Function at 0x497290
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a44f8
mov eax, dword fs:[0]
push eax
mov eax, 0x1060
call fcn.0048aab0
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x824]
call fcn.0049a5c0
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x103c]
call fcn.0049a5c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x102c]
call fcn.0049c860
mov byte [ebp - 4], 2
mov byte [ebp - 0xd], 1
push 0x4f6358
mov edx, dword [ebp + 0xc]
push edx
call fcn.00474132
add esp, 8
test eax, eax
je 0x497366
mov byte [ebp - 0x1041], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x102c]
call fcn.0049c800
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x103c]
call fcn.00499a80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x824]
call fcn.00499a80
mov al, byte [ebp - 0x1041]
jmp 0x49764f
movzx eax, word [0x4f635e]
and eax, 0x4000
je 0x4975df
lea ecx, [ebp - 0x103c]
call fcn.00499970
movzx ecx, al
test ecx, ecx
jne 0x4973e7
push 0
lea edx, [ebp - 0x102c]
push edx
lea ecx, [ebp - 0x103c]
call fcn.0049a900
movzx eax, al
test eax, eax
jne 0x4973e7
mov byte [ebp - 0x1042], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x102c]
call fcn.0049c800
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x103c]
call fcn.00499a80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x824]
call fcn.00499a80
mov al, byte [ebp - 0x1042]
jmp 0x49764f
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4d5b30
lea edx, [ebp - 0x1024]
call fcn.0040b1c0
add esp, 8
push 0x4f6108
lea edx, [ebp - 0x1024]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0xffffffff
je 0x4975dd
mov dword [ebp - 0x1048], 0x4d5b40
mov dword [ebp - 0x104c], 0x4f6134
mov eax, dword [ebp - 0x104c]
mov cx, word [eax]
mov word [ebp - 0x104e], cx
mov edx, dword [ebp - 0x1048]
cmp cx, word [edx]
jne 0x49749d
cmp word [ebp - 0x104e], 0
je 0x497491
mov eax, dword [ebp - 0x104c]
mov cx, word [eax + 2]
mov word [ebp - 0x1050], cx
mov edx, dword [ebp - 0x1048]
cmp cx, word [edx + 2]
jne 0x49749d
add dword [ebp - 0x104c], 4
add dword [ebp - 0x1048], 4
cmp word [ebp - 0x1050], 0
jne 0x497437
mov dword [ebp - 0x1054], 0
jmp 0x4974a8
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x1054], eax
mov ecx, dword [ebp - 0x1054]
mov dword [ebp - 0x1058], ecx
cmp dword [ebp - 0x1058], 0
je 0x49755b
mov dword [ebp - 0x105c], 0x4d5b44
mov dword [ebp - 0x1060], 0x4f6134
mov edx, dword [ebp - 0x1060]
mov ax, word [edx]
mov word [ebp - 0x1062], ax
mov ecx, dword [ebp - 0x105c]
cmp ax, word [ecx]
jne 0x49753b
cmp word [ebp - 0x1062], 0
je 0x49752f
mov edx, dword [ebp - 0x1060]
mov ax, word [edx + 2]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0x105c]
cmp ax, word [ecx + 2]
jne 0x49753b
add dword [ebp - 0x1060], 4
add dword [ebp - 0x105c], 4
cmp word [ebp - 0x1064], 0
jne 0x4974d5
mov dword [ebp - 0x1068], 0
jmp 0x497546
sbb edx, edx
sbb edx, 0xffffffff
mov dword [ebp - 0x1068], edx
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x106c], eax
cmp dword [ebp - 0x106c], 0
jne 0x49755d
jmp 0x4975b6
push 0x4f6134
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4d5b4c
lea edx, [ebp - 0x1024]
call fcn.0040b1c0
add esp, 0xc
push 0x4f6134
mov edx, dword [ebp + 8]
push edx
push 0x4d5b58
lea edx, [ebp - 0x814]
call fcn.0040b1c0
add esp, 0xc
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x814]
push ecx
call fcn.00497290
add esp, 8
movzx edx, al
test edx, edx
jne 0x4975b6
mov byte [ebp - 0xd], 0
push 0x4f6108
mov eax, dword [ebp - 0x1040]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x497423
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x497610
push 0
lea edx, [ebp - 0x103c]
push edx
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x824]
call fcn.0049aea0
movzx ecx, al
test ecx, ecx
jne 0x497610
lea ecx, [ebp - 0x102c]
call fcn.0049cbe0
mov byte [ebp - 0xd], 0
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x1043], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x102c]
call fcn.0049c800
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x103c]
call fcn.00499a80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x824]
call fcn.00499a80
mov al, byte [ebp - 0x1043]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret