Function at 0x42ba60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c04c
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x488], ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00481280
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.0042b8f0
or edx, 0xffffffff
mov dword [ebp - 0x474], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.00412220
mov dword [ebp - 0x478], eax
push 0x4b81c8
lea ecx, [ebp - 0x478]
mov dword [ebp - 4], 0
call fcn.00411b80
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x498], 0xffffffff
lea eax, [ebp - 0x490]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x490], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x250
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.00481280
mov edi, dword [ebp - 0x478]
lea ecx, [ebp - 0x468]
add esp, 0xc
mov eax, 0x4c2758
test edi, edi
cmovne eax, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x494], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x42bce9
cmp esi, 0xffffffff
je 0x42bce9
nop word [eax + eax]
mov ebx, dword [ebp - 0x490]
mov ecx, ebx
mov edx, dword [ebp - 0x48c]
sub ecx, 0x1312d00
mov edi, dword [ebp - 0x450]
mov eax, edx
sbb eax, 0
cmp edi, eax
jl 0x42bccd
mov eax, dword [ebp - 0x454]
jg 0x42bba7
cmp eax, ecx
jb 0x42bccd
cmp edi, edx
jg 0x42bccd
jl 0x42bbb9
cmp eax, ebx
ja 0x42bccd
or edx, 0xffffffff
mov dword [ebp - 0x46c], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.00412220
mov edi, eax
mov dword [ebp - 0x470], edi
mov byte [ebp - 4], 3
cmp word [ebp - 0x43c], 0
je 0x42bc8d
test edi, edi
jne 0x42bbf3
xor ebx, ebx
jmp 0x42bc02
mov ecx, edi
call fcn.004122d0
mov ebx, eax
mov dword [ebp - 0x46c], ebx
lea ecx, [ebp - 0x43c]
call fcn.004122d0
mov dword [ebp - 0x480], eax
xor ecx, ecx
add eax, ebx
mov edx, 2
mov dword [ebp - 0x484], eax
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047d522
add esp, 4
mov edx, eax
mov dword [ebp - 0x47c], edx
test edi, edi
je 0x42bc5e
lea ecx, [ebx + ebx]
push ecx
push edi
push edx
call fcn.0047f730
add esp, 0xc
push edi
call fcn.0047d4ed
mov edx, dword [ebp - 0x47c]
add esp, 4
mov eax, dword [ebp - 0x480]
mov edi, edx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [edx + ebx*2]
push eax
call fcn.0047f730
mov eax, dword [ebp - 0x484]
add esp, 0xc
mov dword [ebp - 0x46c], eax
mov edx, dword [ebp - 0x488]
mov ebx, 0x4c2758
test edi, edi
mov ecx, ebx
cmovne ecx, edi
call fcn.0042b820
test eax, eax
jne 0x42bd26
mov byte [ebp - 4], 2
test edi, edi
je 0x42bcc3
push edi
call fcn.0047d4ed
add esp, 4
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0xffffffff
lea eax, [ebp - 0x468]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42bb70
mov edi, dword [ebp - 0x478]
xor ebx, ebx
test esi, esi
je 0x42bcfb
cmp esi, 0xffffffff
je 0x42bcfb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x42bd08
push edi
call fcn.0047d4ed
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret
test edi, edi
cmovne ebx, edi
mov ecx, ebx
call fcn.0042b760
mov ebx, eax
test edi, edi
je 0x42bd41
push edi
call fcn.0047d4ed
add esp, 4
mov edi, dword [ebp - 0x478]
jmp 0x42bceb