Function at 0x4b3b5e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
push ebx
push esi
push edi
mov esi, 0x57f8f2
mov dword [ebp - 0xc], 0xffffffff
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.004b3aa6
push 0x579058
push str._s.log
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
push 0xb
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0
push 0x184
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [0x556164], 0
je 0x4b3bde
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4b3bfa
push 0x37
lea edx, [ebp - 0x120]
push edx
push esi
call fcn.0053cd24
add esp, 0xc
mov edi, eax
jmp 0x4b3c19
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b3c17
mov edi, 1
jmp 0x4b3c19
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4b3d4f
cmp dword [ebp - 8], 0
jne 0x4b3c76
test byte [ebp - 0x118], 0x10
je 0x4b3c46
lea edx, [ebp - 0x120]
push edx
call fcn.0053cde4
pop ecx
mov edi, eax
jmp 0x4b3d4f
push esi
push edi
lea edi, [ebp - 0x110]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
call fcn.00541e38
pop ecx
jmp 0x4b3cc7
test byte [ebp - 0x284], 0x10
je 0x4b3ca0
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4b3d4f
mov edi, 1
jmp 0x4b3d4f
push esi
push edi
lea edi, [ebp - 0x258]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
push 0x579058
push 0x555b5b
push 0x569f83
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp dword [0x555978], 6
jne 0x4b3cfe
lea eax, [ebp - 0x144]
push eax
push 0x569f83
call fcn.0054051c
add esp, 8
jmp 0x4b3d06
xor edx, edx
mov dword [ebp - 0x12a], edx
push dword [ebp - 0x12a]
push 0
push esi
push dword [ebp - 4]
call fcn.004b0c4c
mov ebx, eax
test ebx, ebx
je 0x4b3d20
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], 0
jne 0x4b3d37
lea eax, [ebp - 0x120]
push eax
call fcn.0053cde4
pop ecx
mov edi, eax
jmp 0x4b3d4f
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4b3d4f
mov edi, 1
test edi, edi
je 0x4b3c23
cmp dword [ebp - 0xc], 0xffffffff
je 0x4b3d65
push dword [ebp - 0xc]
call sub.KERNEL32.dll_FindClose
push 5
push dword [ebp - 4]
call fcn.004fd5fa
mov dword [ebp - 4], eax
push esi
push 0x3e7
push 0xd
push 0x66
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4b3de8
mov edi, 1
cmp byte [esi], 0
je 0x4b3dc7
push 0x555b61
push esi
call fcn.00539874
add esp, 8
test eax, eax
je 0x4b3db9
push 0
push dword [ebx]
push esi
call fcn.00513930
test eax, eax
jne 0x4b3dc7
xor edi, edi
jmp 0x4b3dc7
push esi
push dword [ebx]
call fcn.0041d5ea
test eax, eax
jne 0x4b3dc7
xor edi, edi
test edi, edi
je 0x4b3de1
push dword [ebx]
push 0
push 0x180
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x4b3de8
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x4b3d8b
push dword [ebp - 4]
call fcn.004b12ac
push 1
push 0x555b65
push 0x67
push dword [ebp + 8]
call fcn.00515b46
push 0
push 1
push 0x185
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 1
push 0xb
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push 0x67
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0x10]
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4