Function at 0x4c96af
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
mov edi, 0x585ce2
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.004c95f7
push 0x582088
push str._s.log
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
push 0xb
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0
push 0x184
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
lea eax, [ebp - 0x170]
push eax
push edi
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c9730
mov dword [ebp - 8], 1
jmp 0x4c9735
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x4c9801
test byte [ebp - 0x170], 0x10
je 0x4c9769
lea ecx, [ebp - 0x170]
push ecx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9801
mov dword [ebp - 8], 1
jmp 0x4c9801
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x144]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [0x56a724], 6
jne 0x4c97cf
push edi
push 0x582088
push 0x56a926
push 0x57cddf
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
push 0x57cddf
call fcn.0055482c
add esp, 8
test eax, eax
je 0x4c97d4
xor edx, edx
mov dword [ebp - 0x16], edx
jmp 0x4c97d4
xor ecx, ecx
mov dword [ebp - 0x16], ecx
push dword [ebp - 0x16]
push edi
push dword [ebp - 4]
call fcn.004c6a18
mov ebx, eax
test ebx, ebx
je 0x4c97e9
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x170]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9801
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x4c973f
cmp esi, 0xffffffff
je 0x4c9816
push esi
call sub.KERNEL32.dll_FindClose
push 0
push 5
push dword [ebp - 4]
call fcn.0050cb45
mov dword [ebp - 4], eax
push edi
push 0x3e7
push 0xd
push 0x66
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c98a4
mov esi, 1
cmp byte [edi], 0
je 0x4c987c
push 0x56a92c
push edi
call fcn.0054e548
add esp, 8
test eax, eax
je 0x4c986e
push 1
push 0
push dword [ebx]
push edi
call fcn.0051f0b8
test eax, eax
jne 0x4c987c
xor esi, esi
jmp 0x4c987c
push edi
push dword [ebx]
call fcn.0042d652
test eax, eax
jne 0x4c987c
xor esi, esi
test esi, esi
je 0x4c989d
push dword [ebx]
push 0
push 0x180
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4c98a4
cmp eax, 0xfffffffe
je 0x4c98a4
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4c983e
lea eax, [ebp - 4]
push eax
call fcn.004c6e49
push 1
push 0x56a930
push 0x67
push dword [ebp + 8]
call fcn.005217df
push 0
push 1
push 0x185
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 1
push 0xb
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0xc]
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4