Function at 0x461528
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x461531
mov eax, dword [ebp - 4]
add esp, 0xfffffea0
push ebx
push esi
push edi
mov eax, 0x530f19
call fcn.004d57f0
mov word [ebp - 0x14], 8
push 0x2001
push 0
call fcn.00455bdc
mov edi, eax
xor eax, eax
add esp, 8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x1024]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x1024]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
je 0x4615d4
lea edx, [ebp - 0x1024]
push edx
call fcn.004d2f1c
pop ecx
test eax, eax
je 0x4615d4
lea ecx, [ebp - 0x1024]
push ecx
call fcn.004d2f1c
pop ecx
movsx eax, byte [ebp + eax - 0x1025]
cmp eax, 0x5c
je 0x4615d4
push 0x5ef62a
lea edx, [ebp - 0x1024]
push edx
call fcn.004d2e40
add esp, 8
push 0x5ef62c
lea ecx, [ebp - 0x1024]
push ecx
call fcn.004d2e40
add esp, 8
test byte [0x528c3d], 4
je 0x46160a
lea eax, [ebp - 0x1024]
push eax
push 0x5ef632
push 0x528c40
call fcn.004541dc
add esp, 0xc
lea edx, [ebp - 0x3164]
push edx
lea ecx, [ebp - 0x1024]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x461834
push 0x2001
push 0
call fcn.00455bdc
add esp, 8
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
push esi
lea esi, [ebp - 0x1024]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x1024]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
test eax, eax
je 0x4616a7
lea edx, [ebp - 0x1024]
push edx
call fcn.004d2f1c
pop ecx
test eax, eax
je 0x4616a7
lea ecx, [ebp - 0x1024]
push ecx
call fcn.004d2f1c
pop ecx
movsx eax, byte [ebp + eax - 0x1025]
cmp eax, 0x5c
je 0x4616a7
push 0x5ef64b
lea edx, [ebp - 0x1024]
push edx
call fcn.004d2e40
add esp, 8
lea ecx, [ebp - 0x3138]
push ecx
lea eax, [ebp - 0x1024]
push eax
call fcn.004d2e40
add esp, 8
xor eax, eax
lea edi, [ebp - 0x1024]
or ecx, 0xffffffff
push esi
lea esi, [ebp - 0x2024]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x2024]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push eax
call fcn.004d2f1c
pop ecx
mov ebx, eax
push 0x5ef64d
call fcn.004d2f1c
pop ecx
cmp eax, ebx
jae 0x461713
push 0x5ef652
call fcn.004d2f1c
pop ecx
sub ebx, eax
mov byte [ebp + ebx - 0x2024], 0
lea eax, [ebp - 0x2024]
lea edx, [ebp - 0x1024]
push eax
push edx
lea ecx, [ebp - 0x3024]
push 0x5ef657
push ecx
call fcn.004d75f8
add esp, 0x10
lea eax, [ebp - 0x3024]
push 0
push eax
push 0x5ef663
call fcn.004be694
add esp, 0xc
lea edx, [ebp - 0x2024]
push edx
push 0x5ef671
lea ecx, [ebp - 0x3024]
push ecx
call fcn.004d75f8
add esp, 0xc
test byte [0x528c3d], 4
je 0x461790
lea eax, [ebp - 0x2024]
push eax
push 0x5ef678
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 1
call fcn.004dee84
pop ecx
lea edx, [ebp - 0x3024]
push edx
call fcn.00404c44
pop ecx
lea ecx, [ebp - 0x3024]
push ecx
lea eax, [ebp - 0x2024]
push eax
call fcn.00405860
add esp, 8
lea edx, [ebp - 0x3024]
push edx
call fcn.00404c44
pop ecx
push 0
lea ecx, [ebp - 0x2024]
push ecx
lea eax, [ebp - 0x1024]
push eax
call fcn.00438844
add esp, 0xc
test eax, eax
je 0x4617f3
lea edx, [ebp - 0x1024]
push edx
call fcn.004d70d8
pop ecx
jmp 0x461819
push 0x10000
lea ecx, [ebp - 0x2024]
push ecx
push 0x5ef67f
call fcn.004be694
add esp, 0xc
lea eax, [ebp - 0x1024]
push eax
call fcn.004d70d8
pop ecx
lea edx, [ebp - 0x3164]
push edx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x461628
push esi
call sub.KERNEL32.dll_FindClose
push 0
push 0x2001
push 0x5ef692
lea ecx, [ebp - 0x2024]
push ecx
call fcn.004563e8
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
push 0x5ef69c
lea edx, [ebp - 0x1024]
push edx
call fcn.004d75f8
add esp, 0xc
push 0x2100
lea ecx, [ebp - 0x2024]
push ecx
call fcn.00405c58
add esp, 8
test eax, eax
jne 0x4618d4
push 0x2100
lea eax, [ebp - 0x1024]
push eax
call fcn.00405c58
add esp, 8
test eax, eax
je 0x4618d4
test byte [0x528c3d], 4
je 0x4618bc
lea edx, [ebp - 0x2024]
push edx
push 0x5ef6a3
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 0
lea ecx, [ebp - 0x2024]
push ecx
lea eax, [ebp - 0x1024]
push eax
call fcn.00438844
add esp, 0xc
push 0
push 0x2001
push 0x5ef6b2
lea edx, [ebp - 0x2024]
push edx
call fcn.004563e8
add esp, 0x10
lea ecx, [ebp - 0x2024]
push ecx
push 0x5ef6be
lea eax, [ebp - 0x1024]
push eax
call fcn.004d75f8
add esp, 0xc
push 0x2100
lea edx, [ebp - 0x2024]
push edx
call fcn.00405c58
add esp, 8
test eax, eax
jne 0x461974
push 0x2100
lea ecx, [ebp - 0x1024]
push ecx
call fcn.00405c58
add esp, 8
test eax, eax
je 0x461974
test byte [0x528c3d], 4
je 0x46195c
lea eax, [ebp - 0x2024]
push eax
push 0x5ef6c5
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 0
lea edx, [ebp - 0x2024]
push edx
lea ecx, [ebp - 0x1024]
push ecx
call fcn.00438844
add esp, 0xc
push 0
call fcn.004be92c
pop ecx
mov word [ebp - 0x14], 0
jmp 0x4619a3
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x3170]
mov esi, dword [ebp - 0x316c]
mov ebx, dword [ebp - 0x3168]
pop ebp
ret