Function at 0x5d33e2
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2d0
mov eax, 0x61082a
call fcn.004db52a
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x290]
push edx
call fcn.0040d2ee
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x290]
push 0x5c
pop ecx
mov eax, dword [esi - 8]
movzx eax, word [esi + eax*2 - 2]
cmp ax, cx
je 0x5d343a
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], ecx
push eax
push 1
lea ecx, [ebp - 0x290]
call fcn.0040f454
mov esi, dword [ebp - 0x290]
push edi
lea ecx, [ebp - 0x294]
call fcn.0040d2ee
mov eax, dword [0x668294]
mov edi, str.ttp_.dll
push edi
mov dword [ebp - 0x28c], eax
call fcn.00505bb3
pop ecx
push edi
push eax
push esi
push dword [esi - 8]
lea ecx, [ebp - 0x28c]
call fcn.0040f4c7
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x28c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x298], ebx
cmp ebx, 0xffffffff
mov ebx, 0x668010
jne 0x5d34ca
lea ecx, [edi - 0xc]
cmp ecx, ebx
je 0x5d34a4
call fcn.00407965
mov ecx, dword [ebp - 0x294]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5d34b6
call fcn.00407965
lea ecx, [esi - 0xc]
cmp ecx, ebx
je 0x5d34c2
call fcn.00407965
xor eax, eax
inc eax
jmp 0x5d38cb
test byte [ebp - 0x278], 0x10
jne 0x5d3878
mov eax, dword [ebp - 0x294]
cmp dword [eax - 8], 0
je 0x5d34ff
push ecx
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040cf21
cmp eax, 0xffffffff
jne 0x5d3878
mov eax, dword [0x668294]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00505bb3
pop ecx
lea ecx, [ebp - 0x24c]
push ecx
push eax
push esi
push dword [esi - 8]
lea ecx, [ebp - 0x27c]
call fcn.0040f4c7
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x28c]
call fcn.0040d242
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5d3552
call fcn.00407965
and dword [ebp - 0x280], 0
push 0x2c
mov byte [ebp - 4], 3
call fcn.004da873
pop ecx
push ecx
mov ecx, eax
call fcn.004af0d8
mov dword [ebp - 0x280], eax
test eax, eax
je 0x5d38d3
mov edi, dword [ebp - 0x28c]
mov ecx, eax
push edi
call fcn.005d3d00
test eax, eax
jns 0x5d35a3
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2b0]
push 0x656044
jmp 0x5d38e8
and dword [ebp - 0x27c], 0
xor eax, eax
and dword [ebp - 0x284], 0
mov dword [ebp - 0x288], eax
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x280]
push eax
call fcn.005d3c58
test eax, eax
jns 0x5d3656
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x5d35ec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x27c], 0
je 0x5d363c
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x27c], eax
lock inc dword [eax + 0x28]
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0xd
push eax
mov ecx, 0x675338
call fcn.004b2c36
mov ecx, dword [ebp - 0x280]
call fcn.004af118
mov ecx, dword [ebp - 0x280]
call fcn.004af118
mov dword [ebp - 4], 2
jmp 0x5d3878
mov dword [ebp - 0x2b4], 0x80004001
lea eax, [ebp - 0x2b4]
push 0x656044
jmp 0x5d38e8
push 0x10
lea eax, [ebp - 0x24]
push 0x631940
push eax
call fcn.004ddf58
add esp, 0xc
test eax, eax
jne 0x5d36c3
push dword [ebp - 0x284]
lea ecx, [ebp - 0x29c]
call fcn.004b2083
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2cc]
push dword [ebp - 0x29c]
push dword [ebp - 0x288]
push dword [ebp - 0x280]
call fcn.004af1f3
push eax
mov byte [ebp - 4], 6
call fcn.004b28aa
lea ecx, [ebp - 0x2cc]
call fcn.004b1c72
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x29c]
jmp 0x5d3817
push 0x10
lea eax, [ebp - 0x24]
push 0x631790
push eax
call fcn.004ddf58
add esp, 0xc
test eax, eax
jne 0x5d373b
push dword [ebp - 0x284]
lea ecx, [ebp - 0x2a0]
call fcn.004b205a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2dc]
push dword [ebp - 0x2a0]
push dword [ebp - 0x288]
push dword [ebp - 0x280]
call fcn.004b248b
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 8
push eax
mov ecx, 0x675308
call fcn.004b29b5
lea ecx, [ebp - 0x2dc]
call fcn.004af300
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2a0]
jmp 0x5d3817
push 0x10
lea eax, [ebp - 0x24]
push 0x6318bc
push eax
call fcn.004ddf58
add esp, 0xc
test eax, eax
jne 0x5d37aa
push dword [ebp - 0x284]
lea ecx, [ebp - 0x2a4]
call fcn.004b2031
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2cc]
push dword [ebp - 0x2a4]
push dword [ebp - 0x288]
push dword [ebp - 0x280]
call fcn.004af3a3
push eax
mov ecx, 0x675318
mov byte [ebp - 4], 0xa
call fcn.004b2a8d
lea ecx, [ebp - 0x2cc]
call fcn.004b1d28
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2a4]
jmp 0x5d3817
push 0x10
lea eax, [ebp - 0x24]
push 0x6319fc
push eax
call fcn.004ddf58
add esp, 0xc
test eax, eax
jne 0x5d382b
push dword [ebp - 0x284]
lea ecx, [ebp - 0x2a8]
call fcn.004b2008
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2c8]
push dword [ebp - 0x2a8]
push dword [ebp - 0x288]
push dword [ebp - 0x280]
call fcn.004af49a
push eax
mov ecx, 0x675328
mov byte [ebp - 4], 0xc
call fcn.004b2b82
lea ecx, [ebp - 0x2c8]
call fcn.004b1d86
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x27c], 1
test eax, eax
je 0x5d382b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x5d383f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x288]
inc eax
jmp 0x5d35ac
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x298]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5d34ca
push dword [ebp - 0x298]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [edi - 0xc]
cmp ecx, ebx
je 0x5d38ab
call fcn.00407965
mov ecx, dword [ebp - 0x294]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5d38bd
call fcn.00407965
lea ecx, [esi - 0xc]
cmp ecx, ebx
je 0x5d38c9
call fcn.00407965
xor eax, eax
call fcn.004db47c
ret 4
mov dword [ebp - 0x2ac], 0x8007000e
lea eax, [ebp - 0x2ac]
push 0x656044
push eax
call fcn.004e179d
int3