Function at 0x50d1b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x260], ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x258], edi
test ebx, ebx
je 0x50d1f0
mov dword [ebx], 0
nop word [eax + eax]
mov eax, dword [esi + 0x824]
mov ecx, dword [esi + eax*8 + 4]
cmp ecx, 0xffffffff
jne 0x50d41d
test eax, eax
je 0x50d299
mov ecx, dword [esi + eax*8 + 8]
mov eax, dword [esi + 0x828]
add ecx, ecx
sub eax, ecx
push 0x6d4d20
push eax
mov eax, dword [esi]
add eax, ecx
push eax
call fcn.004f3880
add esp, 0xc
test eax, eax
jne 0x50d299
mov eax, dword [esi + 0x828]
lea edi, [eax + eax]
cmp edi, eax
jle 0x50d4a7
push 0x304c5151
push edi
call fcn.004f3590
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x50d491
push dword [esi]
push dword [esi + 0x828]
push ebx
call fcn.004f3880
push dword [esi]
call fcn.004f3570
mov dword [esi + 0x828], edi
mov dword [esi], ebx
mov eax, dword [esi + 0x824]
push 0x6d4d20
mov eax, dword [esi + eax*8 + 8]
add eax, eax
sub edi, eax
add eax, ebx
push edi
push eax
call fcn.004f3880
add esp, 0x1c
test eax, eax
je 0x50d230
lea eax, [ebp - 0x254]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esi + 0x824]
cmp eax, 0xffffffff
jne 0x50d2e6
lea eax, [ecx - 1]
mov dword [esi + 0x824], eax
test eax, eax
jns 0x50d1f0
mov edi, dword [ebp - 0x258]
mov dword [edi], 0
mov eax, 0x3f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov dword [esi + ecx*8 + 4], eax
lea eax, [ebp - 0x228]
push 0x6d2800
push eax
call fcn.004f37c0
add esp, 8
test eax, eax
je 0x50d1f0
lea eax, [ebp - 0x228]
push 0x6d4d28
push eax
call fcn.004f37c0
add esp, 8
test eax, eax
je 0x50d1f0
mov eax, dword [esi + 0x824]
mov ebx, dword [esi + 0x828]
mov ecx, dword [esi + eax*8 + 8]
mov eax, dword [esi]
add ecx, ecx
add eax, 2
sub ebx, ecx
add eax, ecx
sub ebx, 2
lea ecx, [ebp - 0x228]
push ecx
push ebx
push eax
call fcn.004f3880
add esp, 0xc
test eax, eax
jne 0x50d3d7
nop dword [eax]
mov eax, dword [esi + 0x828]
add ebx, eax
mov dword [ebp - 0x25c], ebx
lea edi, [eax + eax]
cmp edi, eax
jle 0x50d4a7
push 0x304c5151
push edi
call fcn.004f3590
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x50d491
push dword [esi]
push dword [esi + 0x828]
push ebx
call fcn.004f3880
push dword [esi]
call fcn.004f3570
mov eax, dword [esi + 0x824]
lea ecx, [ebp - 0x228]
mov dword [esi], ebx
mov dword [esi + 0x828], edi
push ecx
mov eax, dword [esi + eax*8 + 8]
inc eax
lea eax, [ebx + eax*2]
mov ebx, dword [ebp - 0x25c]
push ebx
push eax
call fcn.004f3880
add esp, 0x1c
test eax, eax
je 0x50d360
test byte [ebp - 0x254], 0x10
je 0x50d4bd
inc dword [esi + 0x824]
mov eax, dword [esi + 0x824]
mov dword [esi + eax*8 + 4], 0xffffffff
mov eax, dword [esi + 0x824]
lea edi, [esi + eax*8]
lea eax, [ebp - 0x228]
push eax
call fcn.004f36b0
mov ecx, dword [edi]
add esp, 4
inc ecx
add eax, ecx
mov dword [edi + 8], eax
jmp 0x50d1f0
lea eax, [ebp - 0x254]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x50d2ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x50d1f0
mov eax, dword [esi + 0x824]
push dword [esi + eax*8 + 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi + 0x824]
xor edx, edx
mov edi, dword [ebp - 0x258]
mov ebx, dword [ebp - 0x260]
mov ecx, dword [esi + eax*8 + 8]
mov eax, dword [esi]
mov word [eax + ecx*2], dx
dec dword [esi + 0x824]
mov eax, dword [esi]
mov dword [edi], eax
test ebx, ebx
je 0x50d484
mov dword [ebx], 1
cmp dword [esi + 0x824], edx
jge 0x50d4c7
jmp 0x50d2ca
pop edi
pop esi
mov eax, 0xc
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x3eb
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x258]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret