Function at 0x481c20
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20ec
call fcn.004ab4d0
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x20e8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x800], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov byte [esp + 0xf], 0
je 0x481f74
cmp esi, ebx
je 0x481f74
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x481c70
sub eax, edx
sar eax, 1
je 0x481f74
lea eax, [esp + 0x2a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x481f59
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2b8]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ecx, word [esp + 0x1a]
movzx edx, word [esp + 0x1e]
mov dword [esp + 0x48], eax
movzx eax, word [esp + 0x18]
mov dword [esp + 0x3c], eax
movzx eax, word [esp + 0x20]
mov dword [esp + 0x38], ecx
movzx ecx, word [esp + 0x22]
mov dword [esp + 0x34], edx
movzx edx, word [esp + 0x24]
push 0x800
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18f4]
push ebx
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], edx
call fcn.004ab450
add esp, 0xc
push 0x400
lea ecx, [esp + 0x4f4]
push ebx
push ecx
call fcn.004ab450
add esp, 0xc
push esi
lea edx, [esp + 0x18f4]
push 0x400
push edx
call fcn.004a9ecb
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x481d47
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x18f0]
mov ebx, 0x5c
cmp word [eax], bx
jne 0x481d6a
add eax, 2
push 0
push 0
push 0x400
lea ecx, [esp + 0x4fc]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x481f59
lea eax, [esp + 0x4f0]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x481da0
sub eax, edx
cmp byte [esp + eax + 0x4ef], bl
je 0x481dd8
lea edi, [esp + 0x4f0]
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x481dc0
mov dx, word [0x4fa44c]
mov word [edi], dx
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x800]
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x4f4]
call fcn.00484a50
add esp, 4
test eax, eax
jne 0x481e05
mov ecx, dword [edi + 0x800]
push ecx
call fcn.004850e0
add esp, 4
push 0x800
lea edx, [esp + 0x10f4]
push 0
push edx
call fcn.004ab450
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481e21
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], bx
push esi
lea edx, [esp + 0x10f4]
jne 0x481e46
push str._s.
jmp 0x481e4b
push 0x4ee1f8
call fcn.00411a00
add esp, 8
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10f4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x481f44
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481e80
mov si, word [esp + 0x7c]
sub eax, edx
sar eax, 1
cmp eax, 2
jne 0x481ea6
cmp si, 0x2e
jne 0x481ea6
cmp word [esp + 0x7e], si
je 0x481eca
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481eb0
sub eax, edx
sar eax, 1
cmp eax, 1
jne 0x481ed1
cmp si, 0x2e
jne 0x481ed1
lea edx, [esp + 0x50]
push edx
jmp 0x481f39
push 0x800
lea eax, [esp + 0x8f4]
push 0
push eax
call fcn.004ab450
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x7c]
push ecx
push edx
push 0x4dd780
lea eax, [esp + 0x8fc]
push 0x400
push eax
call fcn.004a9ca9
add esp, 0x14
test byte [esp + 0x50], 0x10
lea ecx, [esp + 0x8f0]
je 0x481f26
push ecx
mov ecx, dword [esp + 0x14]
call fcn.00481c20
jmp 0x481f30
mov edx, dword [esp + 0x10]
push edx
call fcn.00481970
test al, al
je 0x481f49
lea eax, [esp + 0x50]
push eax
push edi
call ebx
test eax, eax
jne 0x481e77
mov byte [esp + 0xf], 1
cmp edi, 0xffffffff
je 0x481f59
test edi, edi
je 0x481f59
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20e8]
xor ecx, esp
call fcn.004a998e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x20f4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.004a998e
mov esp, ebp
pop ebp
ret 4