Function at 0x468e80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e58d
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x27c], esi
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
push dword [eax + 4]
call fcn.0046ee40
mov eax, dword [esi]
push 0x5c
push ebx
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
mov dword [esi + 4], 0
call fcn.00472b95
add esp, 8
test eax, eax
je 0x468ef2
add eax, 2
mov dword [ebp - 0x264], eax
jmp 0x468f14
push 0x2f
push ebx
call fcn.00472b95
add esp, 8
test eax, eax
je 0x468f0c
add eax, 2
mov dword [ebp - 0x264], eax
jmp 0x468f14
mov eax, ebx
mov dword [ebp - 0x264], ebx
push 0x2e
push eax
call fcn.00472b95
mov edi, eax
add esp, 8
mov dword [ebp - 0x268], edi
mov esi, edi
test edi, edi
je 0x468f5e
cmp edi, ebx
jbe 0x468f4f
movzx eax, word [esi - 2]
push eax
call fcn.00473a07
add esp, 4
test eax, eax
je 0x468f49
add esi, 0xfffffffe
cmp esi, ebx
ja 0x468f31
mov edi, dword [ebp - 0x268]
cmp word [esi - 2], 0x2d
lea eax, [esi - 2]
mov esi, edi
cmove esi, eax
jmp 0x468f78
push 0
push dword [ebp - 0x264]
call fcn.00472b95
mov edi, eax
mov dword [ebp - 0x268], eax
add esp, 8
mov esi, edi
mov ecx, esi
sub ecx, ebx
sar ecx, 1
mov eax, ecx
neg eax
sbb eax, eax
and eax, 2
push eax
push 0x490b00
lea eax, [ecx + ecx]
push eax
push ebx
call fcn.0046b7a0
mov dword [ebp - 0x26c], eax
push edi
mov dword [ebp - 4], 0
call fcn.0046b670
push eax
push edi
call fcn.0046b800
mov dword [ebp - 0x274], eax
push 0x49c5a0
mov byte [ebp - 4], 1
call fcn.0046b670
push eax
push 0x49c5a0
call fcn.0046b800
add esp, 0x28
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x26c]
call fcn.0046b3d0
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x270]
push ecx
mov ecx, eax
call fcn.0046b3d0
mov ecx, dword [ebp - 0x280]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x469022
call fcn.0046b840
mov ecx, dword [ebp - 0x278]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x469035
call fcn.0046b840
mov ecx, dword [ebp - 0x274]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x469048
call fcn.0046b840
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x270]
call fcn.0046b310
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x284], eax
cmp eax, 0xffffffff
je 0x469164
sub esi, dword [ebp - 0x264]
lea edi, [ebp - 0x234]
mov ebx, dword [ebp - 0x268]
sar esi, 1
lea edi, [edi + esi*2]
mov esi, edi
cmp word [esi], 0x2d
jne 0x4690b7
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.00473a07
add esp, 4
test eax, eax
je 0x4690b7
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.00473a07
add esp, 4
test eax, eax
jne 0x4690a3
push ebx
push esi
call fcn.0047097c
add esp, 8
test eax, eax
jne 0x469141
push edi
call fcn.0046b670
push eax
push edi
call fcn.0046b800
add esp, 0xc
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x26c]
call fcn.0046b3d0
mov ecx, dword [ebp - 0x268]
mov byte [ebp - 4], 0xa
test ecx, ecx
je 0x46910b
call fcn.0046b840
movzx eax, byte [0x4c3668]
mov ecx, dword [ebp - 0x27c]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
lea eax, [ebp - 0x28c]
push eax
call fcn.00467060
mov ecx, dword [ebp - 0x264]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x469141
call fcn.0046b840
mov esi, dword [ebp - 0x284]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x469087
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x270]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x469177
call fcn.0046b840
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x46918d
call fcn.0046b840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret 4