Function at 0x480112d7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
push edi
jne 0x48011328
push 0x48024220
call fcn.48008b8a
pop ecx
mov edx, 0x104
mov edi, eax
call fcn.48001c88
push edi
call fcn.48008bb4
test al, al
pop ecx
jne 0x4801131e
mov edi, 0x13875e99
mov eax, 0x480275c0
call fcn.48009c63
or eax, 0xffffffff
mov ecx, esi
call fcn.480018d3
lea ecx, [ebp - 0xc]
call fcn.480017fe
lea eax, [ebp - 0xc]
push eax
mov ebx, str.ResourceDLL
push ebx
mov eax, str.HKCUSoftwareGoogleGoogle_Desktop
call fcn.480063ab
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], eax
mov edi, 0x4801c278
jl 0x480113c0
push 0
push 4
push str.multilanguage
lea ecx, [ebp - 0x14]
mov eax, str.HKLMSoftwareGoogleGoogle_Desktop
call fcn.480085f9
add esp, 0xc
test eax, eax
jl 0x480113c0
cmp dword [ebp - 0x14], 0
je 0x480113c0
mov eax, dword [esi]
sub eax, 0x10
call fcn.48001ca6
add eax, 0x10
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
push eax
call fcn.48004ebe
mov eax, dword [ebp - 0xc]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.48001d00
push dword [ebp - 4]
call fcn.4800e455
test al, al
pop ecx
jne 0x480113b3
mov dword [ebp - 8], 0x80004005
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.48001fbe
jmp 0x480113f9
lea eax, [ebp - 4]
push 0
push eax
call fcn.4800ac55
pop ecx
pop ecx
push str.trnews.exe
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.48001fbe
cmp byte [ebp - 0xd], 0
je 0x480113f9
mov dword [ebp - 8], 0x80004005
cmp dword [ebp - 8], 0
jge 0x480114f0
lea eax, [ebp - 0xc]
push eax
push ebx
mov eax, str.HKLMSoftwareGoogleGoogle_Desktop
call fcn.480063ab
test eax, eax
pop ecx
pop ecx
jge 0x480114f0
mov eax, dword [esi]
sub eax, 0x10
call fcn.48001ca6
add eax, 0x10
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 8]
push eax
call fcn.48004ebe
push str.GoogleDesktopResources_.dll
lea eax, [ebp - 8]
push eax
call fcn.48004ebe
and dword [ebp - 0x264], 0
xor eax, eax
mov ecx, 0x93
lea edi, [ebp - 0x260]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48011493
mov esi, dword [ebp + 8]
push 0
call fcn.48004c5c
lea eax, [edi - 0x10]
call fcn.48001fbe
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.48001fbe
mov eax, esi
jmp 0x4801150e
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.48004f15
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x480114d3
lea eax, [ebp - 0x238]
push 0x48021518
push eax
call fcn.4800c541
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x480114d3
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.48004f15
lea eax, [ebp - 0x264]
push eax
push esi
call ebx
test eax, eax
jne 0x480114ab
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [edi - 0x10]
call fcn.48001fbe
mov esi, dword [ebp - 0xc]
add esi, 0xfffffff0
mov eax, esi
call fcn.48001ca6
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.48001fbe
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret