Function at 0x48a850
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x6dc
mov eax, dword [0xa0b130]
xor eax, esp
mov dword [esp + 0x6d8], eax
mov eax, dword [esp + 0x6f0]
push ebx
mov ebx, dword [esp + 0x6e4]
push ebp
push esi
mov esi, dword [esp + 0x6f8]
push edi
mov dword [esp + 0x18], eax
call fcn.0040ab32
push 0
mov ebp, eax
lea ecx, [esp + 0x6f8]
sub esp, 8
mov dword [esp + 0x1c], ebp
mov eax, esp
mov dword [eax], 0x9271fc
mov dword [eax + 4], 2
call fcn.00409340
mov edi, dword [esp + 0x6f4]
cmp eax, 0xffffffff
je 0x48ac17
mov ebp, dword [esp + 0x6f8]
cmp ebp, 2
jne 0x48a8f6
push ebp
push 0x927200
push edi
call fcn.004031ed
add esp, 0xc
test eax, eax
je 0x48ac13
push ebp
push 0x927204
push edi
call fcn.004031ed
add esp, 0xc
test eax, eax
je 0x48ac13
lea eax, [esp + 0x290]
mov dword [esp + 0x288], 0
mov dword [esp + 0x284], eax
lea eax, [esp + 0x284]
push eax
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x294], 0x104
push edi
push eax
call fcn.00412350
add esp, 0x10
mov edi, dword [eax]
mov ebp, dword [eax + 4]
test edi, edi
je 0x48a964
mov eax, dword [esp + 0x284]
lea ecx, [esp + 0x290]
mov dword [ebx], edi
mov dword [ebx + 4], ebp
cmp eax, ecx
je 0x48ac42
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x48ac42
lea eax, [esp + 0x498]
push eax
push dword [esp + 0x288]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x48a9c3
mov eax, dword [esp + 0x6f4]
mov ecx, esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
call fcn.00415eb0
mov ecx, dword [esp + 0x284]
lea eax, [esp + 0x290]
mov dword [ebx], edi
mov dword [ebx + 4], ebp
cmp ecx, eax
je 0x48ac42
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x48ac42
mov ebp, dword [esp + 0x6f4]
lea ecx, [esp + 0x70]
mov edx, dword [esp + 0x6f8]
xor eax, eax
add edx, ebp
mov dword [esp + 0x64], ecx
mov edi, edx
mov dword [esp + 0x14], edx
sub edi, ebp
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x104
cmp edi, 0x104
jbe 0x48aa14
push 1
mov eax, ecx
lea ecx, [esp + 0x68]
push edi
push eax
call fcn.00405e1b
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x14]
cmp ebp, edx
je 0x48aa29
push edi
add eax, ecx
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x74]
add esp, 0xc
add eax, edi
mov dword [esp + 0x68], eax
lea eax, [esp + 0x64]
push 2
push eax
call fcn.00405100
mov edi, dword [esp + 0x70]
add esp, 8
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea eax, [esp + 0x180]
mov dword [esp + 0x178], 0
mov dword [esp + 0x174], eax
lea eax, [esp + 0x4c4]
mov dword [esp + 0x17c], 0x104
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48aa76
sub eax, edx
lea ecx, [esp + 0x174]
sar eax, 1
push ecx
push eax
lea eax, [esp + 0x4cc]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.004020e5
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
test ecx, ecx
jne 0x48abb8
lea eax, [esp + 0x174]
mov word [esp + 0x38], 0x101
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x40]
mov word [esp + 0x48], 0x101
push eax
lea eax, [esp + 0x50]
mov word [esp + 0x58], 0x101
push eax
lea eax, [esp + 0x30]
mov word [esp + 0x38], 0x106
push eax
lea eax, [esp + 0x74]
push eax
call fcn.004153a7
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x70]
add esp, 0x14
push dword [esp + 0x68]
push dword [esp + 0x68]
push eax
call fcn.004037ec
mov ecx, dword [esi + 4]
mov ebp, dword [eax]
cmp ecx, dword [esi + 8]
jb 0x48ab32
push 4
push 0
lea eax, [esi + 0xc]
mov ecx, esi
push eax
call fcn.00405e1b
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [eax + ecx*4], ebp
inc dword [esi + 4]
mov edx, dword [esp + 0x68]
cmp edi, edx
jb 0x48ab7a
jbe 0x48ab7e
cmp dword [esp + 0x6c], edi
jae 0x48ab5f
push 1
push edi
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x70]
call fcn.00405e1b
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
lea ecx, [eax + edi]
add eax, edx
cmp eax, ecx
je 0x48ab7a
sub ecx, eax
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x68], edi
mov eax, dword [esp + 0x174]
lea ecx, [esp + 0x180]
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp eax, ecx
je 0x48ab9c
push eax
call ebp
add esp, 4
lea eax, [esp + 0x498]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x48aa48
jmp 0x48abd0
mov eax, dword [esp + 0x174]
lea ecx, [esp + 0x180]
cmp eax, ecx
je 0x48abd0
push eax
call ebp
add esp, 4
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x70]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x64]
cmp eax, ecx
je 0x48abf9
push eax
call ebp
add esp, 4
mov eax, dword [esp + 0x284]
lea ecx, [esp + 0x290]
cmp eax, ecx
je 0x48ac42
push eax
call ebp
add esp, 4
jmp 0x48ac42
mov ebp, dword [esp + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
jb 0x48ac31
push 4
push 0
lea eax, [esi + 0xc]
mov ecx, esi
push eax
call fcn.00405e1b
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [eax + ecx*4], edi
inc dword [esi + 4]
mov dword [ebx], 0
mov dword [ebx + 4], ebp
mov ecx, dword [esp + 0x6e8]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004087b5
add esp, 0x6dc
ret