Function at 0x4d6d90
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x298]
push esi
push edi
push 0x140
push 0
push eax
mov dword [ebp - 0x48c], ebx
call fcn.004e69c0
push 0xac
xorps xmm0, xmm0
lea eax, [ebp - 0x484]
push 0
push eax
movups xmmword [ebp - 0x138], xmm0
movups xmmword [ebp - 0x158], xmm0
call fcn.004e69c0
add esp, 0x18
test ebx, ebx
jne 0x4d6e05
cmp dword [0x6835d4], ebx
jne 0x4d795e
lea eax, [ebp - 0x158]
mov dword [ebp - 0x48c], eax
call fcn.004245a0
call fcn.004d9850
mov ebx, dword [ebp + 0x10]
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x4d6e6f
cmp dword [0x6835c0], 0
je 0x4d6e63
call fcn.004d9850
sub eax, edi
cmp eax, 0xbb8
jbe 0x4d6e56
push str.:5:GetLocalTamsTime___is_stuck_in_a_safe_lock_
mov dword [0x6835c0], 0
call fcn.00424fd0
add esp, 4
mov dword [0x6835c0], 0
push 0
call esi
cmp dword [0x6835c0], 0
jne 0x4d6e27
mov dword [0x6835c0], 1
jmp 0x4d6ebe
cmp dword [0x6835bc], 0
je 0x4d6eb4
call fcn.004d9850
sub eax, edi
cmp eax, 0x2710
jbe 0x4d6ea7
push str.:5:GetLocalTamsTime___is_stuck_in_a_regular_lock__
mov dword [0x6835bc], 0
call fcn.00424fd0
add esp, 4
mov dword [0x6835bc], 0
push 0
call esi
cmp dword [0x6835bc], 0
jne 0x4d6e78
mov dword [0x6835bc], 1
mov eax, dword [0x6835d8]
cmp eax, 0x3e8
jbe 0x4d6ed1
cmp eax, 0x493e0
jb 0x4d6ee9
call fcn.0047dd90
neg eax
sbb eax, eax
and eax, 0xea60
add eax, 0xea60
mov dword [0x6835d8], eax
call fcn.004d9850
mov ecx, dword [0x6835d4]
mov edx, eax
sub eax, ecx
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x498], eax
cmp eax, dword [0x6835d8]
jae 0x4d6f10
test ecx, ecx
jne 0x4d6f2b
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
je 0x4d7145
cmp dword [0x6835d4], 0
je 0x4d7339
movups xmm0, xmmword [0x6835c4]
mov esi, 1
pextrw eax, xmm0, 7
movups xmmword [ebp - 0x138], xmm0
movzx ebx, ax
sub ebx, dword [0x6835d4]
add ebx, edx
cmp ebx, 0x3e8
jb 0x4d70aa
mov di, word [ebp - 0x130]
mov eax, 0x10624dd3
mov si, word [ebp - 0x136]
mul ebx
shr edx, 6
mov dword [ebp - 0x488], edx
mov dx, word [ebp - 0x134]
nop
mov eax, dword [ebp - 0x12c]
sub ebx, 0x3e8
inc eax
movzx ecx, ax
mov word [ebp - 0x12c], ax
cmp ecx, 0x3c
jb 0x4d7092
lea eax, [ecx - 0x3c]
mov word [ebp - 0x12c], ax
mov eax, dword [ebp - 0x12e]
inc eax
movzx ecx, ax
mov word [ebp - 0x12e], ax
cmp ecx, 0x3c
jb 0x4d7092
inc di
lea eax, [ecx - 0x3c]
mov word [ebp - 0x12e], ax
mov word [ebp - 0x130], di
cmp di, 0x18
jb 0x4d7092
xor edi, edi
inc dx
mov word [ebp - 0x130], di
mov ecx, dword [ebp - 0x132]
inc ecx
mov word [ebp - 0x134], dx
mov dword [ebp - 0x490], ecx
movzx eax, cx
mov word [ebp - 0x132], cx
cmp dx, 7
jb 0x4d7019
xor edx, edx
mov word [ebp - 0x134], dx
cmp eax, 0x1b
jbe 0x4d7092
movzx eax, si
cmp eax, 4
je 0x4d7055
cmp eax, 6
je 0x4d7055
cmp eax, 9
je 0x4d7055
cmp eax, 0xb
je 0x4d7055
cmp eax, 2
je 0x4d7041
mov ecx, 0x1f
jmp 0x4d705a
mov al, byte [ebp - 0x138]
and al, 3
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 0x1d
jmp 0x4d705a
mov ecx, 0x1e
mov eax, dword [ebp - 0x490]
movzx eax, ax
cmp eax, ecx
jbe 0x4d7092
inc si
mov ecx, 1
mov word [ebp - 0x132], cx
mov word [ebp - 0x136], si
cmp si, 0xc
jbe 0x4d7092
inc word [ebp - 0x138]
mov esi, ecx
mov word [ebp - 0x136], si
sub dword [ebp - 0x488], 1
jne 0x4d6f80
mov edx, dword [ebp - 0x4a0]
mov esi, 1
mov eax, dword [0x6835d8]
shl eax, 2
mov word [ebp - 0x12a], bx
movups xmm0, xmmword [ebp - 0x138]
cmp dword [ebp - 0x498], eax
jb 0x4d70d5
movups xmmword [0x6835c4], xmm0
mov dword [0x6835d4], edx
cmp dword [ebp + 0xc], 0
jne 0x4d70f2
lea eax, [ebp - 0x138]
push eax
push eax
call fcn.004d9be0
movups xmm0, xmmword [ebp - 0x138]
add esp, 8
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x48c]
movups xmmword [eax], xmm0
je 0x4d7123
mov dword [0x6835c0], 0
call fcn.004245e0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov dword [0x6835bc], 0
call fcn.004245e0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
cmp byte [0x682d70], 0
jne 0x4d7177
cmp dword [0x6835dc], 0
jne 0x4d732c
push str.:8:1_of_1:GetPAULATime___FAILED:_the_server_temp_time_stamp_file_has_not_been_defined___This_happens_if_SetPAULATimeServer___has_not_been_called_yet.__The_PAULA_settings_dont_seem_to_have_been_loaded_yet.
mov dword [0x6835dc], 1
call fcn.00424a90
add esp, 4
jmp 0x4d732c
push 0xa4d
push str.C:UsersOfficeDocumentsVisual_StudioPAULATime.c
push 0x80
call fcn.004606f0
add esp, 0xc
test eax, eax
je 0x4d71bb
cmp dword [0x6835e0], 0
jne 0x4d732c
push str.:5:1_of_1:GetPAULATime___FAILED:_could_not_logon_to_TAMS_server_
mov dword [0x6835e0], 1
call fcn.00424a90
add esp, 4
jmp 0x4d732c
push 0x682d70
call fcn.004289f0
add esp, 4
test eax, eax
je 0x4d71d9
push 0x682d70
call fcn.00429a50
add esp, 4
xor edi, edi
nop dword [eax + eax]
push 0x682d70
call fcn.004289f0
add esp, 4
test eax, eax
je 0x4d722d
cmp dword [0x6835e4], 0
jne 0x4d7216
push 0x682d70
push str.:5:1_of_1:GetPAULATime___encountered_a_problem:_the_temp_file_still_exists_on_the_server_after_deletion:___s_
mov dword [0x6835e4], 1
call fcn.00424fd0
add esp, 8
push 0x4b
call esi
push 0x682d70
call fcn.00429a50
inc edi
add esp, 4
cmp edi, 0xa
jl 0x4d71e0
call fcn.004d9850
mov dword [ebp - 0x498], eax
xor edi, edi
nop word [eax + eax]
push 0xa72
push str.C:UsersOfficeDocumentsVisual_StudioPAULATime.c
push 0x510d9c
push 0x682d70
call fcn.0042c170
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4d72ed
call fcn.004d9850
sub eax, dword [ebp - 0x498]
cmp eax, 0x2710
ja 0x4d72ed
call fcn.004eeaba
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x32
js 0x4d72df
call fcn.004eeaba
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x32
cmp edx, 0x7fffffff
jge 0x4d72df
call fcn.004eeaba
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x32
js 0x4d72df
call fcn.004eeaba
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x32
cmp edx, 0x7fffffff
jge 0x4d72df
call fcn.004eeaba
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x32
push edx
jmp 0x4d72e1
push 0xa
call esi
inc edi
cmp edi, 0xa
jl 0x4d7240
call fcn.004d9850
mov edi, eax
mov dword [ebp - 0x498], edi
test ebx, ebx
jne 0x4d73ba
cmp dword [0x6835e8], ebx
jne 0x4d7326
push 0x682d70
mov dword [0x6835e8], 1
push str.:7:1_of_1:GetPAULATime___FAILED:_could_not_create_temp_file_on_server___s_
call fcn.00424a90
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp dword [0x6835d4], 0
jne 0x4d76ff
push 0x6835c4
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp - 0x48c]
movups xmm0, xmmword [0x6835c4]
movups xmmword [esi], xmm0
jne 0x4d738e
lea eax, [ebp - 0x49c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x4d738e
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4d738e
push esi
lea eax, [ebp - 0x494]
push eax
call ebx
cmp dword [ebp + 0x10], 0
je 0x4d78d9
mov dword [0x6835c0], 0
call fcn.004245e0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
lea eax, [ebp - 0x24]
push 0x1f
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call fcn.0045df50
add esp, 8
push eax
call fcn.004d9850
push eax
push 0x21e88e
push 0x16
call fcn.00457a30
add esp, 8
push eax
push str.Current_Time__d_d:__s
push ebx
call fcn.004041d0
push ebx
call fcn.0042bfc0
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0x298]
add esp, 0x18
push eax
push 0x682d70
call esi
cmp eax, 0xffffffff
jne 0x4d743d
cmp dword [0x6835ec], 0
jne 0x4d7326
push 0x682d70
mov dword [0x6835ec], 1
push str.:8:1_of_1:GetPAULATime___FAILED:_could_not_find_the_temp_file_on_server_after_creation___s_
jmp 0x4d731e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x682d70
call fcn.00429a50
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0x288]
push 0x104
mov dword [ebp - 0x494], eax
lea eax, [ebp - 0x128]
push 0
push eax
mov dword [ebp - 0x490], ecx
call fcn.004e69c0
push 0x140
lea eax, [ebp - 0x3d8]
push 0
push eax
call fcn.004e69c0
add esp, 0x1c
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
movups xmmword [ebp - 0x148], xmm0
call fcn.004d9850
sub eax, dword [0x6835b8]
cmp eax, 0x493e0
jb 0x4d75fa
call fcn.004d9850
push 0x682d70
mov dword [0x6835b8], eax
call fcn.004a73a0
add esp, 4
test eax, eax
jne 0x4d75fa
push 0x104
lea eax, [ebp - 0x128]
push 0x682d70
push eax
call fcn.004a9a20
lea eax, [ebp - 0x128]
push eax
call fcn.004a8490
push str.PAULATempTimeDetectionFile
lea eax, [ebp - 0x128]
push 0x531204
push eax
call fcn.004a94f0
add esp, 0x1c
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x128]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4d75fa
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ebx, dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word [eax + eax]
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x3d4]
push eax
call ebx
test eax, eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x3d4]
jg 0x4d7577
lea eax, [ebp - 0x3c4]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movups xmm0, xmmword [ebp - 0x148]
sub esp, 0x10
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax], xmm0
call fcn.004d96a0
add esp, 0x20
cmp eax, 0xdbba0
jle 0x4d75db
lea eax, [ebp - 0x128]
push eax
call fcn.004a8490
push 0x104
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.004a98f0
lea eax, [ebp - 0x128]
push eax
call fcn.00429a50
add esp, 0x14
lea eax, [ebp - 0x3d8]
push eax
push esi
call edi
test eax, eax
jne 0x4d7550
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x498]
cmp dword [ebp - 0x284], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x138], xmm0
jne 0x4d767e
cmp dword [ebp - 0x280], 0
jne 0x4d767e
cmp dword [ebp - 0x28c], 0
jne 0x4d766f
cmp dword [ebp - 0x288], 0
jne 0x4d766f
cmp dword [ebp - 0x294], 0
jne 0x4d7660
cmp dword [ebp - 0x290], 0
jne 0x4d7660
cmp dword [0x6835f0], 0
jne 0x4d7326
push 0x682d70
mov dword [0x6835f0], 1
push str.:8:1_of_1:GetPAULATime___FAILED:_FindFirstFile___could_not_determine_the_file_time_of_the_time_file:___s_
jmp 0x4d731e
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x294]
jmp 0x4d768b
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x28c]
jmp 0x4d768b
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x284]
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push eax
call ebx
movzx eax, word [ebp - 0x138]
movzx ecx, word [ebp - 0x136]
add ecx, eax
movzx eax, word [ebp - 0x132]
add ecx, eax
movzx eax, word [ebp - 0x130]
add ecx, eax
movzx eax, word [ebp - 0x12e]
add ecx, eax
movzx eax, word [ebp - 0x12c]
add ecx, eax
movzx eax, word [ebp - 0x12a]
add ecx, eax
jne 0x4d78fb
cmp dword [0x6835f4], ecx
jne 0x4d732c
push str.:8:1_of_1:GetPAULATime___FAILED:_FindFirstFile___succeeded_but_the_time_returned_is_zerod_____
mov dword [0x6835f4], 1
call fcn.00424a90
add esp, 4
jmp 0x4d732c
call fcn.004d9850
movzx ecx, word [0x6835d2]
sub ecx, dword [0x6835d4]
add ecx, eax
mov dword [ebp - 0x498], eax
cmp ecx, 0x3e8
jb 0x4d787f
mov di, word [0x6835ce]
mov eax, 0x10624dd3
mov bx, word [0x6835c8]
mov si, word [0x6835c6]
mul ecx
mov ax, word [0x6835ca]
shr edx, 6
mov dword [ebp - 0x4a0], edx
mov dx, word [0x6835cc]
mov dword [ebp - 0x488], eax
nop dword [eax]
mov eax, dword [0x6835d0]
sub ecx, 0x3e8
inc eax
mov dword [ebp - 0x490], ecx
movzx ecx, ax
mov word [0x6835d0], ax
cmp ecx, 0x3c
jb 0x4d7792
lea eax, [ecx - 0x3c]
inc di
mov word [0x6835d0], ax
mov word [0x6835ce], di
cmp di, 0x3c
jb 0x4d77b0
mov eax, 0xffc4
add di, ax
inc dx
mov word [0x6835ce], di
mov word [0x6835cc], dx
cmp dx, 0x18
jb 0x4d77dc
mov eax, dword [ebp - 0x488]
xor edx, edx
inc ax
mov word [0x6835cc], dx
inc bx
mov dword [ebp - 0x488], eax
mov word [0x6835ca], ax
mov word [0x6835c8], bx
cmp bx, 7
jb 0x4d77eb
xor ebx, ebx
mov word [0x6835c8], bx
movzx eax, si
cmp eax, 4
je 0x4d7821
cmp eax, 6
je 0x4d7821
cmp eax, 9
je 0x4d7821
cmp eax, 0xb
je 0x4d7821
cmp eax, 2
je 0x4d780e
mov ecx, 0x1f
jmp 0x4d7826
mov al, byte [0x6835c4]
and al, 3
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 0x1d
jmp 0x4d7826
mov ecx, 0x1e
mov eax, dword [ebp - 0x488]
movzx eax, ax
cmp eax, ecx
jbe 0x4d784d
mov eax, 1
inc si
mov dword [ebp - 0x488], eax
mov word [0x6835ca], ax
mov word [0x6835c6], si
cmp si, 0xc
jbe 0x4d7866
inc word [0x6835c4]
mov esi, 1
mov word [0x6835c6], si
sub dword [ebp - 0x4a0], 1
mov ecx, dword [ebp - 0x490]
jne 0x4d7760
mov eax, dword [ebp - 0x498]
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp - 0x48c]
mov word [0x6835d2], cx
movups xmm0, xmmword [0x6835c4]
mov dword [0x6835d4], eax
movups xmmword [ebx], xmm0
jne 0x4d78d9
lea eax, [ebp - 0x49c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x4d78d9
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4d78d9
push ebx
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [0x6835bc], 0
call fcn.004245e0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [ebp - 0x138]
lea eax, [ebp - 0x484]
push eax
movups xmmword [0x6835c4], xmm0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ebx, dword [ebp - 0x48c]
lea eax, [ebp - 0x484]
push ebx
push 0x6835c4
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
cmp dword [ebp + 0xc], 0
movups xmm0, xmmword [ebx]
mov dword [0x6835d4], edi
movups xmmword [0x6835c4], xmm0
jne 0x4d794f
push ebx
push ebx
call fcn.004d9be0
add esp, 8
mov dword [0x6835bc], 0
call fcn.004245e0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret