Function at 0x482610
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50afe8
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x564690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x494], ecx
mov ebx, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x478], ebx
call fcn.004e6690
push 0x5239b8
lea eax, [ebp - 0x490]
push ebx
push eax
call fcn.004029e0
add esp, 0x18
mov esi, dword [ebp - 0x490]
lea ecx, [ebp - 0x218]
mov eax, ecx
mov dword [ebp - 4], 0
mov edx, 0x104
sub esi, eax
lea esp, [esp]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4826be
movzx eax, word [esi + ecx]
test ax, ax
je 0x4826be
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x4826a0
jmp 0x4826c2
test edx, edx
jne 0x4826c5
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x470], ebx
cmp ebx, 0xffffffff
jne 0x48273c
call fcn.00488e50
test al, al
jne 0x482735
mov esi, dword [0x565ae0]
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e3b54
push eax
call fcn.004e5c83
add esp, 8
xor bl, bl
jmp 0x482c9d
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 0
mov byte [ebp - 4], 1
call fcn.00488af0
test al, al
jne 0x48276f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
lea edi, [ebp - 0x43c]
shr edi, 0x10
mov dword [ebp - 0x474], edi
mov esi, 0xe
mov ecx, dword [0x565ae0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
idiv esi
cmp edx, 0xa
jne 0x4827bb
mov eax, 0xb2
mov esi, 0xde
test esi, esi
je 0x4827b4
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x4827a3
add eax, esi
mov dword [0x565ae0], eax
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x46c], esi
mov byte [ebp - 4], 2
test edi, edi
jne 0x482800
lea eax, [ebp - 0x43c]
movzx edi, ax
push 0
push edi
call fcn.00402e50
add esp, 8
test eax, eax
je 0x482838
push edi
push eax
lea ecx, [ebp - 0x46c]
call fcn.00407600
jmp 0x482832
lea ecx, [ebp - 0x43c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x482810
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x46c]
call fcn.00409890
mov esi, dword [ebp - 0x46c]
mov byte [ebp - 4], 3
mov ecx, 0x5189b0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x482869
test dx, dx
je 0x482865
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x482869
add eax, 4
add ecx, 4
test dx, dx
jne 0x482843
xor eax, eax
jmp 0x48286e
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x4829a0
mov ecx, 0x5239bc
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4828a8
test dx, dx
je 0x4828a4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4828a8
add eax, 4
add ecx, 4
test dx, dx
jne 0x482882
xor eax, eax
jmp 0x4828ad
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x4829a0
test byte [ebp - 0x468], 0x10
jne 0x4829a0
cmp dword [esi - 0xc], 0
jl 0x4829a0
push str..sqlite
push esi
call fcn.004e5d72
add esp, 8
test eax, eax
je 0x4829a0
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x4829a0
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x478]
lea eax, [ebp - 0x48c]
push eax
call fcn.00402920
add esp, 0xc
mov ecx, dword [ebp - 0x494]
push eax
mov byte [ebp - 4], 4
call fcn.00480900
mov edi, dword [ebp - 0x48c]
add edi, 0xfffffff0
mov bl, al
mov byte [ebp - 4], 3
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x482946
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x48299a
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x478]
lea eax, [ebp - 0x47c]
push eax
call fcn.00402920
add esp, 0xc
push eax
lea ecx, [ebp - 0x488]
mov byte [ebp - 4], 5
call fcn.0040c5e0
mov edx, dword [ebp - 0x47c]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x48299a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x470]
add esi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4829be
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x468]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x474]
mov esi, 0xe
test eax, eax
jne 0x482783
test ebx, ebx
je 0x4829ea
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x484]
mov edi, dword [ebp - 0x488]
mov ecx, edx
sub ecx, edi
sar ecx, 2
xor eax, eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x47c], ecx
test ecx, ecx
jle 0x482c55
mov esi, dword [edi + eax*4]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x482a3c
cmp ecx, dword [esi - 0x10]
jne 0x482a3c
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x482a75
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x482ce4
mov ecx, dword [esi - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esi - 0xc]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ecx*2 + 2]
push esi
push eax
lea eax, [edi + 0x10]
push eax
call fcn.004e5c88
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [ebp - 0x48c], eax
lea esi, [eax - 0x10]
push ecx
mov ecx, dword [esi]
mov byte [ebp - 4], 6
mov eax, dword [ecx]
mov ebx, esp
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x482aab
cmp ecx, dword [esi]
jne 0x482aab
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x482ae7
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x482ce4
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.004e5c88
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [ebx], eax
call fcn.0040d6f0
mov ecx, dword [esi]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x482b17
cmp ecx, dword [esi]
jne 0x482b17
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x482b53
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x482ce4
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.004e5c88
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [ebp - 0x478], eax
push 0x51661c
push str..sqlite
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 7
call fcn.004078e0
mov edi, dword [ebp - 0x478]
push 1
push ecx
mov ecx, dword [edi - 0x10]
add edi, 0xfffffff0
mov eax, dword [ecx]
mov dword [ebp - 0x474], esp
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x482bab
cmp ecx, dword [edi]
jne 0x482bab
mov ebx, edi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x482be7
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x482ce4
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004e5c88
add esp, 0x10
mov ecx, dword [ebp - 0x474]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
call fcn.0040d500
add esp, 8
mov byte [ebp - 4], 6
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x482c15
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x482c30
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x470]
mov edi, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x470], eax
cmp eax, dword [ebp - 0x47c]
jl 0x482a13
mov edx, dword [ebp - 0x484]
mov bl, 1
mov byte [ebp - 4], 0
test edi, edi
je 0x482c9d
mov esi, edi
cmp edi, edx
je 0x482c94
or edi, 0xffffffff
mov edx, dword [esi]
sub edx, 0x10
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x482c83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, dword [ebp - 0x484]
jne 0x482c68
mov edi, dword [ebp - 0x488]
push edi
call fcn.004e48b8
add esp, 4
mov esi, dword [ebp - 0x490]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x482cc4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e50b4
mov esp, ebp
pop ebp
ret 4
call fcn.00409c50
int3