Function at 0x4a87e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e6573
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x651ea8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xac], ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xa8], eax
call fcn.004a8cd0
mov ecx, esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8840
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00406cf0
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 4], 0
test esi, esi
je 0x4a8968
cmp ebx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edi
mov al, byte [esi + eax - 1]
cmp al, 0x5c
je 0x4a8968
cmp esi, ebx
jae 0x4a88a1
lea eax, [esi + 1]
cmp ebx, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, edi
mov word [eax + esi], 0x5c
mov edi, dword [ebp - 0x28]
jmp 0x4a8962
mov edx, closesocket
mov eax, edx
sub eax, esi
cmp eax, 1
jb 0x4a8cb7
lea ecx, [esi + 1]
or ecx, 0xf
cmp ecx, edx
jbe 0x4a88c1
mov ecx, edx
jmp 0x4a88d9
mov eax, ebx
shr eax, 1
sub edx, eax
cmp ebx, edx
jbe 0x4a88d2
mov ecx, closesocket
jmp 0x4a88d9
add eax, ebx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa4], ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00406c90
mov edi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x14], eax
push esi
cmp ebx, 0x10
jb 0x4a894c
mov eax, dword [ebp - 0x28]
push eax
push edi
mov dword [ebp - 0xa4], eax
call fcn.0058f330
mov eax, dword [ebp - 0xa4]
inc ebx
add esp, 0xc
mov word [esi + edi], 0x5c
cmp ebx, 0x1000
jb 0x4a8940
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8cbc
mov eax, ecx
push ebx
push eax
call fcn.00552bfd
add esp, 8
jmp 0x4a895f
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0058f330
add esp, 0xc
mov word [esi + edi], 0x5c
mov dword [ebp - 0x28], edi
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ebx, 0x10
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmovae eax, edi
lea ecx, [ebp - 0x40]
push esi
push eax
call fcn.00407a40
push 3
push 0x61f4fc
lea ecx, [ebp - 0x40]
call fcn.00407a40
mov ebx, dword [ebp - 0xac]
lea eax, [ebp - 0x40]
or dword [ebx + 4], 0x10
lea ecx, [ebx + 4]
cmp dword [ebp - 0x2c], 0x10
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebx + 0x144], eax
cmp eax, 0xffffffff
je 0x4a8c1d
mov esi, dword [ebp - 0xa8]
lea edi, [ebx + 0x30]
mov dword [ebp - 0xa4], edi
nop
cmp byte [edi], 0x2e
je 0x4a8c05
mov ecx, ebx
call fcn.004a8d20
test al, al
je 0x4a8a10
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebx]
cmovae ecx, dword [ebp - 0x28]
push edi
push ecx
mov eax, dword [eax + 4]
mov ecx, ebx
push esi
call eax
jmp 0x4a8c01
push 0x2e
push edi
call fcn.0058ec20
add esp, 8
mov dword [ebp - 0xb0], eax
test eax, eax
je 0x4a8c05
cmp dword [ebp + 0x10], 0
je 0x4a8beb
mov ebx, dword [ebp - 0xa8]
mov ecx, ebx
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8a50
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x70]
call fcn.00406cf0
cmp dword [ebp - 0x5c], 0x10
lea esi, [ebp - 0x70]
mov eax, dword [ebp - 0x60]
cmovae esi, dword [ebp - 0x70]
mov byte [ebp - 4], 2
test eax, eax
je 0x4a8a8f
push eax
push 0x3b
push esi
call fcn.0058fe30
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4a8a8f
sub edi, esi
jmp 0x4a8a92
or edi, 0xffffffff
test edi, edi
jle 0x4a8bb8
mov ecx, ebx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8ab1
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x58]
call fcn.00406cf0
push edi
push 0
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.00453e80
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00406ed0
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a8af0
sub esi, ecx
mov dword [ebp - 0x48], 0
mov ecx, ebx
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8b10
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x58]
call fcn.00406cf0
push esi
lea eax, [edi + 1]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x58]
call fcn.00453e80
lea ecx, [ebp - 0x58]
call fcn.00406ed0
mov esi, dword [ebp - 0xb0]
lea ecx, [ebp - 0xa0]
inc esi
push esi
call fcn.00416930
test eax, eax
je 0x4a8ba0
push esi
lea ecx, [ebp - 0x88]
call fcn.00416930
test eax, eax
je 0x4a8ba0
lea ecx, [ebp - 0x88]
call fcn.00406ed0
lea ecx, [ebp - 0xa0]
call fcn.00406ed0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00406ed0
mov esi, dword [ebp - 0xa8]
mov ebx, dword [ebp - 0xac]
mov edi, dword [ebp - 0xa4]
jmp 0x4a8c05
lea ecx, [ebp - 0x88]
call fcn.00406ed0
lea ecx, [ebp - 0xa0]
call fcn.00406ed0
jmp 0x4a8bcd
mov eax, dword [ebp - 0xb0]
inc eax
push ebx
push eax
call fcn.005a10e3
add esp, 8
test eax, eax
jne 0x4a8b80
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00406ed0
mov esi, dword [ebp - 0xa8]
mov ebx, dword [ebp - 0xac]
mov edi, dword [ebp - 0xa4]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebx]
cmovae ecx, dword [ebp - 0x28]
push edi
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
test al, al
je 0x4a8c47
lea eax, [ebx + 4]
push eax
push dword [ebx + 0x144]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4a89e0
mov bl, 1
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4a8c55
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8c4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8cbc
jmp 0x4a8c4b
xor bl, bl
jmp 0x4a8c1f
push edx
push ecx
call fcn.00552bfd
add esp, 8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x4a8c97
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8c8d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a8cc1
push edx
push ecx
call fcn.00552bfd
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00552bec
mov esp, ebp
pop ebp
ret 0xc
call fcn.00406c80
call fcn.005983fa
call fcn.005983fa
int3