Function at 0x472f00
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2a4
mov eax, 0x6fc6fc
call fcn.00458b7c
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.00422530
mov esi, 0x714abc
mov byte [ebp - 4], 1
push esi
call fcn.004f2ba9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00422710
call fcn.0046033e
test al, al
je 0x472f5c
popal
mov word [edx - 0x7569d086], ds
insb byte es:[edi], dx
fsubr qword [ebx - 0x3b]
cmp dh, cl
iretd
call fcn.0045ff33
test al, al
je 0x472f7d
inc esi
dec esp
out dx, eax
adc al, 0xe4
inc esp
pop ss
sahf
inc edi
mov dword [0xfb830945], eax
lodsd eax, dword [esi]
mov bh, 0xf
cdq
adc dword [edx - 0x7b], ecx
xor eax, 0xbc7d83c9
or byte [ebp - 0x2a773], cl
dec dword [ebp + 0x430fa845]
inc ebp
test al, 0x51
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x2ac], ebx
cmp ebx, 0xffffffff
je 0x473119
push 0x2e
pop esi
lea eax, [ebp - 0x2a8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x473119
cmp word [ebp - 0x27c], si
je 0x472faa
cmp word [ebp - 0x27a], 0
je 0x472faa
cmp word [ebp - 0x27a], si
jne 0x472fe6
cmp word [ebp - 0x278], 0
je 0x472faa
call fcn.0046040d
test al, al
je 0x47300e
sbb bh, byte [edi - 0x38]
jg 0x472f90
mov cl, byte [esi + 0x5a]
dec esp
invalid
call fcn.0046026f
test al, al
je 0x473037
dec edx
scasd eax, dword es:[edi]
int 0xe9
clc
movsd dword es:[edi], dword [esi]
or esi, dword [ebx]
adc eax, dword [edx]
xor dword [ebx + 0x7e], ebx
sbb ebx, eax
lcall 0x7c44, 0x14a1363f
popfd
imul ebx, dword [esi], 0xffffffaf
or bh, byte [0x33affdec]
rol bh, 0x45
aam 7
add byte [eax], al
add byte [ebx], dh
invalid
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x47305f
lea eax, [ebp - 0x27c]
push eax
call fcn.004f2ba9
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00420aa0
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x4730c6
call fcn.00422530
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00422840
mov edi, 0x794470
push edi
call fcn.004f2ba9
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00422710
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00422530
call fcn.00472ca9
jmp 0x4730f1
call fcn.00422530
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00422840
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00422530
call fcn.00473180
add esp, 0x18
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.004209e0
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004209e0
mov ebx, dword [ebp - 0x2ac]
jmp 0x472fa7
call fcn.0045ff78
test al, al
je 0x473140
push ecx
cwde
invalid
call fcn.0046022a
test al, al
je 0x47315b
inc eax
insb byte es:[edi], dx
dec ecx
out dx, al
out 0xb4, al
invalid
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004209e0
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004209e0
call fcn.00458b37
ret