Function at 0x511cc0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x2ec
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push ebx
lea ecx, [esp + 0x1c]
call fcn.0051db00
lea eax, [esp + 0x1bc]
mov dword [esp + 0x14], vtable.DynamicVectorClass_class_CCINIClass__.0
push eax
push str.RULE.INI
mov dword [esp + 0x30], 0xa
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x511e88
test dword [esp + 0x1bc], 0x116
jne 0x511e60
mov al, byte [esp + 0x2ec]
lea edi, [esp + 0x2ec]
cmp al, bl
jne 0x511d37
lea edi, [esp + 0x1e8]
push edi
lea ecx, [esp + 0x30]
call fcn.00468b70
push 0x50
call fcn.0076d5a7
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x511d63
mov ecx, esi
call fcn.0051a170
mov byte [esi + 0x38], bl
mov dword [esi], vtable.CCINIClass.0
jmp 0x511d65
xor esi, esi
push ebx
lea ecx, [esp + 0x30]
push ebx
push ecx
mov ecx, esi
call fcn.004692d0
push str.RULES.INI
push edi
call fcn.0076d4b0
add esp, 8
test eax, eax
jne 0x511df1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov byte [esp + 0x13], 1
jl 0x511dc7
cmp byte [esp + 0x21], bl
jne 0x511da4
cmp ecx, ebx
jne 0x511e34
mov eax, dword [esp + 0x28]
cmp eax, ebx
jle 0x511e34
mov edx, dword [esp + 0x14]
add ecx, eax
push ebx
push ecx
lea ecx, [esp + 0x1c]
call dword [edx + 8]
test al, al
je 0x511e34
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x511de0
shl eax, 2
push eax
mov eax, dword [esp + 0x1c]
push eax
add eax, 4
push eax
call fcn.0076e820
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
jmp 0x511e34
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jl 0x511e22
cmp byte [esp + 0x21], bl
jne 0x511e07
cmp eax, ebx
jne 0x511e34
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
jle 0x511e34
mov edx, dword [esp + 0x14]
add eax, ecx
push ebx
push eax
lea ecx, [esp + 0x1c]
call dword [edx + 8]
test al, al
je 0x511e34
mov ecx, dword [esp + 0x24]
mov eax, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + eax*4], esi
lea ecx, [esp + 0x80]
mov dword [esp + 0x2c], vtable.CCFileClass.0
mov dword [esp + 0x8c], ebx
call fcn.00438290
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], vtable.CDFileClass.0
call fcn.0042f250
lea edx, [esp + 0x1bc]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x511d0d
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [esp + 0x13], bl
jne 0x511f55
push str.RULES.INI
lea ecx, [esp + 0x30]
call fcn.00468b70
push 0x50
call fcn.0076d5a7
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x511eb8
mov ecx, esi
call fcn.0051a170
mov byte [esi + 0x38], bl
mov dword [esi], vtable.CCINIClass.0
jmp 0x511eba
xor esi, esi
push ebx
lea eax, [esp + 0x30]
push ebx
push eax
mov ecx, esi
call fcn.004692d0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x511efd
cmp byte [esp + 0x21], bl
jne 0x511ede
cmp ecx, ebx
jne 0x511f25
mov eax, dword [esp + 0x28]
cmp eax, ebx
jle 0x511f25
mov edx, dword [esp + 0x14]
add ecx, eax
push ebx
push ecx
lea ecx, [esp + 0x1c]
call dword [edx + 8]
test al, al
je 0x511f25
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x511f16
shl eax, 2
push eax
mov eax, dword [esp + 0x1c]
push eax
add eax, 4
push eax
call fcn.0076e820
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov ebp, vtable.CCFileClass.0
lea ecx, [esp + 0x80]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x8c], ebx
call fcn.00438290
mov edi, vtable.CDFileClass.0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], edi
call fcn.0042f250
jmp 0x511f5f
mov ebp, vtable.CCFileClass.0
mov edi, vtable.CDFileClass.0
cmp dword [esp + 0x24], ebx
jg 0x511f83
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.VectorClass_class_CCINIClass__.0
call fcn.0051d5e0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
push str.ART.INI
lea ecx, [esp + 0x94]
call fcn.00468b70
lea edx, [esp + 0x90]
mov ecx, 0x821b10
push ebx
push ebx
push edx
call fcn.004692d0
test eax, eax
jne 0x512004
push str.Failed_to_load_ART.INI__n
call fcn.004068f0
add esp, 4
lea ecx, [esp + 0xe4]
mov dword [esp + 0x90], ebp
mov dword [esp + 0xf0], ebx
call fcn.00438290
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], edi
call fcn.0042f250
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.VectorClass_class_CCINIClass__.0
call fcn.0051d5e0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
cmp dword [esp + 0x24], 1
jne 0x512013
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x512043
mov edx, dword [0xb0de30]
mov eax, dword [0xb0dbd8]
lea ecx, [esp + 0x14]
push ecx
push 0x512380
push edx
push 0x93
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
jne 0x51203c
xor eax, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x821b68]
push eax
mov dword [0x8219f0], eax
call fcn.0063edc0
mov ecx, dword [0x821b68]
push 0x821b10
call fcn.00644bf0
mov edx, dword [0x8219f0]
mov ecx, dword [0x821b68]
push edx
call fcn.0063ad70
mov eax, dword [0x8219f0]
mov ecx, dword [0x821b68]
push eax
call fcn.006425f0
mov eax, dword [0x821b68]
push str.LANGRULE.INI
mov ecx, dword [eax + 0x10ec]
mov dword [0xa255cc], ecx
mov edx, dword [eax + 0x10fc]
mov dword [0xa255e0], edx
mov ecx, dword [eax + 0x1104]
mov dword [0x7c3968], ecx
mov edx, dword [eax + 0x1108]
mov dword [0xa255d8], edx
mov ecx, dword [eax + 0x110c]
mov dword [0xa255e8], ecx
mov edx, dword [eax + 0x1110]
mov dword [0xa255e4], edx
mov cl, byte [eax + 0x1114]
mov byte [0xa255d0], cl
mov dl, byte [eax + 0x1117]
mov byte [0xa255c8], dl
mov cl, byte [eax + 0x1119]
mov byte [0xa255d1], cl
mov dl, byte [eax + 0x111a]
mov byte [0xa2564e], dl
mov cl, byte [eax + 0x111b]
mov byte [0xa2564d], cl
mov dl, byte [eax + 0x111c]
mov byte [0xa255dc], dl
mov cl, byte [eax + 0x111d]
mov byte [0xa2564c], cl
mov dl, byte [eax + 0x111e]
mov byte [0xa255d2], dl
mov cl, byte [eax + 0x1121]
mov byte [0xa255d3], cl
mov dl, byte [eax + 0x1122]
mov byte [0xa255d4], dl
mov cl, byte [eax + 0x111f]
mov byte [0xa2564f], cl
mov dl, byte [eax + 0x1120]
lea ecx, [esp + 0xf8]
mov byte [0xa25650], dl
call fcn.00468b70
lea ecx, [esp + 0xf4]
push ebx
call fcn.00468dc0
cmp al, 1
jne 0x512264
lea ecx, [esp + 0x2c]
call fcn.0051a170
lea eax, [esp + 0xf4]
lea ecx, [esp + 0x2c]
push ebx
push 1
push eax
mov byte [esp + 0x70], bl
mov dword [esp + 0x38], vtable.CCINIClass.0
call fcn.004692d0
cmp eax, 1
jle 0x51224b
lea ecx, [esp + 0x2c]
call fcn.0050abd0
lea ecx, [esp + 0x148]
mov dword [esp + 0xf4], ebp
mov dword [esp + 0x154], ebx
call fcn.00438290
lea ecx, [esp + 0xf4]
mov dword [esp + 0xf4], edi
call fcn.0042f250
lea ecx, [esp + 0xe4]
mov dword [esp + 0x90], ebp
mov dword [esp + 0xf0], ebx
call fcn.00438290
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], edi
call fcn.0042f250
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.VectorClass_class_CCINIClass__.0
cmp eax, ebx
je 0x51223e
cmp byte [esp + 0x21], bl
je 0x51223e
push eax
call fcn.0076d2d5
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2ec
ret
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x821b68]
call fcn.0063a750
lea ecx, [esp + 0x2c]
call fcn.0050abd0
mov eax, dword [esp + 0x24]
xor esi, esi
cmp eax, ebx
jle 0x512298
mov eax, dword [esp + 0x18]
mov edx, dword [eax + esi*4]
mov ecx, dword [0x8219f0]
cmp edx, ecx
je 0x51228f
mov ecx, edx
cmp ecx, ebx
je 0x51228f
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
inc esi
cmp esi, ecx
jl 0x512272
push str.AI.INI
lea ecx, [esp + 0x15c]
call fcn.00468b70
lea ecx, [esp + 0x158]
push ebx
push 1
push ecx
mov ecx, 0x821ac0
call fcn.004692d0
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x158], ebp
mov dword [esp + 0x1b8], ebx
call fcn.00438290
lea ecx, [esp + 0x158]
mov dword [esp + 0x158], edi
call fcn.0042f250
lea ecx, [esp + 0x148]
mov dword [esp + 0xf4], ebp
mov dword [esp + 0x154], ebx
call fcn.00438290
lea ecx, [esp + 0xf4]
mov dword [esp + 0xf4], edi
call fcn.0042f250
lea ecx, [esp + 0xe4]
mov dword [esp + 0x90], ebp
mov dword [esp + 0xf0], ebx
call fcn.00438290
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], edi
call fcn.0042f250
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.VectorClass_class_CCINIClass__.0
cmp eax, ebx
je 0x512364
cmp byte [esp + 0x21], bl
je 0x512364
push eax
call fcn.0076d2d5
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2ec
ret