Function at 0x489c20
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x470
mov eax, dword [0x4e3f80]
xor eax, esp
mov dword [esp + 0x46c], eax
mov eax, dword [esp + 0x474]
push ebx
push ebp
push esi
push edi
push 2
push str.ID_d_n
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov esi, edx
call fcn.00477b80
add esp, 8
test esi, esi
je 0x489c8a
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489c61
sub eax, edx
sar eax, 1
je 0x489c8a
push 0x104
lea edx, [esp + 0x274]
push esi
push edx
call fcn.0049f415
add esp, 0xc
jmp 0x489cb5
push str.BROWSER_PATH_PROJECTS
call fcn.0046ccd0
mov esi, eax
push 0x104
lea eax, [esp + 0x274]
push esi
push eax
call fcn.0049f415
add esp, 0xc
push esi
call fcn.0049081d
add esp, 4
push 0x21de
call fcn.00490828
add esp, 4
push 6
lea edx, [esp + 0x274]
mov ebp, eax
xor ecx, ecx
push str..foe
push edx
mov word [ebp], cx
call fcn.0049f45f
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x489d06
xor edx, edx
mov word [ebp], dx
jmp 0x489e73
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489d10
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
je 0x489d49
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
jmp 0x489d30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489d30
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
cmp eax, 0x104
jae 0x489d88
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489d50
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
je 0x489d84
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
jmp 0x489d70
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489d70
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
jmp 0x489d8d
xor eax, eax
jmp 0x489d8d
mov eax, 0x104
push eax
lea eax, [esp + 0x50]
push eax
push ebp
call fcn.0049f45f
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push edi
call esi
test eax, eax
je 0x489e6c
push 1
push 0x4c5d6c
push ebp
call fcn.0049f45f
lea eax, [esp + 0x58]
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489dd0
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
je 0x489e09
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
jmp 0x489df0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489df0
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
cmp eax, 0x104
jae 0x489e48
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489e10
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
je 0x489e44
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
jmp 0x489e30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489e30
sub eax, edx
sar eax, 1
add eax, 0xfffffffc
jmp 0x489e4d
xor eax, eax
jmp 0x489e4d
mov eax, 0x104
push eax
lea edx, [esp + 0x50]
push edx
push ebp
call fcn.0049f45f
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push edi
call esi
test eax, eax
jne 0x489db2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
lea edx, [eax + 2]
jmp 0x489e80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489e80
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
lea ebx, [edi + edi]
push ebx
call fcn.0049f632
add esp, 4
push edi
mov esi, eax
push ebp
push esi
call fcn.0049f415
add esp, 0xc
push ebp
call fcn.0049081d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 4
push esi
push ecx
push edx
mov edx, ebx
mov al, 2
call fcn.0048fcb0
push esi
mov edi, eax
call fcn.0049e328
mov ecx, dword [esp + 0x480]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049dc2a
add esp, 0x470
ret 4