Function at 0x46fe70
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x44c
test eax, eax
push ebx
push esi
push edi
jne 0x46fe90
pop edi
pop esi
mov eax, 0xff
pop ebx
add esp, 0x44c
ret
mov al, byte [0x4d1b90]
test al, al
jne 0x46fec5
push 0x1d
call fcn.0046f7f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4d1b90
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4d1a60]
test ecx, ecx
jle 0x46fee9
mov esi, ecx
je 0x46fee9
call fcn.00461460
push 0
push 0xfffffffffffffffe
push str.._AULISTENTRY__
push esi
call sub.Storm.dll_Ordinal_403
jmp 0x46fec5
mov bl, byte [esp + 0x45c]
push ebp
test bl, 0x10
je 0x46ff00
call fcn.00470840
jmp 0x4700d5
mov ecx, dword [esp + 0x464]
push 0x104
lea edx, [esp + 0x14]
push ecx
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [esp + 0x10]
push eax
call fcn.004734b0
add esp, 4
test eax, eax
je 0x46ff62
push closesocket
lea ecx, [esp + 0x14]
push 0x4d668c
push ecx
call sub.Storm.dll_Ordinal_501
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0041e1f0
add esp, 8
lea eax, [esp + 0x10]
push closesocket
push 0x4b3aa0
push eax
call sub.Storm.dll_Ordinal_503
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x254]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x258]
push ecx
call fcn.0041e1f0
lea edx, [esp + 0x25c]
lea eax, [esp + 0x360]
push edx
push eax
call fcn.00489d10
add esp, 0x10
lea ecx, [esp + 0x254]
push 0x104
push 0x4965d0
push ecx
call sub.Storm.dll_Ordinal_503
call fcn.0043e8c0
mov edi, eax
lea edx, [esp + 0x114]
lea eax, [esp + 0x254]
push edx
push eax
inc edi
and bl, 0xf0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4700d5
mov al, byte [esp + 0x114]
test al, 0x10
je 0x47002a
test byte [esp + 0x460], 8
je 0x4700b7
lea ecx, [esp + 0x140]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00470230
add esp, 8
jmp 0x4700b7
test al, 2
jne 0x4700b7
lea eax, [esp + 0x140]
push 0x2e
push eax
call fcn.0047c8d0
mov esi, eax
add esp, 8
mov ecx, esi
inc esi
test ecx, ecx
je 0x4700b7
push 0x4a5844
push esi
call fcn.0047c900
add esp, 8
test eax, eax
je 0x47009c
push 0x4a5840
push esi
call fcn.0047c900
add esp, 8
test eax, eax
je 0x47009c
mov al, byte [0x4b497e]
test al, al
je 0x4700b7
push edi
push esi
call fcn.0047c900
add esp, 8
test eax, eax
jne 0x4700b7
lea edx, [esp + 0x140]
lea eax, [esp + 0x10]
mov cl, bl
push edx
push eax
or cl, 1
jmp 0x4700ae
lea edx, [esp + 0x140]
lea eax, [esp + 0x10]
mov cl, bl
push edx
push eax
or cl, 4
push ecx
call fcn.00470590
add esp, 0xc
lea edx, [esp + 0x114]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x46fff7
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x4d1a60]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
pop ebp
and ecx, eax
mov esi, ecx
test esi, esi
jle 0x47011b
mov edi, dword [esp + 0x464]
mov dl, byte [esi + 0x268]
lea eax, [esi + 8]
push edx
push eax
push esi
call edi
test esi, esi
mov dword [esi + 0x254], eax
jne 0x47010f
mov esi, 0x4d1a5c
mov esi, dword [esi + 4]
test esi, esi
jg 0x4700f2
mov eax, dword [0x4d1a60]
mov ebx, dword [esp + 0x468]
test ebx, ebx
je 0x470170
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov esi, ecx
test esi, esi
jle 0x470170
lea edi, [esi + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + 9]
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffc
push ecx
push edx
push ebx
call fcn.0047d120
add esp, 0xc
test eax, eax
je 0x4701e6
test esi, esi
jne 0x470164
mov esi, 0x4d1a5c
mov esi, dword [esi + 4]
test esi, esi
jg 0x470136
mov eax, dword [0x4d1a60]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov edi, ecx
test edi, edi
jle 0x470206
lea esi, [edi + 0x269]
push esi
call fcn.004734b0
add esp, 4
test eax, eax
jne 0x4701f6
push 0x2e
push esi
call fcn.0047c8d0
mov esi, eax
add esp, 8
mov edx, esi
inc esi
test edx, edx
je 0x4701cf
push 0x4a5844
push esi
call fcn.0047c900
add esp, 8
test eax, eax
je 0x4701f6
push 0x4a5840
push esi
call fcn.0047c900
add esp, 8
test eax, eax
je 0x4701f6
test edi, edi
jne 0x4701d8
mov edi, 0x4d1a5c
mov edi, dword [edi + 4]
test edi, edi
jg 0x470184
mov eax, dword [0x4d1a60]
jmp 0x470206
mov eax, dword [esi + 0x254]
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
mov eax, dword [edi + 0x254]
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
xor ecx, ecx
pop edi
test eax, eax
setle cl
dec ecx
pop esi
and eax, ecx
pop ebx
neg eax
sbb eax, eax
and al, 1
add eax, 0xff
add esp, 0x44c
ret