Function at 0x4afcf0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf5c
push ebx
push esi
push edi
push 0xa
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x24], ecx
mov ecx, dword [0x621c80]
push 0xbcc6
push ecx
call sym.vidcap60.exe__SfLoadString_16
mov eax, dword [0x621c80]
push 0xa
lea edx, [esp + 0x58]
push edx
push 0xbcc7
push eax
call sym.vidcap60.exe__SfLoadString_16
push 1
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x40
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [0x5d2614]
push ecx
lea edx, [esp + 0xadc]
push edx
mov dword [esp + 0x28], eax
call ebx
lea eax, [esp + 0xae0]
push str..
push eax
call dword [0x5d24cc]
add esp, 0x10
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0xadc]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x4b01c3
jmp 0x4afda0
lea ecx, [esp + 0x94]
mov edx, dword [ecx]
mov eax, 0x5d8fd8
cmp edx, dword [eax]
je 0x4b0199
mov ecx, 3
mov edi, 0x5e86f8
lea esi, [esp + 0x94]
xor eax, eax
repe cmpsw word [esi], word es:[edi]
je 0x4b0199
test byte [esp + 0x68], 6
jne 0x4b0199
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0xadc]
push edx
call ebx
mov esi, dword [0x5d24cc]
lea eax, [esp + 0xae0]
push 0x5d8fc8
push eax
call esi
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0xaec]
push edx
call esi
mov eax, dword [esp + 0x80]
add esp, 0x18
test al, 0x10
mov dword [esp + 0x2bc], 0
je 0x4afeb3
test al, 2
jne 0x4b0199
or eax, 0x10000
mov dword [esp + 0x610], eax
lea eax, [esp + 0xad8]
push eax
call fcn.004af310
test eax, eax
je 0x4afe5f
or dword [esp + 0x610], 0x20000
push 0x4603
lea ecx, [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xae0]
push edx
call fcn.004af6b0
test ax, ax
jne 0x4afef2
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x2c8]
push ecx
call ebx
mov eax, dword [0x621c80]
add esp, 8
push 0x50
lea edx, [esp + 0x4d0]
push edx
push 0xbcc8
push eax
call sym.vidcap60.exe__SfLoadString_16
jmp 0x4afef2
push 0x4601
lea ecx, [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xae0]
push edx
mov dword [esp + 0x61c], eax
call fcn.004af6b0
test ax, ax
jne 0x4afef2
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x2c8]
push ecx
call ebx
add esp, 8
mov eax, dword [esp + 0x2bc]
lea edx, [esp + 0x94]
test edx, edx
mov dword [esp + 0x618], eax
mov dword [esp + 0x614], eax
jne 0x4aff16
xor eax, eax
jmp 0x4aff27
lea eax, [esp + 0x94]
push eax
call dword [0x5d2620]
add esp, 4
inc eax
mov word [esp + 0x620], ax
mov eax, dword [esp + 0x620]
add eax, eax
movzx ebx, ax
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x94]
lea edi, [esp + 0x624]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x80]
push ecx
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x50
lea ecx, [esp + 0xa3c]
push ecx
push edi
lea edx, [esp + 0x3c]
push edx
push 2
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push 0x50
lea eax, [esp + 0x574]
push eax
push edi
lea ecx, [esp + 0x3c]
push ecx
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
test byte [esp + 0x68], 0x10
je 0x4b0005
lea edx, [esp + 0xa38]
push edx
lea eax, [esp + 0x574]
push eax
movzx eax, word [esp + 0x628]
lea ecx, [esp + 0x4d4]
push ecx
lea edx, [esp + 0x2d0]
push edx
lea ecx, [esp + eax*2 + 0x634]
push str._s_t_t_s_t_s__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x4b0100
mov edi, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
xor esi, esi
xor eax, eax
or esi, edx
or edi, eax
cmp word [esp + 0x4cc], ax
jne 0x4b0097
lea ecx, [esp + 0x94]
push ecx
call sym.vidcap60.exe__SfGetFileNameExtensionPtrW_4
cmp word [eax], 0
je 0x4b0062
add eax, 2
push eax
lea edx, [esp + 0xd64]
push 0x5ea008
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0xd60]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x4b006c
mov word [esp + 0xd60], 0
mov edx, dword [0x621c80]
lea ecx, [esp + 0xd60]
push ecx
push 0xbcc9
push edx
call sym.vidcap60.exe__SfGetString_8
push eax
lea eax, [esp + 0x4d4]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jg 0x4b00ac
jl 0x4b00a5
cmp esi, 0x400
ja 0x4b00ac
mov esi, 0x400
xor edi, edi
lea ecx, [esp + 0xce0]
push ecx
push edi
push esi
call sym.vidcap60.exe__SfGetByteSizeText_12
lea edx, [esp + 0xa38]
push edx
lea eax, [esp + 0x574]
push eax
lea ecx, [esp + 0x4d4]
push ecx
movzx ecx, word [esp + 0x62c]
lea edx, [esp + 0xcec]
push edx
lea eax, [esp + 0x2d4]
push eax
lea edx, [esp + ecx*2 + 0x638]
push str._s_t_s_t_s_t_s__s
push edx
call sym.vidcap60.exe_SfPrintF
add esp, 0x1c
mov word [esp + 0x622], ax
mov eax, dword [esp + 0x622]
lea ecx, [eax + eax]
push 0x18
push 1
mov dword [esp + 0x2c], ecx
call dword [0x5d24c0]
add esp, 8
test eax, eax
je 0x4b0193
mov dword [eax + 0xc], edi
mov edi, dword [ebp + 8]
mov dword [eax], 8
mov dword [eax + 8], esi
mov edx, dword [esp + 0x7c]
mov dword [eax + 0x10], edx
mov ecx, dword [esp + 0x80]
movzx edx, word [esp + 0x24]
push 0
mov dword [eax + 0x14], ecx
push 0xffffffffffffffff
mov dword [esp + 0x624], eax
lea eax, [edx + ebx + 0x16]
push eax
lea ecx, [esp + 0x61c]
push ecx
push edi
call sym.vidcap60.exe__SfList_AllocAndInsertItem_20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x4b0193
mov esi, ecx
push esi
push edi
call sym.vidcap60.exe__SfList_GrowAllocated_8
lea edx, [esi + esi]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov ebx, dword [0x5d2614]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x68]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4afda0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
jmp 0x4b01c6
or esi, 0xffffffff
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8