Function at 0x49c980
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x460], 0xffffffff
mov eax, edx
cmp dword [0x51996c], 0
push ebx
mov dword [ebp - 0x470], ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x46c], ecx
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x468], ecx
je 0x49ca22
push dword [ebp + 0xc]
push 0x414974
push eax
push 0x41f944
push 0x41fb9c
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.0043ec15
add esp, 0x1c
lea eax, [ebp - 0x208]
mov ecx, 0xb7b
push esi
push 0x41fbc0
push eax
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
add esp, 0x14
mov ecx, esi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x49ca29
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x106]
mov dword [ebp - 0x45c], eax
add eax, eax
push eax
call fcn.004fee60
mov ebx, eax
test ebx, ebx
jne 0x49ca64
call fcn.004c73cc
mov edi, eax
push edi
push 0x5770144
jmp 0x49cc1b
mov edx, dword [ebp - 0x45c]
mov ecx, ebx
push esi
call fcn.0043eb7d
mov edx, dword [ebp - 0x45c]
mov ecx, ebx
push 0x41fbd4
call fcn.0043eadb
lea eax, [ebp - 0x458]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x460], eax
cmp eax, 0xffffffff
jne 0x49caaf
call fcn.004c73cc
mov edi, eax
push edi
push 0x5830144
jmp 0x49cc1b
lea ecx, [ebp - 0x42c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x49cab8
sub ecx, edx
sar ecx, 1
test dword [ebp - 0x458], 0x10
jne 0x49cbe8
cmp dword [ebp - 0x43c], edi
jne 0x49cbe8
cmp dword [ebp - 0x438], edi
je 0x49cbe8
xor eax, eax
cmp ax, word [ebp - 0x42c]
je 0x49cbe8
cmp ecx, 0x104
ja 0x49cbe8
mov edx, dword [ebp - 0x45c]
mov ecx, ebx
push esi
call fcn.0043eb7d
mov edx, dword [ebp - 0x45c]
mov ecx, ebx
push 0x4050fc
call fcn.0043eadb
mov edx, dword [ebp - 0x45c]
lea eax, [ebp - 0x42c]
push eax
mov ecx, ebx
call fcn.0043eadb
push dword [ebp - 0x468]
mov edx, dword [ebp - 0x464]
push dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x470]
push dword [ebp + 0xc]
push ebx
call fcn.0049c826
test eax, eax
jns 0x49cbe8
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push 0x414974
push dword [ebp - 0x464]
push 0x41f944
push 0x41fb9c
push 0x100
push eax
call fcn.0043ec15
add esp, 0x1c
mov ecx, 0xb5e
call fcn.004cf8b9
mov ecx, 0xb64
mov esi, eax
call fcn.004cf8b9
push esi
push eax
push 0x41fbdc
call fcn.004c5942
add esp, 0xc
lea eax, [ebp - 0x208]
mov ecx, 0xb7a
push ebx
push 0x41f990
push eax
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
mov esi, dword [ebp - 0x474]
add esp, 0x14
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x49caaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x49cc21
call fcn.004c73cc
mov edi, eax
push edi
push 0x5b70144
call dword [sym.imp.certcli.dll_Ordinal_357]
push ebx
call fcn.004feed0
mov eax, dword [ebp - 0x460]
cmp eax, 0xffffffff
je 0x49cc39
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0x10