Function at 0x556040
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x108
mov edx, dword [0x69fa6c]
push ebp
mov ebp, dword [esp + 0x110]
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor al, al
test dx, dx
mov dword [esp + 8], edx
mov byte [esp + 0xf], al
jl 0x5562d7
push ebx
push esi
nop
movsx esi, dx
mov eax, dword [esi*4 + 0x69fb70]
cmp eax, 0xffffffff
jne 0x5561f4
mov cx, word [0x69fa6e]
lea edx, [esp + 0x18]
mov eax, 0x69fa70
call fcn.00556500
lea eax, [esp + 0x18]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5560b0
sub eax, edx
lea ecx, [esp + eax + 0x18]
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x5560cc
mov byte [ecx], 0x5c
inc ecx
mov byte [ecx], 0
lea eax, [esp + 0x18]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5560d3
sub eax, edi
mov edx, 0xff
sub edx, eax
push edx
push 0x671fc4
push ecx
call fcn.00623ce0
add esp, 0xc
push 0x69fbb0
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x11f], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esi*4 + 0x69fb70], eax
je 0x556221
test byte [0x69fbb0], 0x10
je 0x556231
mov edi, 0x660158
mov esi, 0x69fbdc
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x55623a
mov edi, 0x671fc0
mov esi, 0x69fbdc
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x55623a
mov al, byte [0x69fa68]
test al, 2
je 0x55619b
mov dx, word [0x69fa6e]
xor eax, eax
mov ecx, 0x43
mov edi, ebp
rep stosd dword es:[edi], eax
lea esi, [ebp + 8]
mov ebx, 0x69fa70
mov dword [ebp], 0x66696c6f
mov word [ebp + 6], dx
call fcn.005562f0
mov ebx, 0x69fbdc
call fcn.005562f0
mov al, byte [0x69fa68]
test al, 1
je 0x5561bb
test al, 2
jne 0x5561b7
mov ebx, 0x69fbdc
mov esi, 0x69fa70
call fcn.005562f0
mov al, byte [0x69fa68]
inc dword [esp + 0x10]
test al, 2
je 0x55623a
mov eax, dword [esp + 0x120]
test eax, eax
je 0x5561db
mov ecx, dword [0x69fbc4]
mov dword [eax], ecx
mov edx, dword [0x69fbc8]
mov dword [eax + 4], edx
mov cx, word [esp + 0x10]
pop esi
pop ebx
pop edi
mov al, 1
mov word [0x69fa6c], cx
pop ebp
add esp, 0x108
ret
push 0x69fbb0
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x55611a
mov ecx, dword [esi*4 + 0x69fb70]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esi*4 + 0x69fb70], 0xffffffff
mov ebx, 0x69fa70
call fcn.005563b0
dec dword [esp + 0x10]
jmp 0x55623a
test byte [0x69fa68], 2
je 0x55625d
mov edx, dword [esp + 0x10]
test dx, dx
jge 0x556080
mov al, byte [esp + 0x17]
pop esi
pop ebx
pop edi
mov word [0x69fa6c], dx
pop ebp
add esp, 0x108
ret
mov dx, word [0x69fa6e]
xor eax, eax
mov ecx, 0x43
mov edi, ebp
rep stosd dword es:[edi], eax
lea esi, [ebp + 8]
mov ebx, 0x69fa70
mov dword [ebp], 0x66696c6f
mov word [ebp + 6], dx
call fcn.005562f0
test byte [ebp + 4], 1
je 0x556294
mov ebx, esi
call fcn.005563b0
mov ebx, 0x69fbdc
call fcn.005562f0
mov eax, dword [esp + 0x120]
or byte [ebp + 4], 1
test eax, eax
je 0x5562be
mov edx, dword [0x69fbc4]
mov dword [eax], edx
mov ecx, dword [0x69fbc8]
mov dword [eax + 4], ecx
mov dx, word [esp + 0x10]
pop esi
pop ebx
pop edi
mov al, 1
mov word [0x69fa6c], dx
pop ebp
add esp, 0x108
ret
pop edi
mov word [0x69fa6c], dx
pop ebp
add esp, 0x108
ret