Function at 0x481fff
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push 0x2e4
mov eax, 0x4c5bf3
call fcn.004ac3e5
mov eax, dword [ebp + 8]
and dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp + 0xc]
push 0x24c
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x2d4]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x2f0], esi
mov ebx, edx
mov byte [ebp - 0x2d9], 1
call fcn.004a63e0
add esp, 0xc
lea eax, [ebp - 0x88]
push esi
push eax
call fcn.004826f6
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x74], 8
mov eax, dword [ebp - 0x88]
jae 0x482073
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0x2d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2e4], eax
setne al
test al, al
je 0x4822ae
mov ebx, 0x80
mov edi, dword [ebp - 0x2f0]
lea eax, [ebp - 0x64]
push 0x4cb648
push eax
call fcn.00408817
lea ecx, [ebp - 0x2ac]
push ecx
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004088bd
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.0040a3ed
test byte [ebp - 0x2d8], 0x10
jne 0x4822f3
test byte [0x4f5ac4], 1
jne 0x48210f
or dword [0x4f5ac4], 1
mov edi, 0x4f5aa8
mov byte [ebp - 4], 4
call fcn.0047e6b7
push 0x4c6fc1
call fcn.004a6981
pop ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x48]
call fcn.00409d45
mov esi, str.sogouipfilter.dll
push esi
mov byte [ebp - 4], 5
call fcn.004a5eb4
pop ecx
push eax
push esi
xor eax, eax
lea ecx, [ebp - 0x48]
call fcn.0040f26e
cmp eax, 0xffffffff
jne 0x4822e7
cmp dword [ebp - 0x34], 8
mov esi, dword [ebp - 0x48]
jae 0x48214f
lea esi, [ebp - 0x48]
push esi
call fcn.004a5eb4
pop ecx
push eax
push esi
xor eax, eax
lea ecx, [ebp - 0x48]
call fcn.0040f26e
cmp eax, 0xffffffff
jne 0x4822e7
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x482177
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x48218b
lea ecx, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
push eax
push ebx
push 4
push eax
push eax
push 0x40000000
push ecx
call esi
cmp eax, 0xffffffff
jne 0x4822e0
mov edi, dword [ebp - 0x2ec]
push dword [ebp - 0x2e8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x240]
test al, al
je 0x48232e
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4821db
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x4821ef
lea ecx, [ebp - 0x2c]
xor eax, eax
push eax
push ebx
push 4
push eax
push eax
push 0x40000000
push ecx
call esi
cmp eax, 0xffffffff
jne 0x4822e0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x482214
lea eax, [ebp - 0x2c]
push dword [ebp - 0x2e0]
mov ecx, dword [0x4f5464]
push eax
push str.Check_File_Writeable_CheckRootDllDeleteImpl_:__s__d_
push 0
call fcn.0047b68e
add esp, 0x10
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e0], 0x1e
jl 0x4821cf
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c4]
mov byte [ebp - 0x2d9], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
lea eax, [ebp - 0x2c]
mov esi, esp
mov dword [ebp - 0x2e8], esp
push eax
call fcn.00409de0
lea ebx, [ebp - 0x6c]
call fcn.00488fd4
mov ecx, ebx
push ecx
mov byte [ebp - 4], 7
mov eax, dword [edi]
push 3
mov ecx, edi
call dword [eax + 0x24c]
mov ecx, ebx
call fcn.0048904a
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040a3ed
push 1
lea esi, [ebp - 0x2c]
call fcn.0040a3ed
cmp dword [ebp - 0x2e4], 0xffffffff
je 0x4822c3
push dword [ebp - 0x2e4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
xor edi, edi
lea esi, [ebp - 0x88]
call fcn.0040a3ed
mov al, byte [ebp - 0x2d9]
call fcn.004ac468
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040a3ed
lea eax, [ebp - 0x2d8]
push eax
push dword [ebp - 0x2e4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
setne byte [ebp - 0x2da]
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040a3ed
cmp byte [ebp - 0x2da], 0
jne 0x48209a
jmp 0x4822ae
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c4]
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2e8], esp
push str.unknown
mov byte [ebp - 0x2d9], 0
call fcn.00409d45
lea ebx, [ebp - 0x68]
call fcn.00489de4
mov ecx, ebx
push ecx
mov byte [ebp - 4], 6
mov eax, dword [edi]
push 3
mov ecx, edi
call dword [eax + 0x24c]
mov ecx, ebx
call fcn.00489e54
jmp 0x482298