Function at 0x5ea8e0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x3a4
lea edx, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3b4]
push edi
lea eax, [esi + 0xc]
push eax
push edx
call fcn.005ea460
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push edi
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
push 0x60b218
lea eax, [esp + 0x164]
push ecx
push eax
call fcn.005f0fcb
mov edx, dword [str.updates_]
lea ecx, [esp + 0x16c]
push ecx
push edx
lea eax, [esp + 0x2a0]
push str._s_s
push eax
call fcn.005f106c
add esp, 0x20
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x288]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x5ea979
lea ecx, [esp + 0x10]
call fcn.00406010
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x3a4
ret 4
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x48]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jbe 0x5eaa08
lea edi, [esp + 0x48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, dword [esi + 0x24]
not ecx
dec ecx
lea eax, [esp + ecx + 0x3e]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x5ea9d4
test cl, cl
je 0x5ea9d0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x5ea9d4
add eax, 2
add esi, 2
test cl, cl
jne 0x5ea9ac
xor eax, eax
jmp 0x5ea9d9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jl 0x5eaa08
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0041d810
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3a4
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x1c]
push edx
push ebp
call ebx
test eax, eax
je 0x5eaa8f
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x48]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jbe 0x5eaa83
mov eax, dword [esp + 0x3b8]
lea edi, [esp + 0x48]
or ecx, 0xffffffff
mov esi, dword [eax + 0x24]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x3e]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x5eaa7a
test cl, cl
je 0x5eaa76
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x5eaa7a
add eax, 2
add esi, 2
test cl, cl
jne 0x5eaa56
xor eax, eax
jmp 0x5eaa7f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jge 0x5eaac3
lea eax, [esp + 0x1c]
push eax
push ebp
call ebx
test eax, eax
jne 0x5eaa1a
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub eax, ecx
test ecx, ecx
je 0x5eab07
cmp eax, 0x80
jbe 0x5eaaf1
push ecx
call fcn.005f0905
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a4
ret 4
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5eaae2
mov ecx, dword [esp + 0x18]
sub ecx, eax
push ecx
push eax
call fcn.00406670
add esp, 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3a4
ret 4
dec eax
shr eax, 3
mov edx, dword [eax*4 + 0x61f1a0]
lea eax, [eax*4 + 0x61f1a0]
mov dword [ecx], edx
mov dword [eax], ecx
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x3a4
ret 4