Function at 0x4a14b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x34c
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x104
lea eax, [esp + 0x158]
mov esi, edx
push ebp
push eax
mov dword [esp + 0x1c], esi
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x154]
push 0x5c
push ecx
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x4a14ef
mov cl, byte [eax + 1]
test cl, cl
je 0x4a1506
push 0x104
lea edx, [esp + 0x158]
push 0x4fac0c
push edx
call sub.Storm.dll_Ordinal_503
push 0x104
lea eax, [esp + 0x158]
push esi
push eax
call sub.Storm.dll_Ordinal_503
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x154]
push ecx
push edx
call edi
mov esi, eax
mov ebx, dword [esp + 0x370]
cmp esi, 0xffffffff
je 0x4a15b7
mov al, byte [esp + 0x14]
test al, 2
jne 0x4a1588
test al, 0x10
je 0x4a156e
cmp byte [esp + 0x40], 0x2e
jne 0x4a1563
mov al, byte [esp + 0x41]
test al, al
je 0x4a1588
cmp al, 0x2e
jne 0x4a1563
mov al, byte [esp + 0x42]
test al, al
je 0x4a1588
mov eax, dword [esp + 0x364]
test eax, eax
je 0x4a1588
mov eax, dword [esp + 0x36c]
push ebx
push eax
lea edx, [esp + 0x1c]
mov ecx, ebp
call dword [esp + 0x368]
test eax, eax
je 0x4a159a
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4a15b0
jmp 0x4a153c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x368]
test esi, esi
je 0x4a172d
push 0x104
lea edx, [esp + 0x158]
push ebp
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [esp + 0x154]
push 0x5c
push eax
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x4a15f3
mov cl, byte [eax + 1]
test cl, cl
je 0x4a160a
push 0x104
lea ecx, [esp + 0x158]
push 0x4fac0c
push ecx
call sub.Storm.dll_Ordinal_503
push 0x104
lea edx, [esp + 0x158]
push 0x4faf10
push edx
call sub.Storm.dll_Ordinal_503
lea eax, [esp + 0x14]
lea ecx, [esp + 0x154]
push eax
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x4a172d
mov al, byte [esp + 0x14]
test al, 2
jne 0x4a16fb
test al, 0x10
je 0x4a16fb
cmp byte [esp + 0x40], 0x2e
jne 0x4a1672
mov al, byte [esp + 0x41]
test al, al
je 0x4a16fb
cmp al, 0x2e
jne 0x4a1672
mov al, byte [esp + 0x42]
test al, al
je 0x4a16fb
push 0x104
lea edx, [esp + 0x25c]
push ebp
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [esp + 0x258]
push 0x5c
push eax
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x4a169f
mov cl, byte [eax + 1]
test cl, cl
je 0x4a16b6
push 0x104
lea ecx, [esp + 0x25c]
push 0x4fac0c
push ecx
call sub.Storm.dll_Ordinal_503
lea edx, [esp + 0x40]
push 0x104
lea eax, [esp + 0x25c]
push edx
push eax
call sub.Storm.dll_Ordinal_503
mov ecx, dword [esp + 0x36c]
mov edx, dword [esp + 0x364]
mov eax, dword [esp + 0x360]
push ebx
push ecx
push esi
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x26c]
call fcn.004a14b0
test eax, eax
je 0x4a1710
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4a1726
jmp 0x4a163b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 0x14
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34c
ret 0x14