Function at 0x4a0406
Capabilities:
Check for peb beingdebugged flag
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56dd72
mov eax, dword fs:[0]
push eax
sub esp, 0x3f0
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x3e8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x400]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], esi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4a0479
sub eax, ecx
sar eax, 1
mov dword [esp + 0x34], eax
cmp eax, 0x102
jbe 0x4a0530
lea eax, [esp + 0x10c]
push eax
call fcn.00403689
mov esi, eax
and dword [esp + 0x408], 0
push str.GFE::DAOS::DAOSupportImplementation::ScanFiles:_cannot_scan_
push esi
call fcn.00405d65
push ebx
push esi
call fcn.00405d65
push str._because_it_is_longer_than_MAX_PATH_with__appended
push esi
call fcn.00405d65
add esp, 0x18
lea eax, [esp + 0xd4]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x408], 1
cmp dword [esp + 0xe8], 8
mov eax, dword [esp + 0xd4]
jae 0x4a04fd
lea eax, [esp + 0xd4]
xor ecx, ecx
push eax
inc ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd8]
call fcn.0040412d
or dword [esp + 0x408], 0xffffffff
lea eax, [esp + 0x10c]
call fcn.0040262a
jmp 0x4a085f
lea ebx, [ebx + eax*2]
cmp word [ebx - 2], 0x5c
push 0x19b
sete al
movzx eax, al
push eax
mov edi, 0x5a660c
call fcn.004924b4
pop ecx
mov eax, 0x587bd0
mov edx, ebx
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4a0559
mov eax, dword [esp + 0x1c]
push dword [eax + 0x30]
lea ecx, [esp + 0x1a8]
push 0
push 0
push ecx
push dword [eax + 0x2c]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], eax
push 2
pop edi
xor ecx, ecx
mov dword [esp + 0x408], edi
mov word [ebx], cx
cmp eax, 0xffffffff
jne 0x4a0649
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x10c]
push eax
call fcn.00403689
mov esi, eax
push str.GFE::DAOS::DAOSupportImplementation::ScanFiles:_FindFirstFileEx_failed_with
push esi
mov byte [esp + 0x410], 3
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
push str._for
push esi
call fcn.00405d65
push dword [esp + 0x18]
push esi
call fcn.00405d65
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x408], 4
cmp dword [esp + 0xe8], 8
mov eax, dword [esp + 0xd4]
jae 0x4a0622
lea eax, [esp + 0xd4]
xor ecx, ecx
push eax
inc ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd8]
call fcn.0040412d
mov byte [esp + 0x408], 2
jmp 0x4a051f
mov eax, ebx
lea ecx, [esp + 0x1d0]
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4a066f
push 0
call fcn.00491e21
test al, al
jne 0x4a0885
push dword [esp + 0x10]
sub dword [esp + 0x18], edi
push dword [esp + 0x24]
xor eax, eax
sub ebx, edi
mov word [ebx], ax
call dword [esp + 0x30]
add dword [esp + 0x1c], edi
pop ecx
pop ecx
push 0x5c
pop eax
mov word [ebx], ax
add ebx, edi
xor eax, eax
xor edx, edx
mov word [ebx], ax
cmp word [esp + 0x1d0], dx
je 0x4a0835
cmp word [esp + 0x1d0], 0x2e
jne 0x4a06db
cmp word [esp + 0x1d2], dx
je 0x4a0835
cmp word [esp + 0x1d2], 0x2e
jne 0x4a06db
cmp word [esp + 0x1d4], dx
je 0x4a0835
test byte [esp + 0x1a4], 0x10
lea eax, [esp + 0x1d0]
je 0x4a0819
add dword [esi + 8], 1
adc dword [esi + 0xc], edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, edi
cmp cx, dx
jne 0x4a06fa
mov ecx, dword [esp + 0x34]
sub eax, esi
sar eax, 1
lea eax, [eax + ecx + 1]
cmp eax, 0x103
jbe 0x4a07bb
lea eax, [esp + 0x3c]
push eax
call fcn.00403689
mov esi, eax
push str.GFE::DAOS::DAOSupportImplementation::ScanFiles:_Cannot_scan_under_path_
push esi
mov byte [esp + 0x410], 5
call fcn.00405d65
push dword [esp + 0x18]
push esi
call fcn.00405d65
lea eax, [esp + 0x1e0]
push eax
push esi
call fcn.00405d65
push str._as_it_is_longer_than_MAX_PATH.
push esi
call fcn.00405d65
add esp, 0x20
lea eax, [esp + 0xf0]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x408], 6
cmp dword [esp + 0x104], 8
mov eax, dword [esp + 0xf0]
jae 0x4a078f
lea eax, [esp + 0xf0]
push eax
mov ecx, edi
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xf4]
call fcn.0040412d
lea eax, [esp + 0x3c]
mov byte [esp + 0x408], 2
call fcn.0040262a
jmp 0x4a0810
lea eax, [esp + 0x1d0]
movzx ecx, word [eax]
mov esi, dword [esp + 0x14]
mov word [esi + eax], cx
add eax, edi
cmp cx, dx
jne 0x4a07c2
lea eax, [ebx - 2]
mov cx, word [eax + 2]
add eax, edi
cmp cx, dx
jne 0x4a07d7
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push dword [esp + 0x30]
mov edi, eax
push dword [esp + 0x28]
mov esi, 0x584ab8
push dword [esp + 0x34]
movsd dword es:[edi], dword [esi]
push dword [esp + 0x40]
push dword [esp + 0x24]
call fcn.004a0406
xor eax, eax
mov word [ebx], ax
mov esi, dword [esp + 0x18]
push 2
pop edi
jmp 0x4a0835
push dword [esp + 0x20]
add dword [esi], 1
mov ecx, dword [esp + 0x34]
push eax
adc dword [esi + 4], edx
push dword [esp + 0x18]
mov edx, dword [esp + 0x28]
call fcn.004a0a25
lea eax, [esp + 0x1a4]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a0658
cmp dword [esp + 0x24], eax
je 0x4a085f
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x400]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret 0x18
lea ebx, [esp + 0x10c]
call fcn.0049deaf
push 0x5c9828
mov eax, ebx
push eax
call fcn.0051eb2a
int3