Function at 0x4f6fd8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x3d
push 0
push 0
dec ecx
jne 0x4f6fe1
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004046b8
mov eax, dword [ebp + 0x10]
call fcn.004046b8
xor eax, eax
push ebp
push 0x4f766c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4f762f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 8]
call fcn.004044c8
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00404728
mov eax, dword [ebp - 0x158]
mov edx, 0x4f7684
call fcn.00404614
jne 0x4f706a
mov eax, dword [ebp - 8]
call fcn.004044c8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 1
call fcn.00404768
lea edx, [ebp - 0x15c]
mov eax, dword [ebp - 8]
call fcn.004089c4
cmp dword [ebp - 0x15c], 0
jne 0x4f70a5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x160]
call fcn.004e9f20
mov eax, dword [ebp - 0x160]
mov ecx, 2
mov edx, 1
call fcn.00404728
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x164]
push eax
lea edx, [ebp - 0x16c]
mov eax, 0x19
call fcn.004e57b0
lea eax, [ebp - 0x16c]
mov edx, 0x4f7690
call fcn.004044d0
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.00408774
mov eax, dword [ebp - 0x168]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7105
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x170]
push eax
lea edx, [ebp - 0x178]
mov eax, 0x19
call fcn.004e57b0
lea eax, [ebp - 0x178]
mov edx, 0x4f76a0
call fcn.004044d0
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00408774
mov eax, dword [ebp - 0x174]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7165
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x17c]
push eax
lea edx, [ebp - 0x184]
mov eax, 0x18
call fcn.004e57b0
lea eax, [ebp - 0x184]
mov edx, 0x4f76b0
call fcn.004044d0
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00408774
mov eax, dword [ebp - 0x180]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f71c5
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x188]
push eax
lea edx, [ebp - 0x190]
mov eax, 0x18
call fcn.004e57b0
lea eax, [ebp - 0x190]
mov edx, 0x4f76c0
call fcn.004044d0
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.00408774
mov eax, dword [ebp - 0x18c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7225
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x194]
push eax
lea edx, [ebp - 0x19c]
mov eax, 0x19
call fcn.004e57b0
lea eax, [ebp - 0x19c]
mov edx, 0x4f76cc
call fcn.004044d0
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.00408774
mov eax, dword [ebp - 0x198]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7285
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x1a0]
push eax
lea edx, [ebp - 0x1a4]
mov eax, 0x4f76e0
call fcn.00408774
mov eax, dword [ebp - 0x1a4]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f72c4
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x1a8]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x1a8]
push eax
lea edx, [ebp - 0x1ac]
mov eax, 0x4f7704
call fcn.00408774
mov eax, dword [ebp - 0x1ac]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7303
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x1b0]
push eax
lea edx, [ebp - 0x1b4]
mov eax, 0x4f7718
call fcn.00408774
mov eax, dword [ebp - 0x1b4]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7342
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x1b8]
push eax
lea edx, [ebp - 0x1bc]
mov eax, 0x4f7728
call fcn.00408774
mov eax, dword [ebp - 0x1bc]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7381
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x1c0]
push eax
lea edx, [ebp - 0x1c4]
mov eax, 0x4f774c
call fcn.00408774
mov eax, dword [ebp - 0x1c4]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f73c0
call fcn.00403c6c
jmp 0x4f7636
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 8]
call fcn.00408774
mov eax, dword [ebp - 0x1c8]
push eax
lea edx, [ebp - 0x1d0]
mov eax, 0x19
call fcn.004e57b0
lea eax, [ebp - 0x1d0]
mov edx, 0x4f7760
call fcn.004044d0
mov eax, dword [ebp - 0x1d0]
lea edx, [ebp - 0x1cc]
call fcn.00408774
mov eax, dword [ebp - 0x1cc]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f7420
call fcn.00403c6c
jmp 0x4f7636
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x1d4]
mov ecx, 0x4f7774
mov edx, dword [ebp - 8]
call fcn.00404514
mov eax, dword [ebp - 0x1d4]
call fcn.004046c8
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
setne al
jmp 0x4f7610
mov eax, dword [0x512704]
cmp byte [eax], 2
je 0x4f7618
mov eax, dword [0x51297c]
mov eax, dword [eax]
call fcn.00481930
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404478
mov eax, dword [ebp - 0x154]
test eax, eax
jbe 0x4f75fa
cmp eax, 0x2328
jae 0x4f75fa
push dword [ebp - 8]
push 0x4f7684
push dword [ebp - 0x10]
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.00404588
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp + 8]
call fcn.00461c78
mov eax, dword [ebp - 0x10]
mov edx, 0x4f7784
call fcn.00404614
je 0x4f759d
mov eax, dword [ebp - 0x10]
mov edx, 0x4f7790
call fcn.00404614
je 0x4f759d
push dword [ebp - 8]
push 0x4f7684
push dword [ebp - 0x10]
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x1dc]
call fcn.00409010
test al, al
je 0x4f759d
xor eax, eax
push ebp
push 0x4f755b
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 8]
push 0x4f7684
push dword [ebp - 0x10]
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x1e0]
call fcn.004e5718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7565
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 8]
push 0x4f7684
push dword [ebp - 0x10]
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.00404588
mov edx, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004f6fd8
push dword [ebp - 8]
push 0x4f7684
push dword [ebp - 0x10]
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x1e8]
call fcn.00409000
test al, al
je 0x4f75fa
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp - 8]
push 0x4f7684
push dword [ebp - 0x10]
lea eax, [ebp - 0x1ec]
mov edx, 3
call fcn.00404588
mov ecx, dword [ebp - 0x1ec]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004f92dc
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4f745a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7636
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7673
lea eax, [ebp - 0x1ec]
mov edx, 0x26
call fcn.0040422c
lea eax, [ebp - 0x10]
call fcn.00404208
lea eax, [ebp - 8]
call fcn.00404208
lea eax, [ebp + 0x10]
call fcn.00404208
ret