Function at 0x47b9b9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x5c], 0
je 0x47bd9f
mov ecx, dword [esi + 4]
xor ebx, ebx
cmp ecx, ebx
je 0x47ba03
call fcn.0047b9b9
cmp eax, ebx
jne 0x47bda1
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x47ba00
mov ecx, edi
call fcn.0047b879
push edi
call fcn.0049de76
pop ecx
mov dword [esi + 4], ebx
mov eax, dword [esi]
sub eax, ebx
je 0x47bd06
dec eax
je 0x47bcbe
dec eax
je 0x47bc81
dec eax
je 0x47bb42
dec eax
jne 0x47bd9f
mov eax, dword [esi + 0x5c]
push eax
push dword [eax + 0x140]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov eax, dword [esi + 0x5c]
jne 0x47ba5b
push dword [eax + 0x140]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi + 0x5c]
or dword [eax + 0x140], 0xffffffff
jmp 0x47bb89
test byte [eax], 0x10
je 0x47b9d5
add eax, 0x2c
push 0x4df8cc
push eax
call fcn.004862b0
pop ecx
test eax, eax
pop ecx
je 0x47b9d5
mov eax, dword [esi + 0x5c]
push 0x4dd424
add eax, 0x2c
push eax
call fcn.004862b0
pop ecx
test eax, eax
pop ecx
je 0x47b9d5
push 0x6c
call fcn.0049de4d
mov edi, eax
pop ecx
cmp edi, ebx
je 0x47bb03
push dword [esi + 0x64]
or dword [ebp - 4], 8
or dword [ebp - 4], 0x10
lea ecx, [esi + 0x28]
or dword [ebp - 4], 0x20
push 1
push 0x4e7e70
call fcn.00479ef8
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
push 0x4dd1e4
push eax
mov eax, dword [esi + 0x5c]
lea ecx, [esi + 0x38]
add eax, 0x2c
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479ef8
push eax
mov ecx, edi
call fcn.0047b7e5
jmp 0x47bb05
xor eax, eax
test byte [ebp - 4], 0x20
mov dword [esi + 4], eax
je 0x47bb1a
and dword [ebp - 4], 0xffffffdf
lea ecx, [ebp - 0x24]
call fcn.00479e4b
test byte [ebp - 4], 0x10
je 0x47bb2c
and dword [ebp - 4], 0xffffffef
lea ecx, [ebp - 0x64]
call fcn.00479e4b
test byte [ebp - 4], 8
je 0x47b9d5
and dword [ebp - 4], 0xfffffff7
lea ecx, [ebp - 0x44]
jmp 0x47bc77
push dword [esi + 0x5c]
lea edi, [esi + 0x38]
lea eax, [ebp - 0x84]
mov ecx, edi
push 0x4dd1e0
push eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479ef8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esi + 0x5c]
mov dword [ecx + 0x140], eax
lea ecx, [ebp - 0x84]
call fcn.00479e4b
mov eax, dword [esi + 0x5c]
cmp dword [eax + 0x140], 0xffffffff
jne 0x47bb90
mov dword [esi], ebx
jmp 0x47b9d5
mov dword [esi], 4
test byte [eax], 0x10
je 0x47b9d5
add eax, 0x2c
push 0x4df8cc
push eax
call fcn.004862b0
pop ecx
test eax, eax
pop ecx
je 0x47b9d5
mov eax, dword [esi + 0x5c]
push 0x4dd424
add eax, 0x2c
push eax
call fcn.004862b0
pop ecx
test eax, eax
pop ecx
je 0x47b9d5
push 0x6c
call fcn.0049de4d
mov ebx, eax
pop ecx
test ebx, ebx
je 0x47bc3d
push dword [esi + 0x64]
or dword [ebp - 4], 1
or dword [ebp - 4], 2
lea ecx, [esi + 0x28]
or dword [ebp - 4], 4
push 1
push 0x4e7e70
call fcn.00479ef8
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push 0x4dd1e4
push eax
mov eax, dword [esi + 0x5c]
mov ecx, edi
add eax, 0x2c
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479cd7
mov ecx, eax
call fcn.00479ef8
push eax
mov ecx, ebx
call fcn.0047b7e5
jmp 0x47bc3f
xor eax, eax
test byte [ebp - 4], 4
mov dword [esi + 4], eax
je 0x47bc54
and dword [ebp - 4], 0xfffffffb
lea ecx, [ebp - 0x14]
call fcn.00479e4b
test byte [ebp - 4], 2
je 0x47bc66
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x34]
call fcn.00479e4b
test byte [ebp - 4], 1
je 0x47b9d5
and dword [ebp - 4], 0xfffffffe
lea ecx, [ebp - 0x54]
call fcn.00479e4b
jmp 0x47b9d5
mov eax, dword [esi + 0x5c]
push eax
push dword [eax + 0x140]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov eax, dword [esi + 0x5c]
jne 0x47bcb0
push dword [eax + 0x140]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi + 0x5c]
or dword [eax + 0x140], 0xffffffff
jmp 0x47bce5
test byte [eax], 0x10
je 0x47bd47
jmp 0x47b9d5
push dword [esi + 0x5c]
lea ecx, [esi + 0x18]
call fcn.00479ef8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esi + 0x5c]
mov dword [ecx + 0x140], eax
mov eax, dword [esi + 0x5c]
cmp dword [eax + 0x140], 0xffffffff
jne 0x47bcf6
mov eax, dword [esi + 0x58]
neg eax
sbb eax, eax
and eax, 3
mov dword [esi], eax
jmp 0x47b9d5
mov dword [esi], 2
test byte [eax], 0x10
je 0x47bd6a
jmp 0x47b9d5
mov ecx, esi
call fcn.0047b8ca
test eax, eax
je 0x47bd9f
lea edi, [esi + 0x18]
lea ebx, [esi + 0x38]
push edi
mov ecx, ebx
call fcn.00479e3d
mov ecx, ebx
call fcn.00479f11
lea ebx, [esi + 0x28]
push edi
mov ecx, ebx
call fcn.00479e3d
mov ecx, ebx
call fcn.00479f55
mov dword [esi], 1
jmp 0x47b9d5
mov eax, dword [esi + 0x5c]
lea ecx, [esi + 0x38]
add eax, 0x2c
lea edi, [esi + 0x48]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00479cd7
push eax
mov ecx, edi
call fcn.00479e3d
lea ecx, [ebp - 0x74]
jmp 0x47bd91
mov eax, dword [esi + 0x5c]
lea ecx, [esi + 0x38]
add eax, 0x2c
lea edi, [esi + 0x48]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00479cd7
push eax
mov ecx, edi
call fcn.00479e3d
lea ecx, [ebp - 0x94]
call fcn.00479e4b
mov ecx, edi
call fcn.00479ef8
jmp 0x47bda1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret