Function at 0x497900
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 2
jne 0x497926
cmp dword [ebp + 8], 5
je 0x497926
mov dword [ebp + 8], 5
cmp dword [0x5515e4], 0
jne 0x4979f1
mov eax, dword [0x5515e4]
add eax, 1
mov dword [0x5515e4], eax
push 0x140
push 0
mov ecx, 0x140
imul ecx, ecx, 0
add ecx, 0x5515f0
push ecx
call fcn.004b6780
add esp, 0xc
push 0x140
push 0
mov edx, 0x140
shl edx, 0
add edx, 0x5515f0
push edx
call fcn.004b6780
add esp, 0xc
push 0x140
push 0
mov eax, 0x140
shl eax, 1
add eax, 0x5515f0
push eax
call fcn.004b6780
add esp, 0xc
push 0x140
push 0
mov ecx, 0x140
imul ecx, ecx, 3
add ecx, 0x5515f0
push ecx
call fcn.004b6780
add esp, 0xc
push 0x140
push 0
mov edx, 0x140
shl edx, 2
add edx, 0x5515f0
push edx
call fcn.004b6780
add esp, 0xc
push 0x140
push 0
mov eax, 0x140
imul eax, eax, 5
add eax, 0x5515f0
push eax
call fcn.004b6780
add esp, 0xc
mov ecx, 1
imul ecx, ecx, 0
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x497a19
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.004b5e60
add esp, 8
jmp 0x497a35
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4f2608
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x10
cmp dword [ebp + 0x1c], 1
je 0x497a45
cmp dword [ebp + 0x1c], 2
jne 0x497b1c
mov eax, dword [ebp + 8]
cmp dword [eax*4 + 0x5515c8], 0
je 0x497a9d
mov ecx, dword [ebp + 8]
cmp dword [ecx*4 + 0x5515c8], 0xffffffff
je 0x497a9d
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x5515c8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
mov dword [ecx*4 + 0x5515c8], 0
push 0x140
push 0
mov edx, dword [ebp + 8]
imul edx, edx, 0x140
add edx, 0x5515f0
push edx
call fcn.004b6780
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [ebp + eax - 0x204]
test ecx, ecx
jne 0x497ac9
mov edx, dword [ebp + 8]
mov dword [edx*4 + 0x5515c8], 0xffffffff
jmp 0x497aef
mov eax, dword [ebp + 8]
imul eax, eax, 0x140
add eax, 0x5515f0
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, dword [ebp + 8]
mov dword [edx*4 + 0x5515c8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp + 8]
cmp dword [eax*4 + 0x5515c8], 0xffffffff
jne 0x497b10
mov dword [ebp - 0x208], 0xffffffff
jmp 0x497b1a
mov dword [ebp - 0x208], 0
jmp 0x497b7b
mov ecx, dword [ebp + 8]
cmp dword [ecx*4 + 0x5515c8], 0xffffffff
jne 0x497b35
mov dword [ebp - 0x208], 0
jmp 0x497b5c
mov edx, dword [ebp + 8]
imul edx, edx, 0x140
add edx, 0x5515f0
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x5515c8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x497b71
mov dword [ebp - 0x208], 0
jmp 0x497b7b
mov dword [ebp - 0x208], 0xffffffff
cmp dword [ebp - 0x208], 0
jne 0x497c15
cmp dword [ebp + 0x20], 1
jne 0x497c15
mov edx, dword [ebp + 8]
imul edx, edx, 0x140
mov eax, dword [edx + 0x5515f0]
and eax, 0x10
jne 0x497c15
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x140
add ecx, 0x5515f0
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x5515c8]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x497c01
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x5515c8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
mov dword [eax*4 + 0x5515c8], 0xffffffff
mov dword [ebp - 0x208], 0xffffffff
jmp 0x497c15
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x140
mov edx, dword [ecx + 0x5515f0]
and edx, 0x10
je 0x497ba6
mov eax, dword [ebp + 8]
cmp dword [eax*4 + 0x5515c8], 0xffffffff
je 0x497d80
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
jb 0x497c36
mov edx, dword [ebp + 0x18]
cmp dword [edx], 3
jbe 0x497c3f
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x214], 1
jne 0x497c76
mov eax, dword [ebp + 8]
imul eax, eax, 0x140
mov ecx, dword [eax + 0x551604]
mov edx, dword [eax + 0x551608]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], edx
jmp 0x497cc3
cmp dword [ebp - 0x214], 3
jne 0x497ca2
mov eax, dword [ebp + 8]
imul eax, eax, 0x140
mov ecx, dword [eax + 0x551604]
mov edx, dword [eax + 0x551608]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], edx
jmp 0x497cc3
mov eax, dword [ebp + 8]
imul eax, eax, 0x140
mov ecx, dword [eax + 0x5515f4]
mov edx, dword [eax + 0x5515f8]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
cmp dword [ebp - 0x214], 0
je 0x497d3a
movzx edx, word [ebp - 0x210]
push edx
movzx eax, word [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00497850
add esp, 0xc
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov eax, dword [ebp + 8]
imul eax, eax, 0x140
mov ecx, dword [eax + 0x5515f0]
and ecx, 0x10
je 0x497d59
mov edx, dword [ebp + 0x24]
mov dword [edx], 1
jmp 0x497d62
mov eax, dword [ebp + 0x24]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x140
add ecx, 0x55161c
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.004b5e60
add esp, 8
jmp 0x497d8f
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp + 0x14]
mov byte [ecx + eax], 0
cmp dword [ebp + 0x1c], 2
jne 0x497e10
mov edx, dword [ebp + 8]
cmp dword [edx*4 + 0x5515c8], 0
je 0x497ded
mov eax, dword [ebp + 8]
cmp dword [eax*4 + 0x5515c8], 0xffffffff
je 0x497ded
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x5515c8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
mov dword [eax*4 + 0x5515c8], 0
push 0x140
push 0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x140
add ecx, 0x5515f0
push ecx
call fcn.004b6780
add esp, 0xc
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x20]
cmp eax, dword [edx]
je 0x497e10
mov ecx, 1
imul ecx, ecx, 0
mov edx, dword [ebp + 0x14]
mov byte [edx + ecx], 0
mov dword [ebp - 0x208], 0xffffffff
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret