Function at 0x490a00
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f1274
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2f0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c0], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x2e0], eax
test eax, eax
je 0x490a5d
mov ecx, eax
call fcn.005dc400
push ecx
mov ecx, esi
call fcn.0043e540
mov dword [ebp - 0x2c8], eax
test eax, eax
je 0x490a7a
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x490a84
xor eax, eax
mov dword [ebp - 0x2c8], eax
jmp 0x490a8a
mov eax, dword [ebp - 0x2c8]
push ecx
push eax
push 0xffffffffffffffff
push SysReAllocString
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c2
push 0x226
push str.Add_Edit_a_note
lea edi, [esi + 0x1cf8]
push str._AddNoteDlgBox_
mov ecx, edi
call fcn.005c5d10
mov ecx, eax
lea eax, [esi + 0x14a8]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2cc], ecx
test eax, eax
je 0x490af0
push 0
mov edx, eax
call fcn.005d3010
push dword [ebp - 0x2cc]
mov ecx, dword [esi + 0x14e4]
call fcn.005c6150
push 4
push 0xc
push 0xfffefefe
push 0xfffefefe
push 0xff000000
push 0x1c2
push 0x226
mov ecx, edi
call fcn.005b9530
movsd xmm1, qword [0x6edb20]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0x1000
mov ecx, edi
call fcn.005c4340
push 0xffffffffffffffff
push 0x10000300
push 0x23
push 0x208
push 5
push 5
push str.__Add__edit_and_delete_notes
call fcn.005c0890
push 0
mov ecx, edi
call fcn.005c4340
push 0xff080808
push 0x14
push 0x14
push 5
push 0x20d
call fcn.005c1810
movsd xmm1, qword [0x6edaf8]
mov ecx, edi
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x2f4], eax
call fcn.005c42b0
push 0xffffffffffffffff
push 0x1080000d
push 0x177
push 0x104
push 0x28
push 0xa
push 0
push str.Notes_in_this_computer
mov ecx, edi
call fcn.005c0620
push edi
push str.Double_click_a_note_to_start_editing_it
push eax
mov ecx, esi
mov dword [ebp - 0x2c4], eax
call fcn.0045b370
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esi + 0x150]
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x2c8], eax
mov ecx, eax
push str.Notes.
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0x260
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x2b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, eax
mov dword [ebp - 0x68], edx
cmp edx, 0xffffffff
je 0x490cf5
mov ecx, 3
mov dword [ebp - 0x64], ecx
cmp word [ebp - 0x28c], 0x2e
jne 0x490ca6
mov ax, word [ebp - 0x28a]
test ax, ax
je 0x490cd0
cmp ax, 0x2e
jne 0x490ca6
cmp word [ebp - 0x288], 0
je 0x490cd0
test ecx, ecx
je 0x490cf5
mov eax, dword [ebp - 0x2b8]
test cl, 1
je 0x490cbc
test eax, 0x400
jne 0x490cd0
test cl, 2
je 0x490cc7
test al, 0x10
je 0x490cf5
jmp 0x490cd0
test cl, 4
je 0x490cf5
test al, 0x10
jne 0x490cf5
lea eax, [ebp - 0x2b8]
push eax
push edx
call esi
test eax, eax
je 0x490ce6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x68]
jmp 0x490c80
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_FindClose]
or edx, 0xffffffff
mov dword [ebp - 0x68], edx
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x490d53
nop
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28c]
mov ecx, edi
push eax
call fcn.005bbb80
mov eax, dword [ebp - 0x68]
cmp eax, 0xffffffff
je 0x490d53
lea ecx, [ebp - 0x2b8]
push ecx
push eax
call esi
test eax, eax
je 0x490d4a
lea ecx, [ebp - 0x2b8]
call fcn.004011a0
test al, al
jne 0x490d00
mov eax, dword [ebp - 0x68]
cmp eax, 0xffffffff
je 0x490d53
push eax
jmp 0x490d4d
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
mov dword [ebp - 0x68], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005cf7e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..rtf
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov ecx, dword [ebp - 0x2c8]
push eax
push str.NotesNote_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
mov ecx, eax
call fcn.005e3160
sub esp, 8
mov ecx, edi
push 0x82
push 0x104
push 0x28
push 0x118
push str.Create_a_new_note
call fcn.005c0950
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x16
push 0xf0
push 0x46
push 0x122
push str.New_notes_file_name:
mov ecx, edi
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x16
push 0xf0
push 0x5a
push 0x122
push 1
lea ecx, [ebp - 0x20]
call fcn.005dbf40
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005c0a40
push ecx
push 0xffffffffffffffff
push 0x1a
push 0xd7
push 0x82
push 0x136
push str.Create_your_new_note_now
mov ecx, edi
mov dword [ebp - 0x2ec], eax
call fcn.005c1a50
sub esp, 8
mov dword [ebp - 0x2e8], eax
mov ecx, edi
push 0x6e
push 0x104
push 0xbe
push 0x118
push str.Edit_or_delete_a_note
call fcn.005c0950
push ecx
push 0xffffffffffffffff
push 0x1a
push 0xd7
push 0xdc
push 0x136
push str.Edit_the_selected_note
mov ecx, edi
call fcn.005c1a50
push 0x40
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x2dc], eax
call fcn.005bd3f0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0xd7
push 0x104
push 0x136
push str.Delete_the_selected_note
mov ecx, edi
call fcn.005c1a50
push 0x40
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x2d0], eax
call fcn.005bd3f0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0xd7
push 0x140
push 0x136
push str.Browse_the_notes_folder
mov ecx, edi
call fcn.005c1a50
cmp byte [ebx + 0xc], 0
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2d8], 0xffffffff
je 0x490f30
cmp dword [ebp - 0x2e0], 0
je 0x490f30
push ecx
push 0xffffffffffffffff
push 0x1a
push 0xd7
push 0x168
push 0x136
push str.Add_selected_note_to_zip
mov ecx, edi
call fcn.005c1a50
push 0x40
push 0xffffffffffffffff
mov ecx, edi
mov dword [ebp - 0x2d8], eax
call fcn.005bd3f0
mov ecx, str.Select_a_note_to_edit__delete_or_add_to_the_zip._To_create_a_new_note_press_the_button_at_the_top
jmp 0x490f56
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28
push 0xfa
push 0x16d
push 0x11d
push str.After_writing_your_notes_text__dont_forget_to_save
mov ecx, edi
call fcn.005c0890
mov ecx, str.Select_a_note_to_edit_or_delete__in_the_list_above._To_create_a_new_note__click_Create_new_note_now
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x212
push 0x1a4
push 0xa
push ecx
mov ecx, edi
call fcn.005c0890
mov esi, dword [ebp - 0x2c0]
add esi, 0x14f0
mov ecx, esi
mov dword [ebp - 0x2f0], esi
call fcn.005b6bd0
test eax, eax
setne cl
mov byte [ebp - 0x2b9], cl
test eax, eax
je 0x490fb9
mov ecx, esi
call fcn.005b6bd0
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x490fb3
mov byte [ebp - 0x2b9], 2
jmp 0x490fbd
mov cl, byte [ebp - 0x2b9]
test cl, cl
je 0x490fc6
push 1
mov ecx, esi
call fcn.005b6250
push 1
push 5
mov ecx, edi
call fcn.005c3f80
mov ecx, dword [ebp - 0x2e4]
xor dl, dl
call fcn.005c8820
test eax, eax
je 0x491652
nop word [eax + eax]
mov edx, dword [ebp - 0x2e4]
mov esi, dword [edx]
cmp esi, 0xfffffffa
je 0x491652
cmp dword [edx + 0x30], edi
jne 0x49163d
cmp esi, dword [ebp - 0x2e8]
jne 0x49127d
mov ecx, dword [ebp - 0x2c8]
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Notes_
call fcn.005dc190
push eax
push dword [ebp - 0x2ec]
mov ecx, edi
call fcn.005bc230
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc1c0
mov ecx, eax
call fcn.005d9bd0
mov ecx, eax
call fcn.005da510
push 0
push ecx
lea ecx, [ebp - 0x20]
call fcn.005dc0b0
mov edx, str..rtf
mov ecx, eax
call fcn.005d8ad0
test eax, eax
je 0x49109a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..rtf
lea ecx, [ebp - 0x20]
call fcn.005da780
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
push 0
push 0xa
movups xmmword [ebp - 0x58], xmm0
movups xmmword [ebp - 0x48], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005e4770
push 0
push str._rtf1_ansi_ansicpg1252deff0_nouicompatdeflang1033_fonttbl_f0_fnil_fcharset0_Calibri__r_ngenerator_Riched20_10.0.22621_viewkind4uc1__r_npard_sa200_sl276_slmult1_f0_fs22lang9par_r_n_r_n
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.005e37e0
push ecx
lea ecx, [ebp - 0x58]
call fcn.005e36a0
push 1
push 0
mov ecx, edi
call fcn.005c3f80
mov esi, dword [ebp - 0x2c0]
mov ecx, esi
push 0
push 1
call fcn.0043d720
cmp byte [ebp - 0x2b9], 0
je 0x491119
sub esp, 8
lea ecx, [esi + 0x14f0]
push str.Waiting_for_you_to_create_your_note..._r_nClose_WordPad_to_continue.
push 0xffffffffffffffff
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
jmp 0x49114a
push 0
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov ecx, esi
push 0x46
push 0x1c2
push 0
push str.Waiting_for_you_to_create_your_note..._r_nClose_WordPad_to_continue.
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov ecx, eax
call fcn.005cf370
sub esp, 8
mov dword [ebp - 0x2cc], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
call fcn.005dc190
push eax
push str.Windows_NTAccessoriesWORDPAD.EXE__
sub esp, 8
lea ecx, [esi + 0x1290]
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x2c]
push eax
call fcn.005dc520
push 5
push 0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0057b4f0
xor ecx, ecx
mov esi, eax
cmp byte [ebp - 0x2b9], cl
sete cl
inc ecx
push ecx
mov ecx, dword [ebp - 0x2f0]
call fcn.005b6250
push 1
push 5
mov ecx, edi
call fcn.005c3f80
cmp esi, 0xffffffff
je 0x491238
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov ecx, eax
call fcn.005cf370
cmp eax, dword [ebp - 0x2cc]
jne 0x491215
cmp edx, dword [ebp - 0x2d4]
je 0x491238
push 0
push dword [ebp - 0x2c4]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
lea ecx, [ebp - 0x20]
call fcn.005dbfc0
push eax
mov ecx, edi
call fcn.005bbb80
jmp 0x491249
lea ecx, [ebp - 0x20]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e4c40
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.005d9280
mov eax, dword [ebp - 0x58]
cmp eax, 0xffffffff
je 0x49163d
test eax, eax
je 0x49163d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49163d
mov eax, dword [ebp - 0x2c4]
cmp esi, dword [ebp - 0x2dc]
je 0x4913fa
cmp esi, dword [ebp - 0x2d0]
je 0x4913fa
cmp esi, 0xfffffff2
jne 0x4912a9
cmp dword [edx + 0xc], eax
je 0x4913fa
cmp byte [ebx + 0xc], 0
je 0x49132a
cmp dword [ebp - 0x2e0], 0
je 0x49132a
cmp esi, dword [ebp - 0x2d8]
jne 0x49132a
push 2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb4c0
mov ecx, dword [ebp - 0x2c0]
mov esi, eax
test esi, esi
jns 0x4916ba
sub esp, 8
push 0x8c
push 0x190
push 0
push edi
push 0
push str.Please_select_a_note_in_the_list_before_using_this_feature.
call fcn.0043e2e0
push 0x40
push dword [ebp - 0x2dc]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x2d0]
mov ecx, edi
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x2d8]
mov ecx, edi
call fcn.005bd3f0
jmp 0x49163d
cmp esi, dword [ebp - 0x2f4]
je 0x491652
cmp esi, dword [ebp - 0x2f8]
jne 0x491386
mov ecx, dword [ebp - 0x2c8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Notes
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push ecx
push 5
push 0
lea ecx, [ebp - 0x20]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
jmp 0x49163d
cmp esi, 0xffffffd3
je 0x491394
cmp esi, 0xffffffd2
jne 0x49163d
cmp dword [edx + 0xc], eax
jne 0x49163d
push 2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb4c0
mov esi, eax
mov ecx, edi
sar esi, 0x1f
and esi, 0x20
add esi, 0x20
push esi
push dword [ebp - 0x2dc]
call fcn.005bd3f0
push esi
push dword [ebp - 0x2d0]
mov ecx, edi
call fcn.005bd3f0
cmp byte [ebx + 0xc], 0
je 0x49163d
cmp dword [ebp - 0x2e0], 0
je 0x49163d
push esi
push dword [ebp - 0x2d8]
mov ecx, edi
call fcn.005bd3f0
jmp 0x49163d
push 2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.005bb4c0
mov edx, eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2cc], edx
lea ecx, [eax + 0x1cf8]
mov dword [ebp - 0x2fc], ecx
lea ecx, [eax + 0x1cf8]
mov dword [ebp - 0x2d4], ecx
test edx, edx
jns 0x49147b
sub esp, 8
lea ecx, [eax + 0x1cf8]
push 0x8c
push 0x190
push 0
push ecx
push 0
push str.Please_select_a_note_in_the_list_before_using_this_feature.
mov ecx, eax
call fcn.0043e2e0
mov ecx, dword [ebp - 0x2d4]
push 0x40
push dword [ebp - 0x2dc]
call fcn.005bd3f0
push 0x40
push dword [ebp - 0x2d0]
mov ecx, edi
call fcn.005bd3f0
jmp 0x49163d
mov ecx, dword [ebp - 0x2c8]
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Notes_
call fcn.005dc190
mov ecx, dword [ebp - 0x2fc]
push eax
push 0
push dword [ebp - 0x2cc]
push dword [ebp - 0x2c4]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc1c0
mov ecx, eax
call fcn.005da510
cmp esi, dword [ebp - 0x2d0]
je 0x4915e8
mov ecx, dword [ebp - 0x2d4]
push 1
push 0
call fcn.005c3f80
mov esi, dword [ebp - 0x2c0]
mov ecx, esi
push 0
push 1
call fcn.0043d720
cmp byte [ebp - 0x2b9], 0
je 0x491519
sub esp, 8
lea ecx, [esi + 0x14f0]
push str.Waiting_for_you_to_edit_your_note..._r_nClose_WordPad_to_continue.
push 0xffffffffffffffff
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
jmp 0x49154a
push 0
push str.Cancel
push 0
push 0xffffffffffffffba
sub esp, 8
mov ecx, esi
push 0x46
push 0x1c2
push 0
push str.Waiting_for_you_to_edit_your_note..._r_nClose_WordPad_to_continue.
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b64a0
sub esp, 8
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x38], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
call fcn.005dc190
push eax
push str.Windows_NTAccessoriesWORDPAD.EXE__
sub esp, 8
lea ecx, [esi + 0x1290]
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x38]
push eax
call fcn.005dc520
push 5
push 0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.005dc190
push eax
lea ecx, [esi + 0x1290]
call fcn.0057b4f0
mov ecx, dword [ebp - 0x2c0]
xor eax, eax
cmp byte [ebp - 0x2b9], al
sete al
inc eax
lea ecx, [ecx + 0x14f0]
push eax
call fcn.005b6250
push 1
push 5
mov ecx, edi
call fcn.005c3f80
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.005dc430
jmp 0x49163d
mov ecx, dword [ebp - 0x2c0]
sub esp, 8
push 0x8c
push 0x190
push 0
push dword [ebp - 0x2d4]
push 1
push str.Are_you_sure_you_want_to_delete_the_dselected_note_.
call fcn.0043e2e0
test eax, eax
je 0x49163d
lea ecx, [ebp - 0x20]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e4c40
test eax, eax
je 0x49163d
push 0
push dword [ebp - 0x2cc]
mov ecx, edi
push dword [ebp - 0x2c4]
call fcn.005bb970
mov ecx, dword [ebp - 0x2e4]
xor dl, dl
call fcn.005c8820
test eax, eax
jne 0x490ff0
mov edi, dword [ebp - 0x2c0]
mov ecx, edi
push 0
push 0
push 0
push str.Successfully_executed_the_Add_Edit_note_function.
call fcn.0045a700
add edi, 0x1cf8
xor eax, eax
mov ecx, dword [ebp - 0x2c0]
push eax
push edi
call fcn.0043dcc0
mov ecx, dword [ebp - 0x68]
mov esi, eax
cmp ecx, 0xffffffff
je 0x491690
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
sub esp, 0xc
lea ecx, [ecx + 0x150]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Notes_
call fcn.005dc190
push eax
push 0
push esi
push dword [ebp - 0x2c4]
mov ecx, edi
call fcn.005bb510
mov ecx, dword [ebp - 0x2e0]
push eax
call fcn.005dc1c0
mov ecx, eax
call fcn.005da510
mov eax, 2
jmp 0x491672