Function at 0x49a9e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x58737e
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x5f4760]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4760]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov eax, dword [0x6047b0]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x49ac46
xor eax, eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push edx
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x49ac46
lea ecx, [esp + 0x1c]
push ecx
call fcn.004030f0
mov dword [esp + 0x2b0], 0
mov edx, dword [0x6047b0]
push edx
push str._s.
lea edi, [esp + 0x24]
call fcn.00413090
push 0x250
lea eax, [esp + 0x60]
push 0
push eax
call fcn.004add60
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call fcn.00462370
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x54]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x49ab73
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x49aae0
test byte [esp + 0x54], 0x10
je 0x49ab5c
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x84]
call fcn.00408390
mov bl, 2
mov byte [esp + 0x2b0], bl
mov edx, dword [esp + 0x18]
cmp dword [edx - 0xc], 8
jne 0x49ab4a
lea eax, [esp + 0x20]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
lea edx, [esp + 0x20]
push edx
push ecx
call fcn.00492a00
mov byte [esp + 0x2b8], 3
mov byte [esp + 0x2b8], bl
call fcn.0049a800
add esp, 8
test al, al
je 0x49ab4a
lea ebx, [esp + 0x18]
lea edi, [esp + 0x2c]
call fcn.00495c80
mov byte [esp + 0x2b0], 1
lea eax, [esp + 0x18]
push eax
call fcn.00403090
lea ecx, [esp + 0x54]
push ecx
push esi
call ebp
test eax, eax
jne 0x49aae0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x38]
xor esi, esi
sar edx, 2
test edx, edx
jbe 0x49ac1f
mov bl, 4
lea ebx, [ebx]
lea eax, [esp + 0x18]
push eax
call fcn.004030f0
mov byte [esp + 0x2b0], bl
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x38]
sar ecx, 2
cmp esi, ecx
jb 0x49abb5
call fcn.004a35f3
mov edx, dword [esp + 0x38]
mov eax, dword [edx + esi*4]
mov ecx, dword [0x6047b0]
push eax
push ecx
push str._s_s
lea edi, [esp + 0x24]
call fcn.00413090
add esp, 8
mov edx, esp
mov dword [esp + 0x2c], esp
mov eax, edi
push eax
push edx
call fcn.00492a00
mov byte [esp + 0x2b4], 5
mov byte [esp + 0x2b4], bl
call fcn.0049a590
add esp, 4
mov byte [esp + 0x2b0], 1
mov ecx, edi
push ecx
call fcn.00403090
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x38]
inc esi
sar edx, 2
cmp esi, edx
jb 0x49ab90
mov byte [esp + 0x2b0], 0
lea eax, [esp + 0x2c]
push eax
call fcn.0040ac80
mov dword [esp + 0x2b0], 0xffffffff
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403090
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.004a314d
add esp, 0x2a0
ret