Function at 0x4de7ac
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ed0
xor eax, eax
push ebp
push 0x4ded81
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x160]
push eax
push 0x4ded94
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4ded45
mov eax, dword [0x580cd8]
cmp byte [eax], 2
je 0x4ded45
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048d8b8
mov ebx, dword [ebp - 0x160]
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x134]
mov ecx, 0x104
call fcn.00404c90
mov eax, dword [ebp - 0x10]
mov edx, 0x4deda0
call fcn.00404e2c
je 0x4ded27
mov eax, dword [ebp - 0x10]
mov edx, 0x4dedac
call fcn.00404e2c
je 0x4ded27
cmp ebx, 0x10
je 0x4de8c6
cmp ebx, 2
je 0x4de8c6
cmp ebx, 4
je 0x4de8c6
cmp ebx, 0x80
je 0x4de8c6
cmp ebx, 0x100
je 0x4de8c6
cmp ebx, 0x20
je 0x4de8c6
cmp ebx, 0x11
je 0x4de8c6
cmp ebx, 0x12
je 0x4de8c6
cmp ebx, 0x13
je 0x4de8c6
cmp ebx, 0x14
jne 0x4ded27
cmp dword [ebp + 8], 0
jne 0x4deb24
lea edx, [ebp - 0x2b0]
mov eax, dword [ebp - 0x10]
call fcn.00409c60
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x14]
call fcn.00408ebc
mov edx, dword [ebp - 0x14]
mov eax, 0x4dedb8
call fcn.00405024
test eax, eax
jne 0x4deb24
mov edx, dword [ebp - 0x14]
mov eax, 0x4dedcc
call fcn.00405024
test eax, eax
jne 0x4deb24
mov edx, dword [ebp - 0x14]
mov eax, 0x4dede0
call fcn.00405024
test eax, eax
jne 0x4deb24
push dword [ebp - 4]
push 0x4dedf0
push dword [ebp - 0x10]
lea eax, [ebp - 0x2b4]
mov edx, 3
call fcn.00404da0
mov edx, dword [ebp - 0x2b4]
mov ecx, dword [0x5812e0]
mov ecx, dword [ecx]
mov eax, 0x4dedfc
call fcn.004d4684
test al, al
jne 0x4deb24
mov eax, dword [ebp + 0xc]
call fcn.004d0190
mov ebx, eax
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
mov byte [eax + 0x12], 1
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
mov edx, dword [0x580bb0]
mov dl, byte [edx + 0x14]
mov byte [eax + 0xc], dl
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
xor edx, edx
mov dword [eax + 0xe], edx
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x13
mov edx, 0x4dee14
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x17
mov edx, 0x4dee24
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x1b
mov edx, 0x4dee40
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x1f
mov edx, 0x4dedfc
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x23
push eax
lea edx, [ebp - 0x2b8]
mov eax, dword [ebp - 0x10]
call fcn.00409c60
mov edx, dword [ebp - 0x2b8]
pop eax
call fcn.00404a74
push dword [ebp - 4]
push 0x4dedf0
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x2f
mov edx, 3
call fcn.00404da0
push dword [ebp - 4]
push 0x4dedf0
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404da0
mov eax, dword [ebp - 0x18]
call fcn.004099b4
test al, al
je 0x4deb10
xor eax, eax
push ebp
push 0x4deaf2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x2ac]
call fcn.00402f40
mov edx, 1
lea eax, [ebp - 0x2ac]
call fcn.004035ec
call fcn.00402944
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x4b
push eax
lea eax, [ebp - 0x2ac]
call fcn.0040328c
call fcn.00402944
pop edx
mov dword [edx], eax
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
mov eax, dword [eax + 0x4b]
mov edx, dword [0x581294]
add dword [edx], eax
lea eax, [ebp - 0x2ac]
call fcn.004030b0
call fcn.00402944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4deb10
inc dword [ebp - 0x20]
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004d4158
cmp dword [ebp + 8], 1
jne 0x4ded27
push dword [ebp - 4]
push 0x4dedf0
push dword [ebp - 0x10]
lea eax, [ebp - 0x2bc]
mov edx, 3
call fcn.00404da0
mov edx, dword [ebp - 0x2bc]
mov ecx, dword [0x5812e0]
mov ecx, dword [ecx]
mov eax, 0x4dee60
call fcn.004d4684
test al, al
jne 0x4ded27
mov eax, dword [ebp + 0xc]
call fcn.004d0190
mov ebx, eax
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
mov byte [eax + 0x12], 1
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
mov edx, dword [0x580bb0]
mov dl, byte [edx + 0x14]
mov byte [eax + 0xc], dl
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
xor edx, edx
mov dword [eax + 0xe], edx
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x13
mov edx, 0x4dee14
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x17
mov edx, 0x4dee24
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x1b
mov edx, 0x4dee78
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x1f
mov edx, 0x4dee60
call fcn.00404a74
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x23
push eax
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 0x10]
call fcn.00409c60
mov edx, dword [ebp - 0x2c0]
pop eax
call fcn.00404a74
push dword [ebp - 4]
push 0x4dedf0
push dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x2f
mov edx, 3
call fcn.00404da0
push dword [ebp - 4]
push 0x4dedf0
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404da0
mov eax, dword [ebp - 0x18]
call fcn.004099b4
test al, al
je 0x4ded13
xor eax, eax
push ebp
push 0x4decf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x2ac]
call fcn.00402f40
mov edx, 1
lea eax, [ebp - 0x2ac]
call fcn.004035ec
call fcn.00402944
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
add eax, 0x4b
push eax
lea eax, [ebp - 0x2ac]
call fcn.0040328c
call fcn.00402944
pop edx
mov dword [edx], eax
mov edx, ebx
mov eax, dword [ebp + 0xc]
call fcn.004d01a4
mov eax, dword [eax + 0x4b]
mov edx, dword [0x581294]
add dword [edx], eax
lea eax, [ebp - 0x2ac]
call fcn.004030b0
call fcn.00402944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ded13
inc dword [ebp - 0x20]
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004d4158
lea eax, [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4de831
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ded88
lea eax, [ebp - 0x2c0]
mov edx, 5
call fcn.00404a44
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404a44
lea eax, [ebp - 4]
call fcn.00404a20
ret