Function at 0x4a0115
Capabilities:
Check for peb beingdebugged flag
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56e070
mov eax, dword fs:[0]
push eax
sub esp, 0x3f0
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x3e8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x400]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], esi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4a0188
sub eax, ecx
sar eax, 1
mov dword [esp + 0x34], eax
cmp eax, 0x102
jbe 0x4a023f
lea eax, [esp + 0x10c]
push eax
call fcn.004036c8
mov esi, eax
and dword [esp + 0x408], 0
push str.GFE::DAOS::DAOSupportImplementation::ScanFiles:_cannot_scan_
push esi
call fcn.00405d7d
push ebx
push esi
call fcn.00405d7d
push str._because_it_is_longer_than_MAX_PATH_with__appended
push esi
call fcn.00405d7d
add esp, 0x18
lea eax, [esp + 0xd4]
push eax
mov eax, esi
call fcn.00403732
mov byte [esp + 0x408], 1
cmp dword [esp + 0xe8], 8
mov eax, dword [esp + 0xd4]
jae 0x4a020c
lea eax, [esp + 0xd4]
xor ecx, ecx
push eax
inc ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd8]
call fcn.00404145
or dword [esp + 0x408], 0xffffffff
lea eax, [esp + 0x10c]
call fcn.00402669
jmp 0x4a056e
lea ebx, [ebx + eax*2]
cmp word [ebx - 2], 0x5c
push 0x19b
sete al
movzx eax, al
push eax
mov edi, 0x5a66d4
call fcn.0049231b
pop ecx
mov eax, 0x587bd0
mov edx, ebx
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4a0268
mov eax, dword [esp + 0x1c]
push dword [eax + 0x30]
lea ecx, [esp + 0x1a8]
push 0
push 0
push ecx
push dword [eax + 0x2c]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], eax
push 2
pop edi
xor ecx, ecx
mov dword [esp + 0x408], edi
mov word [ebx], cx
cmp eax, 0xffffffff
jne 0x4a0358
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x10c]
push eax
call fcn.004036c8
mov esi, eax
push str.GFE::DAOS::DAOSupportImplementation::ScanFiles:_FindFirstFileEx_failed_with
push esi
mov byte [esp + 0x410], 3
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.0041056c
push str._for
push esi
call fcn.00405d7d
push dword [esp + 0x18]
push esi
call fcn.00405d7d
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
mov eax, esi
call fcn.00403732
mov byte [esp + 0x408], 4
cmp dword [esp + 0xe8], 8
mov eax, dword [esp + 0xd4]
jae 0x4a0331
lea eax, [esp + 0xd4]
xor ecx, ecx
push eax
inc ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd8]
call fcn.00404145
mov byte [esp + 0x408], 2
jmp 0x4a022e
mov eax, ebx
lea ecx, [esp + 0x1d0]
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4a037e
push 0
call fcn.00491c88
test al, al
jne 0x4a0594
push dword [esp + 0x10]
sub dword [esp + 0x18], edi
push dword [esp + 0x24]
xor eax, eax
sub ebx, edi
mov word [ebx], ax
call dword [esp + 0x30]
add dword [esp + 0x1c], edi
pop ecx
pop ecx
push 0x5c
pop eax
mov word [ebx], ax
add ebx, edi
xor eax, eax
xor edx, edx
mov word [ebx], ax
cmp word [esp + 0x1d0], dx
je 0x4a0544
cmp word [esp + 0x1d0], 0x2e
jne 0x4a03ea
cmp word [esp + 0x1d2], dx
je 0x4a0544
cmp word [esp + 0x1d2], 0x2e
jne 0x4a03ea
cmp word [esp + 0x1d4], dx
je 0x4a0544
test byte [esp + 0x1a4], 0x10
lea eax, [esp + 0x1d0]
je 0x4a0528
add dword [esi + 8], 1
adc dword [esi + 0xc], edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, edi
cmp cx, dx
jne 0x4a0409
mov ecx, dword [esp + 0x34]
sub eax, esi
sar eax, 1
lea eax, [eax + ecx + 1]
cmp eax, 0x103
jbe 0x4a04ca
lea eax, [esp + 0x3c]
push eax
call fcn.004036c8
mov esi, eax
push str.GFE::DAOS::DAOSupportImplementation::ScanFiles:_Cannot_scan_under_path_
push esi
mov byte [esp + 0x410], 5
call fcn.00405d7d
push dword [esp + 0x18]
push esi
call fcn.00405d7d
lea eax, [esp + 0x1e0]
push eax
push esi
call fcn.00405d7d
push str._as_it_is_longer_than_MAX_PATH.
push esi
call fcn.00405d7d
add esp, 0x20
lea eax, [esp + 0xf0]
push eax
mov eax, esi
call fcn.00403732
mov byte [esp + 0x408], 6
cmp dword [esp + 0x104], 8
mov eax, dword [esp + 0xf0]
jae 0x4a049e
lea eax, [esp + 0xf0]
push eax
mov ecx, edi
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xf4]
call fcn.00404145
lea eax, [esp + 0x3c]
mov byte [esp + 0x408], 2
call fcn.00402669
jmp 0x4a051f
lea eax, [esp + 0x1d0]
movzx ecx, word [eax]
mov esi, dword [esp + 0x14]
mov word [esi + eax], cx
add eax, edi
cmp cx, dx
jne 0x4a04d1
lea eax, [ebx - 2]
mov cx, word [eax + 2]
add eax, edi
cmp cx, dx
jne 0x4a04e6
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push dword [esp + 0x30]
mov edi, eax
push dword [esp + 0x28]
mov esi, 0x584ab8
push dword [esp + 0x34]
movsd dword es:[edi], dword [esi]
push dword [esp + 0x40]
push dword [esp + 0x24]
call fcn.004a0115
xor eax, eax
mov word [ebx], ax
mov esi, dword [esp + 0x18]
push 2
pop edi
jmp 0x4a0544
push dword [esp + 0x20]
add dword [esi], 1
mov ecx, dword [esp + 0x34]
push eax
adc dword [esi + 4], edx
push dword [esp + 0x18]
mov edx, dword [esp + 0x28]
call fcn.004a0734
lea eax, [esp + 0x1a4]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a0367
cmp dword [esp + 0x24], eax
je 0x4a056e
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x400]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret 0x18
lea ebx, [esp + 0x10c]
call fcn.0049d9c5
push 0x5c98f0
mov eax, ebx
push eax
call fcn.0051ed55
int3