Function at 0x49a4a0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543fca
mov eax, dword fs:[0]
push eax
sub esp, 0x3c8
mov eax, dword [0x596c60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x2a4], ebx
mov edi, ecx
mov eax, dword [0x59f554]
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x29c], ebx
test al, 1
jne 0x49a518
or eax, 1
mov dword [0x59f554], eax
mov dword [ebp - 4], 0
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x49a52d
cmp byte [eax + 0x19], 6
jb 0x49a52d
mov al, 1
jmp 0x49a52f
xor al, al
cmp byte [0x59f560], 0
jne 0x49a549
cmp byte [0x59f561], 0
jne 0x49a549
test al, al
je 0x49a6b9
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x33c]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x33c]
call fcn.0047ee50
mov edx, str..installer.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x100
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b46c
mov ecx, eax
call fcn.0047f0b0
mov edx, str.FindTheUninstallXMLFiles
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x571fc8
mov ecx, eax
call fcn.0047f0b0
mov edx, str._in_directory
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1820
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
jb 0x49a5fe
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49a5fe
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x33c]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x49a61b
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x49a646
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 5
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 4
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp - 0x18], 0x10
jb 0x49a669
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49a669
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 1
call fcn.0047b5a0
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x49a6b9
test edi, edi
jne 0x49a6c5
lea eax, [edi + 0x57]
jmp 0x49ad26
push dword [ebp - 0x29c]
mov edx, dword [ebx + 4]
push ecx
mov ecx, dword [ebx]
call fcn.00480260
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a0]
add esp, 8
mov dword [ebx + 4], eax
mov dword [ebp - 0x298], 0
push 0x104
push edi
call fcn.00483c80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0x29c]
mov esi, eax
test ecx, ecx
je 0x49a716
push ecx
call fcn.00507b54
add esp, 4
cmp esi, 0xffffffff
je 0x49a9ea
push edi
lea ecx, [ebp - 0x44]
call fcn.0047af80
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 1]
cmp eax, ecx
ja 0x49a743
push str.invalid_string_position
call fcn.0052907d
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x49a74f
lea eax, [ebp - 0x44]
cmp word [eax + ecx*2], 0x5c
je 0x49a762
push 0x5c
push 1
lea ecx, [ebp - 0x44]
call fcn.00481a30
push 3
push 0x5727fc
lea ecx, [ebp - 0x44]
call fcn.004824e0
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x49a77d
lea eax, [ebp - 0x44]
push 0x104
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00483c80
lea ecx, [ebp - 0x294]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x29c]
mov esi, eax
test ecx, ecx
je 0x49a7b2
push ecx
call fcn.00507b54
add esp, 4
cmp esi, 0xffffffff
je 0x49a8ca
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x294], 0x10
jne 0x49a887
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp word [ebp - 0x268], ax
jne 0x49a7ef
xor ecx, ecx
jmp 0x49a80f
lea ecx, [ebp - 0x268]
lea edx, [ecx + 2]
jmp 0x49a800
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a800
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0047c4b0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.0049a040
mov byte [ebp - 4], 7
mov bl, al
cmp dword [ebp - 0x18], 8
jb 0x49a847
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x49a847
push ecx
call fcn.00507b54
add esp, 4
test bl, bl
je 0x49a887
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0047af80
mov ecx, dword [ebp - 0x2a4]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 9
call fcn.004a0650
mov byte [ebp - 4], 7
cmp dword [ebp - 0x18], 8
jb 0x49a887
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49a887
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x294]
push eax
push esi
call edi
test eax, eax
jne 0x49a7c1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], 8
jb 0x49ab5a
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x49ab5a
push eax
call fcn.00507b54
add esp, 4
jmp 0x49ab5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x298], eax
call fcn.004a1320
mov ecx, dword [0x597f88]
test byte [ecx + 0x1c], 2
je 0x49a8f1
cmp byte [ecx + 0x19], 2
jb 0x49a8f1
mov cl, 1
jmp 0x49a8f3
xor cl, cl
cmp byte [eax], 0
jne 0x49a902
cmp byte [eax + 1], 0
jne 0x49a902
test cl, cl
je 0x49a8a0
sub esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x33c]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x33c]
call fcn.0047ee50
mov edx, str..installer.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x122
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.FindFirstFile___returned_INVALID_HANDLE_VALUE_in_directory
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.004a1750
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
call fcn.0047abe0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x33c]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xd
cmp dword [esi + 0x14], 0x10
jb 0x49a9a0
mov esi, dword [esi]
call fcn.004a1320
push esi
push 2
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp - 0x2c]
call fcn.0047abe0
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0xa
call fcn.0047b5a0
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x49a8a0
mov eax, dword [0x59f554]
test al, 1
jne 0x49aa1a
or dword [0x59f554], 1
mov dword [ebp - 4], 0xf
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x597f88]
test byte [ecx + 0x1c], 2
je 0x49aa30
cmp byte [ecx + 0x19], 2
jb 0x49aa30
mov al, 1
jmp 0x49aa32
xor al, al
cmp byte [0x59f560], 0
jne 0x49aa4c
cmp byte [0x59f561], 0
jne 0x49aa4c
test al, al
je 0x49ab5a
sub esp, 8
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x33c]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x33c]
call fcn.0047ee50
mov edx, str..installer.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x127
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Path
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1820
mov edx, str._Not_Found
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x18], 0x10
jb 0x49aae9
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49aae9
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x33c]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x13
cmp dword [esi + 0x14], 0x10
jb 0x49ab06
mov esi, dword [esi]
call fcn.004a1320
push esi
push 2
mov ecx, eax
call fcn.004a1510
cmp dword [ebp - 0x18], 0x10
jb 0x49ab2b
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49ab2b
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x10
call fcn.0047b5a0
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x59f554]
test al, 1
jne 0x49ab8a
or dword [0x59f554], 1
mov dword [ebp - 4], 0x15
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x597f88]
test byte [ecx + 0x1c], 2
je 0x49aba6
cmp byte [ecx + 0x19], 6
jb 0x49aba6
mov al, 1
jmp 0x49aba8
xor al, al
cmp byte [0x59f560], 0
jne 0x49abc2
cmp byte [0x59f561], 0
jne 0x49abc2
test al, al
je 0x49ad20
sub esp, 8
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x3d4]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3d4]
call fcn.0047ee50
mov edx, str..installer.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x12a
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b498
mov ecx, eax
call fcn.0047f0b0
mov edx, str.FindTheUninstallXMLFiles
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x571fc8
mov ecx, eax
call fcn.0047f0b0
mov edx, str._with_result
mov ecx, eax
call fcn.0047f0b0
push dword [ebp - 0x298]
mov ecx, eax
call fcn.0047b2d0
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0x18], 0x10
jb 0x49ac7b
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49ac7b
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x3d4]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x19
cmp dword [esi + 0x14], 0x10
jb 0x49ac98
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x49acc3
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0x1a
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0x19
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp - 0x18], 0x10
jb 0x49ace6
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49ace6
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x384]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x16
call fcn.0047b5a0
lea eax, [ebp - 0x384]
mov dword [ebp - 0x384], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005072fd
mov esp, ebp
pop ebp
ret