Function at 0x4aac98
Capabilities:
Check if file exists
Enumerate files on windows
Read file on windows

Disassembly:
push 0x5a8
mov eax, 0x694841
call fcn.0056e23b
mov ebx, ecx
mov dword [ebp - 0x5b0], ebx
and dword [ebp - 0x5b4], 0
lea ecx, [ebp - 0xfc]
call fcn.004d2654
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.004173bc
mov byte [ebp - 4], 3
push 0x220
call fcn.0056def4
or edi, 0xffffffff
mov dword [ebp - 0x5a0], eax
pop ecx
test eax, eax
je 0x4ab2e1
push 2
pop eax
mov dword [ebp - 0x5a8], eax
lea esi, [eax + 0x41]
push esi
lea ecx, [ebp - 0xfc]
call fcn.004d2843
test eax, eax
jne 0x4ab07f
lea ecx, [ebp - 0xfc]
call fcn.004d281a
cmp eax, 5
movzx eax, si
push eax
lea eax, [ebp - 0x48]
jne 0x4aad63
push 0x6cf1a0
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
push 0
call fcn.004552fa
add esp, 0x18
jmp 0x4aad71
push 0x6cf1dc
push eax
call fcn.0041ccda
add esp, 0xc
lea ecx, [ebp - 0xfc]
call fcn.004d2741
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push str._s_I
push eax
call fcn.0041ccda
add esp, 0xc
lea ecx, [ebp - 0x34c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ab07f
lea esi, [ebx + 0x818]
mov ecx, esi
call fcn.004c2c9d
mov ecx, esi
call fcn.00451480
test eax, eax
jne 0x4ab2c3
test byte [ebp - 0x34c], 0x10
jne 0x4ab05f
push 0x220
push dword [ebp - 0x5a0]
call fcn.0059e3f3
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x320]
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf210
push eax
call fcn.0041ccda
add esp, 0x18
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push ecx
push 3
push ecx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4aae82
and dword [ebp - 0x5a4], 0
lea eax, [ebp - 0x5a4]
push 0
push eax
push 0x220
push dword [ebp - 0x5a0]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4aaf79
cmp dword [ebp - 0x5a4], 0x220
jne 0x4aaf79
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x64]
call fcn.004179fb
mov esi, 0x6cf21c
push esi
call fcn.00647fd1
pop ecx
push eax
push esi
push 1
push 1
lea ecx, [ebp - 0x60]
call fcn.00450e23
push 8
pop esi
cmp dword [ebp - 0x4c], esi
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x60]
cmp dword [ebp - 0x30], esi
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf220
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ab051
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
mov eax, dword [ebp - 0x5a0]
je 0x4aaf85
cmp dword [ebp - 0x14], esi
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, 0x18
push eax
push 1
push ecx
mov ecx, ebx
call fcn.004aa656
test eax, eax
jne 0x4ab046
cmp dword [ebp - 0x30], esi
lea ecx, [ebp - 0x320]
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf22c
push eax
call fcn.0041ccda
sub esp, 0x18
mov dword [ebp - 0x5a4], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x4a917d
mov dword [eax + 8], ebx
call fcn.004a81c7
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], esi
lea esi, [ebx + 0x818]
jmp 0x4ab02c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ab059
inc dword [ebx + 0x80c]
mov ecx, ebx
push dword [eax + 0xc]
push dword [eax + 8]
add eax, 0x18
push eax
call fcn.004a91f6
sub esp, 0x28
mov dword [ebp - 0x5ac], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x4a919b
mov dword [eax + 8], ebx
call fcn.004a81c7
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], esi
lea esi, [ebx + 0x818]
push esi
cmovae eax, dword [ebp - 0x28]
push 0x7e7c80
push eax
mov byte [ebp - 4], 3
call fcn.005380d7
add esp, 0x34
test eax, eax
jne 0x4ab046
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x320]
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf238
push eax
call fcn.0041ccda
sub esp, 0x18
mov dword [ebp - 0x5ac], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x4a917d
mov dword [eax + 8], ebx
call fcn.004a81c7
mov byte [ebp - 4], 6
cmp dword [ebp - 0x14], 8
push esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x7e7c80
push eax
mov byte [ebp - 4], 3
call fcn.005380d7
add esp, 0x34
cmp eax, 0x18697
je 0x4ab2c3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [ebx + 0x818]
lea eax, [ebp - 0x34c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4aadc3
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or edi, 0xffffffff
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp eax, 0x19
jle 0x4aad0e
push 2
pop ebx
lea esi, [ebx + 0x41]
push esi
lea ecx, [ebp - 0xfc]
call fcn.004d2843
test eax, eax
jne 0x4ab2af
lea ecx, [ebp - 0xfc]
call fcn.004d281a
cmp eax, 5
movzx eax, si
push eax
lea eax, [ebp - 0x48]
jne 0x4ab0ed
push str._c:_Recycle.Bin__UserSID__
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
push 0
call fcn.004552fa
add esp, 0x18
jmp 0x4ab0fb
push str._c:_Recycle.Bin
push eax
call fcn.0041ccda
add esp, 0xc
lea ecx, [ebp - 0xfc]
call fcn.004d2741
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf2a4
push eax
call fcn.0041ccda
add esp, 0xc
lea ecx, [ebp - 0x59c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ab2af
mov esi, dword [ebp - 0x5b0]
lea eax, [esi + 0x818]
mov ecx, eax
call fcn.004c2c9d
lea ecx, [esi + 0x818]
call fcn.00451480
test eax, eax
jne 0x4ab2c3
lea eax, [ebp - 0x570]
push 0x6cf2b0
push eax
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab289
lea eax, [ebp - 0x570]
push 0x6cf2b4
push eax
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab289
lea eax, [ebp - 0x570]
push 0x6cf2bc
push eax
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab289
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x570]
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf2d4
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
test byte [ebp - 0x59c], 0x10
je 0x4ab204
cmp dword [ebp - 0x14], 8
mov ecx, esi
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call fcn.004aa656
jmp 0x4ab27a
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
call fcn.005655b9
pop ecx
push edx
push eax
push esi
mov esi, dword [ebp - 0x5b0]
mov ecx, esi
call fcn.004a91f6
sub esp, 0x28
mov dword [ebp - 0x5ac], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x4a919b
mov dword [eax + 8], esi
call fcn.004a81c7
mov byte [ebp - 4], 7
lea ecx, [esi + 0x818]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push 0x7e7c80
push eax
mov byte [ebp - 4], 3
call fcn.005380d7
add esp, 0x34
test eax, eax
jne 0x4ab27a
inc dword [esi + 0x80c]
cmp eax, 0x18697
je 0x4ab2c3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x59c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
lea eax, [esi + 0x818]
jne 0x4ab153
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or edi, 0xffffffff
inc ebx
cmp ebx, 0x19
jle 0x4ab098
mov dword [ebp - 0x5b4], 1
push 0x220
push dword [ebp - 0x5a0]
call fcn.0056df27
pop ecx
pop ecx
cmp edi, 0xffffffff
je 0x4ab2e1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.0041786a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.004d26ba
mov eax, dword [ebp - 0x5b4]
call fcn.0056e1e5
ret