Function at 0x4b1d40
Capabilities:
Enumerate files on windows
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5c6526
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea ecx, [esi + 4]
call fcn.0058d50f
xor ebp, ebp
lea ecx, [esi + 0x18]
mov dword [esp + 0x164], ebp
call fcn.0058d50f
mov eax, dword [0x639698]
mov dword [esi + 0x3c], eax
mov dword [esi], 0x5e3950
mov dword [esi + 0x30], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x34], ebp
mov edi, 0x5dad7c
mov dword [esp + 0x164], 1
mov dword [esi + 0x60], edi
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x7c], edi
mov dword [esi + 0x88], ebp
mov dword [esi + 0x84], ebp
mov dword [esi + 0x8c], ebp
mov dword [esi + 0x98], edi
mov dword [esi + 0xa4], ebp
mov dword [esi + 0xa0], ebp
mov dword [esi + 0xa8], ebp
mov dword [esi + 0xb4], edi
mov dword [esi + 0xc0], ebp
mov dword [esi + 0xbc], ebp
mov dword [esi + 0xc4], ebp
or ecx, 0xffffffff
mov ebx, 0x20
mov eax, 0x100
mov dword [esi + 0xf4], ebp
mov dword [esi + 0xf8], ebp
mov dword [esi + 0xfc], ecx
mov dword [esi + 0x100], ecx
mov dword [esi + 0x10c], 0x2b11
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], eax
mov dword [esi + 0x118], ebp
mov dword [esi + 0x11c], ebp
mov dword [esi + 0x120], ebp
mov dword [esi + 0x124], ebp
mov dword [esi + 0x128], ebp
mov dword [esi + 0x30e6c], ebp
mov dword [esi + 0x30e70], ebp
mov dword [esi + 0x30e78], 0x800
mov edx, dword [0x639698]
mov dword [esi + 0x30e84], edx
mov dword [esi + 0x30ea0], ebp
mov dword [esi + 0x30ea4], ebp
mov dword [esi + 0x30ea8], ecx
mov dword [esi + 0x30eac], ecx
mov dword [esi + 0x30eb8], 0x2b11
mov dword [esi + 0x30e90], ebx
mov dword [esi + 0x30e94], eax
mov dword [esi + 0x30e98], ebx
mov dword [esi + 0x30e9c], eax
mov dword [esi + 0x30ec4], ebp
mov dword [esi + 0x30ec8], ebp
mov dword [esi + 0x30ecc], ebp
mov dword [esi + 0x30ed0], ebp
mov dword [esi + 0x30ed4], ebp
mov dword [esi + 0x61c18], ebp
mov dword [esi + 0x61c1c], ebp
mov dword [esi + 0x61c24], 0x800
lea ecx, [esi + 0x6435c]
mov byte [esp + 0x164], 8
call fcn.004cd970
mov dword [esi + 0x7e390], edi
mov dword [esi + 0x7e39c], ebp
mov dword [esi + 0x7e398], ebp
mov dword [esi + 0x7e3a0], ebp
mov dword [esi + 0x7e3ac], edi
mov dword [esi + 0x7e3b8], ebp
mov dword [esi + 0x7e3b4], ebp
mov dword [esi + 0x7e3bc], ebp
mov dword [esi], 0x5e38f0
lea edi, [esi + 0x7e3e4]
mov ecx, 0x28
xor eax, eax
mov dword [esi + 0x7e4c0], ebp
push 0x24
rep stosd dword es:[edi], eax
mov byte [esp + 0x168], 0xb
call fcn.0058ecf8
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebp
mov byte [esp + 0x164], 0xc
je 0x4b1f7b
push 0x41
push 0x3d
mov ecx, eax
call fcn.004c18d0
jmp 0x4b1f7d
xor eax, eax
mov dword [esi + 0x7e38c], eax
mov dword [esi + 0x7e48c], ebp
mov dword [esi + 0x7e3e0], ebp
mov dword [esi + 0xfc], ebp
mov dword [esi + 0x100], ebp
or edi, 0xffffffff
mov dword [esi + 0x10c], 0x2b11
mov dword [esi + 0x50], ebp
push 0x1c
mov byte [esp + 0x168], 0xb
mov dword [esi + 0x7e388], ebp
mov dword [esi + 0x7e4cc], ebp
mov dword [esi + 0x7e4d0], ebp
mov dword [esi + 0x7e490], 0x14
mov dword [esi + 0x7e484], ebp
mov dword [esi + 0x7e4a4], edi
mov dword [esi + 0x7437c], ebp
mov dword [esi + 0x7e384], ebp
mov dword [esi + 0x7e494], ebp
mov dword [esi + 0x7e498], ebp
mov dword [esi + 0x74378], ebp
mov dword [esi + 0x7e4bc], 0xfffffff6
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], 0x3e8
mov dword [esi + 0x48], ebp
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xe0], ebp
mov dword [esi + 0x7e49c], ebp
mov dword [esi + 0x7e4a0], ebp
mov dword [esi + 0xd4], ebp
mov dword [esi + 0xd8], ebx
mov dword [esi + 0x5c], 0xfffffc18
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebp
call fcn.0058ecf8
add esp, 4
cmp eax, ebp
je 0x4b2060
mov dword [eax], fcn.004eac90
mov dword [eax + 0xc], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0x10], ebp
jmp 0x4b2062
xor eax, eax
push ebp
push ebp
push ebp
mov dword [esi + 0x7e4c4], eax
mov edx, dword [eax]
push ebp
push 5
push 0x82
mov ecx, eax
call dword [edx]
push 0x1c
call fcn.0058ecf8
add esp, 4
cmp eax, ebp
je 0x4b2098
mov dword [eax], fcn.004eac90
mov dword [eax + 0xc], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0x10], ebp
jmp 0x4b209a
xor eax, eax
push ebp
push ebp
push ebp
mov dword [esi + 0x7e4c8], eax
mov edx, dword [eax]
push ebp
push 5
push 0x82
mov ecx, eax
call dword [edx]
push str.Mode.dll
lea eax, [esp + 0x18]
push 0x664810
push eax
mov dword [esi + 0x61c38], ebp
mov dword [esi + 0x30e8c], edi
mov dword [esi + 0x61c28], ebp
mov dword [esi + 0x61c2c], 0x2b11
mov dword [esi + 0x61c30], ebp
mov dword [esi + 0x61c34], ebp
call fcn.00593970
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x16c], 0xd
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
setne al
cmp eax, ebp
je 0x4b21d2
test dword [esp + 0x1c], 0x1356
jne 0x4b21be
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, ebp
je 0x4b21be
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ModeCommand
push ebx
call edi
cmp eax, ebp
je 0x4b217d
push ebp
push ebp
push ebp
push 0x17
push ebp
call eax
add esp, 0x14
cmp eax, ebp
je 0x4b217d
mov edx, dword [esi + 0xc]
lea ecx, [esi + 4]
push eax
push edx
call fcn.0058d6eb
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x18]
lea edx, [esp + 0x48]
push edx
push eax
call fcn.0058d6eb
push str.GetMacros
push ebx
call edi
cmp eax, ebp
je 0x4b21b3
call eax
mov edi, eax
cmp edi, ebp
je 0x4b21b3
mov eax, dword [edi]
cmp eax, ebp
je 0x4b21b3
mov ecx, dword [0x664718]
push eax
push ecx
mov ecx, 0x664710
call fcn.0058d6eb
mov eax, dword [edi + 4]
add edi, 4
cmp eax, ebp
jne 0x4b2197
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, ebp
jne 0x4b211b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 0xb
call fcn.005936db
mov ecx, dword [esp + 0x15c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x158
ret