Function at 0x4e24ba
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8a8
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x878], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
or dword [eax], 0xffffffff
mov dword [ebp - 0x8a8], edx
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x894], edx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x890], edx
xor edx, edx
mov dword [esi], edx
push edi
mov dword [eax], edx
xor edi, edi
mov eax, dword [ebp - 0x890]
push 0x5c
push ecx
mov dword [ebp - 0x8a4], ebx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x898], esi
mov dword [ebp - 0x8a0], edi
mov dword [ebp - 0x87c], edi
mov dword [ebp - 0x880], edi
mov dword [ebp - 0x888], edi
mov dword [ebp - 0x88c], edi
mov dword [ebp - 0x884], edi
mov word [ebp - 0x624], ax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4e25bd
lea ecx, [eax + 2]
lea edx, [ebp - 0x88c]
call fcn.004cb395
mov esi, eax
test esi, esi
je 0x4e258c
push esi
push 0x5030197
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ebx, dword [ebp - 0x878]
jmp 0x4e295f
mov ecx, dword [ebp - 0x88c]
lea edx, [ebp - 0x884]
call fcn.004cb226
mov esi, eax
test esi, esi
je 0x4e25b7
push esi
push 0x5060197
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [ebp - 0x884]
jmp 0x4e2581
mov edi, dword [ebp - 0x884]
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4e25c4
sub ecx, edx
mov esi, 0x208
sar ecx, 1
lea eax, [ecx + 4]
cmp eax, esi
jb 0x4e25f5
mov eax, 0x8007006f
push eax
push 0x50c0197
mov esi, eax
push ebx
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4e2581
push ebx
mov edx, esi
lea ecx, [ebp - 0x624]
call fcn.0043eb7d
push 0x42f9d0
mov edx, esi
lea ecx, [ebp - 0x624]
call fcn.0043eadb
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x878], ebx
cmp ebx, 0xffffffff
jne 0x4e2646
mov esi, 0x80070002
push esi
push 0x5150197
jmp 0x4e2959
mov esi, 0x8007010b
test byte [ebp - 0x874], 0x10
jne 0x4e2851
lea ecx, [ebp - 0x848]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8a0]
jne 0x4e2661
sub ecx, edx
mov edx, 0x104
sar ecx, 1
cmp ecx, edx
jae 0x4e28dd
push ecx
lea eax, [ebp - 0x848]
push eax
push ecx
lea ecx, [ebp - 0x214]
call fcn.0043eb27
lea eax, [ebp - 0x214]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x4e28d5
xor ecx, ecx
lea ebx, [eax + 2]
push 1
mov word [eax], cx
mov edx, 0x42fa0e
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004ca39c
test eax, eax
jne 0x4e2784
push 3
lea eax, [ebp - 0x214]
push 0x42fa18
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4e2888
mov ax, word [ebp - 0x20e]
lea ebx, [ebp - 0x20e]
xor ecx, ecx
cmp cx, ax
je 0x4e2723
movzx ecx, ax
push ecx
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x4e2880
add ebx, 2
xor edx, edx
movzx eax, word [ebx]
mov ecx, eax
cmp dx, ax
jne 0x4e2704
push 0x10
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, dword [ebp - 0x898]
add esp, 0xc
cmp eax, dword [ecx]
jbe 0x4e2744
mov dword [ecx], eax
mov ecx, dword [ebp - 0x89c]
cmp eax, dword [ecx]
jae 0x4e2750
mov dword [ecx], eax
mov ecx, dword [ebp - 0x854]
mov eax, dword [ebp - 0x858]
add ecx, 0xffff
push ebx
push 0x10000
adc eax, ebx
push eax
push ecx
call fcn.005049b0
mov ecx, dword [ebp - 0x890]
add dword [ecx], eax
inc dword [ebp - 0x888]
jmp 0x4e284b
push 1
push 0xffffffffffffffff
mov edx, 0x41f7ba
mov ecx, ebx
call fcn.004ca39c
test eax, eax
jne 0x4e2800
cmp dword [ebp - 0x87c], eax
jne 0x4e28af
test edi, edi
je 0x4e27c8
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x214]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
jne 0x4e289a
mov ecx, dword [ebp - 0x854]
mov eax, dword [ebp - 0x858]
add ecx, 0xffff
push 0
pop edx
push edx
push 0x10000
adc eax, edx
push eax
push ecx
call fcn.005049b0
mov ecx, dword [ebp - 0x894]
mov dword [ebp - 0x87c], 1
add dword [ecx], eax
jmp 0x4e284b
push 1
push 0xffffffffffffffff
mov edx, 0x42fa22
mov ecx, ebx
call fcn.004ca39c
test eax, eax
jne 0x4e28cd
cmp dword [ebp - 0x880], eax
jne 0x4e28c2
push 0xffffffffffffffff
push 0x42f9f0
push 0xffffffffffffffff
lea eax, [ebp - 0x848]
xor ebx, ebx
push eax
inc ebx
push ebx
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, ebx
jne 0x4e28ba
mov dword [ebp - 0x880], ebx
mov ebx, dword [ebp - 0x878]
lea eax, [ebp - 0x874]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e264b
mov edx, dword [ebp - 0x888]
test edx, edx
jne 0x4e28f8
push esi
push 0x5740197
jmp 0x4e2959
push esi
push 0x53c0197
jmp 0x4e288e
push esi
push 0x5360197
lea eax, [ebp - 0x848]
push eax
jmp 0x4e25ed
push esi
push 0x5570197
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
push esi
push 0x5580197
jmp 0x4e288e
push esi
push 0x5520197
jmp 0x4e257b
push esi
push 0x5660197
jmp 0x4e288e
push esi
push 0x5620197
jmp 0x4e257b
push esi
push 0x56c0197
jmp 0x4e288e
push esi
push 0x52d0197
jmp 0x4e2959
mov eax, 0x8007006f
push eax
push 0x5260197
push dword [ebp - 0x8a4]
mov esi, eax
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4e295f
test dword [ebp - 0x8a8], 1
jne 0x4e291e
cmp dword [ebp - 0x87c], 0
je 0x4e2916
cmp dword [ebp - 0x880], 0
jne 0x4e2930
push esi
push 0x57a0197
jmp 0x4e2959
cmp dword [ebp - 0x87c], 0
jne 0x4e2953
cmp dword [ebp - 0x880], 0
jne 0x4e2953
mov eax, dword [ebp - 0x898]
mov ecx, dword [ebp - 0x89c]
mov eax, dword [eax]
sub eax, dword [ecx]
inc eax
cmp eax, edx
je 0x4e294d
push esi
push 0x5870197
jmp 0x4e2959
xor eax, eax
mov esi, eax
jmp 0x4e295f
push esi
push 0x5810197
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x88c]
test eax, eax
je 0x4e2970
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x4e297b
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebx, 0xffffffff
je 0x4e2987
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0x14