Function at 0x4a2868
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x284
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x280], eax
push ebx
push esi
xor eax, eax
mov esi, edx
push edi
or edi, 0xffffffff
mov dword [esp + 0xc], eax
mov ebx, ecx
cmp dword [0x51996c], eax
je 0x4a28ca
push 0x406520
call fcn.004c5942
pop ecx
call fcn.004a0ea8
push ebx
mov ecx, 0xb8f
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
xor eax, eax
push eax
push esi
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [0x519934], eax
test eax, eax
jne 0x4a28ff
call fcn.004c73cc
mov esi, eax
push esi
push 0x97f0146
jmp 0x4a2adb
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x519938], eax
test eax, eax
jne 0x4a2924
call fcn.004c73cc
mov esi, eax
push esi
push 0x98c0146
jmp 0x4a2adb
mov ecx, ebx
xor eax, eax
inc eax
mov dword [0x51993c], eax
mov dword [0x519940], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4a2936
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 3]
lea eax, [esi + esi]
push eax
call fcn.004fee60
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4a296b
call fcn.004c73cc
mov esi, eax
push esi
push 0x9990146
jmp 0x4a2adb
push ebx
mov edx, esi
mov ecx, eax
call fcn.0043eb7d
mov edx, esi
mov esi, dword [esp + 0xc]
push 0x41fbd4
mov ecx, esi
call fcn.0043eadb
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a29ac
call fcn.004c73cc
mov esi, eax
push esi
push 0x9a20146
jmp 0x4a2adb
test dword [esp + 0x18], 0x10
jne 0x4a2a35
cmp dword [esp + 0x34], 0
jne 0x4a2a35
cmp dword [esp + 0x38], 0
je 0x4a2a35
xor eax, eax
cmp ax, word [esp + 0x44]
je 0x4a2a35
lea ecx, [esp + 0x44]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4a29d6
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x4a2a35
lea edx, [esp + 0x26c]
lea ecx, [esp + 0x18]
call fcn.004a2726
mov esi, eax
test esi, esi
jne 0x4a2ab0
lea ecx, [esp + 0x26c]
call fcn.004a1549
test eax, eax
jne 0x4a2a35
lea eax, [esp + 0x26c]
mov edx, ebx
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x18]
call fcn.004a2109
mov esi, eax
test esi, esi
jne 0x4a2aa8
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a29ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4a2ace
call fcn.004a1da6
cmp dword [0x51996c], 0
je 0x4a2a8f
mov esi, dword [0x51993c]
test esi, esi
je 0x4a2a8f
call fcn.004a0ea8
push esi
mov ecx, 0xb98
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
add esp, 0xc
mov ecx, dword [0x519938]
call fcn.004a0c03
mov esi, eax
test esi, esi
je 0x4a2ab8
push esi
push 0x9df0146
jmp 0x4a2adb
push esi
push 0x9bc0146
jmp 0x4a2adb
push esi
push 0x9b30146
jmp 0x4a2adb
lea ecx, [esp + 0x10]
call fcn.004a2610
xor ecx, ecx
call fcn.004a168f
xor ebx, ebx
mov esi, ebx
jmp 0x4a2ae3
call fcn.004c73cc
mov esi, eax
push esi
push 0x9c80146
call dword [sym.imp.certcli.dll_Ordinal_357]
xor ebx, ebx
push dword [esp + 0xc]
call fcn.004feed0
cmp edi, 0xffffffff
je 0x4a2af8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x519934]
test eax, eax
je 0x4a2b0e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x519934], ebx
mov eax, dword [0x519938]
test eax, eax
je 0x4a2b24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x519938], ebx
mov ecx, dword [esp + 0x28c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret