 0x9c]
call fcn.0043794f
jmp 0x47e7bd
push dword [esp + 0x38]
lea ecx, [esp + 0xa0]
call fcn.00436910
pop ecx
push dword [esp + 0x14]
lea eax, [esp + 0xa0]
push eax
call fcn.00401a80
pop ecx
inc eax
push eax
lea eax, [esp + 0xa4]
push 1
push eax
call fcn.0040257f
mov esi, eax
lea eax, [esp + 0xac]
push eax
call fcn.00401a80
add esp, 0x14
inc eax
cmp esi, eax
jb 0x47ec24
lea esi, [esp + 0x9c]
call fcn.004359d7
cmp dword [ebp + 0x28], ebx
je 0x47e824
mov eax, dword [0x4c4c9c]
mov dword [esp + 0x84], eax
mov eax, dword [0x4c4ca0]
mov dword [esp + 0x88], eax
push dword [esp + 0x14]
lea eax, [esp + 0x88]
push 1
push 8
push eax
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jb 0x47ec24
push edi
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x47e870
mov eax, dword [esp + 0x84]
mov dword [0x4c4ca4], eax
mov eax, dword [esp + 0x88]
mov dword [0x4c4ca8], eax
push dword [esp + 0x34]
inc dword [esp + 0x30]
mov edi, 0x56ce
push edi
push 1
push dword [esp + 0x28]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
call fcn.00402244
movzx esi, ax
add esp, 0x10
cmp si, bx
jbe 0x47e94b
mov eax, dword [esp + 0x1c]
add eax, edi
mov dword [esp + 0x4c], eax
push dword [ebp + 0x34]
mov ebx, dword [esp + 0x50]
push dword [esp + 0x58]
push esi
push dword [esp + 0x28]
call fcn.0047dd01
push dword [esp + 0x24]
movzx eax, ax
push 1
mov dword [esp + 0x54], eax
lea eax, [esp + 0x54]
push 2
push eax
call fcn.0040257f
add esp, 0x20
cmp eax, 1
jae 0x47e8e9
and dword [esp + 0x10], 0
push dword [esp + 0x14]
movzx eax, word [esp + 0x40]
movzx ebx, word [esp + 0x40]
push eax
push 1
push dword [esp + 0x58]
call fcn.0040257f
add esp, 0x10
cmp eax, ebx
jae 0x47e90f
and dword [esp + 0x10], 0
add dword [esp + 0x24], 2
cmp si, di
jae 0x47e926
mov eax, dword [esp + 0x28]
inc dword [esp + 0x28]
cmp eax, 0xa
jg 0x47e949
push dword [esp + 0x34]
add dword [esp + 0x28], ebx
push edi
push 1
push dword [esp + 0x28]
call fcn.00402244
movzx esi, ax
add esp, 0x10
test si, si
jne 0x47e8ae
xor ebx, ebx
push ebx
push dword [esp + 0x5c]
push dword [esp + 0x1c]
call fcn.0040287c
add esp, 0xc
test eax, eax
je 0x47e964
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push 1
push 4
push eax
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jae 0x47e982
mov dword [esp + 0x10], ebx
push 2
push ebx
push dword [esp + 0x1c]
call fcn.0040287c
add esp, 0xc
test eax, eax
je 0x47e999
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x34]
call fcn.00475e84
push 0x140
lea eax, [esp + 0x74]
push ebx
push eax
mov dword [esp + 0x40], ebx
call fcn.00401f80
mov edi, dword [esp + 0x54]
add esp, 0xc
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47e386
cmp dword [ebp + 0x14], ebx
je 0x47eb50
cmp dword [esp + 0x20], ebx
je 0x47e9ed
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0xbc0]
push eax
mov ecx, 0x800
lea eax, [esp + 0x3c4]
call fcn.00435b27
pop ecx
push eax
call fcn.00401a80
pop ecx
lea ecx, [esp + 0x3c0]
cmp byte [eax + ecx - 1], 0x5c
je 0x47ea23
mov eax, ecx
call fcn.00435996
lea eax, [esp + 0x3c0]
push 0x48d2a0
push eax
call fcn.00401bb0
pop ecx
pop ecx
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x3c4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x47ec28
test byte [esp + 0x70], 0x10
je 0x47eb26
lea esi, [esp + 0x9c]
call fcn.004359d7
cmp byte [esp + 0x9c], bl
je 0x47eb39
cmp byte [esp + 0x9c], 0x2e
je 0x47eb39
cmp dword [ebp + 0x18], ebx
jne 0x47ea99
test byte [esp + 0x70], 2
jne 0x47eb39
cmp dword [ebp + 0x1c], ebx
jne 0x47eaa9
test byte [esp + 0x70], 4
jne 0x47eb39
cmp dword [esp + 0x1c], ebx
je 0x47eabd
push dword [esp + 0x1c]
call fcn.00401a00
pop ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x47eace
call fcn.00475e84
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x3c4]
push 0x48d2b8
push eax
call fcn.00401954
add esp, 0xc
push dword [ebp + 0x34]
lea eax, [esp + 0x3c4]
push eax
push dword [esp + 0x58]
lea eax, [esp + 0xbcc]
push dword [ebp + 0x28]
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esp + 0x78]
push dword [esp + 0x40]
push eax
call fcn.0047e0e6
add esp, 0x30
add dword [esp + 0x2c], eax
push 0x140
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.00401f80
add esp, 0xc
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47ea57
cmp dword [esp + 0x38], ebx
jne 0x47ec28
cmp dword [esp + 0x2c], ebx
jle 0x47ec28
cmp dword [esp + 0x14], ebx
jne 0x47eb90
mov ecx, dword [esp + 0x18]
push 0x9a6
push str.Archive.c
mov edx, 0x48d2b0
call fcn.00473c34
pop ecx
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x47ec24
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x14]
push ebx
add esi, 8
push esi
push edi
call fcn.0040287c
add esp, 0xc
push edi
push 1
push 8
push 0x4c4ca4
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jae 0x47ebc1
mov dword [esp + 0x10], ebx
push ebx
push esi
push edi
call fcn.0040287c
add esp, 0xc
xor ecx, ecx
mov edx, edi
call fcn.0047d72b
push edi
mov dword [esp + 0x44], eax
call fcn.0040278d
pop ecx
push ebx
push dword [esp + 0x34]
mov dword [esp + 0x4c], eax
push edi
call fcn.0040287c
add esp, 0xc
push edi
push 1
lea eax, [esp + 0x4c]
push 4
push eax
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jae 0x47ec0d
mov dword [esp + 0x10], ebx
push edi
push 1
lea eax, [esp + 0x48]
push 4
push eax
call fcn.0040257f
add esp, 0x10
cmp eax, 1
jae 0x47ec28
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
je 0x47ec35
call fcn.00475e84
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x47ec42
call fcn.00475e84
cmp dword [esp + 0x20], ebx
je 0x47ec59
cmp dword [esp + 0x20], 0xffffffff
je 0x47ec59
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x1c], ebx
je 0x47ec69
push dword [esp + 0x1c]
call fcn.00401a00
pop ecx
call fcn.0047e096
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1bc4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401317
mov esp, ebp
pop ebp
ret