Function at 0x479fe0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x5a8dfc
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x61ac94]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61ac94]
xor eax, esp
push eax
lea eax, [esp + 0x284]
mov dword fs:[0], eax
mov eax, dword [esp + 0x298]
mov edi, dword [esp + 0x294]
mov ecx, dword [esp + 0x29c]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
sub eax, 0x10
push eax
mov dword [esp + 0x28], ecx
call fcn.0040c050
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 4
xor ebx, ebx
push 0x5bda20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x294], ebx
call fcn.0040c9c0
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x47a0a6
mov dword [esp + 0x28c], eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47a09f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x47a2e2
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040e080
push 0x5bda1c
lea edx, [esp + 0x30]
push edi
push edx
mov byte [esp + 0x298], 1
call fcn.0040d150
lea ecx, [esp + 0x68]
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x2a4], 2
call fcn.0040d150
add esp, 0x18
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x28c], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47a113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov edx, 0x5bf340
mov ecx, eax
mov edi, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0x47a146
cmp si, bx
je 0x47a142
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x47a146
add ecx, 4
add edx, 4
cmp si, bx
jne 0x47a120
xor ecx, ecx
jmp 0x47a14b
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
setne cl
cmp cl, bl
je 0x47a247
mov ecx, 0x5bf338
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47a186
cmp dx, bx
je 0x47a182
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47a186
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x47a160
xor eax, eax
jmp 0x47a18b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
setne al
cmp al, bl
je 0x47a247
test byte [esp + 0x30], 0x10
je 0x47a1bb
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00479fe0
add esp, 0xc
jmp 0x47a247
lea ecx, [esp + 0x5c]
push str..vir
push ecx
call fcn.004e6559
add esp, 8
test eax, eax
jne 0x47a235
lea edx, [esp + 0x5c]
push str..bak
push edx
call fcn.004e6559
add esp, 8
test eax, eax
jne 0x47a235
lea eax, [esp + 0x5c]
push str..bkup
push eax
call fcn.004e6559
add esp, 8
test eax, eax
jne 0x47a235
lea ecx, [esp + 0x5c]
push str..dat
push ecx
call fcn.004e6559
add esp, 8
test eax, eax
jne 0x47a235
lea edx, [esp + 0x5c]
push str..vbk
push edx
call fcn.004e6559
add esp, 8
test eax, eax
jne 0x47a235
mov eax, dword [esp + 0x24]
mov dword [eax], 1
jmp 0x47a247
mov ecx, dword [esp + 0x28]
mov dword [ecx], 1
mov dword [esp + 0x20], 1
lea edx, [esp + 0x30]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x28c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47a27d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x28c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47a2a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
jne 0x47a0aa
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x28c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47a2de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x284]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.004e5fb0
add esp, 0x27c
ret