Function at 0x4ab320
Capabilities:
Enumerate files on windows

Disassembly:
push 0x334
mov eax, 0x69488f
call fcn.0056e23b
mov ebx, ecx
and dword [ebp - 0x338], 0
lea ecx, [ebp - 0xe0]
call fcn.004d2654
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 2
or esi, 0xffffffff
push 2
pop eax
mov dword [ebp - 0x334], eax
lea edi, [eax + 0x41]
push edi
lea ecx, [ebp - 0xe0]
call fcn.004d2843
test eax, eax
jne 0x4ab594
lea ecx, [ebp - 0xe0]
call fcn.004d281a
cmp eax, 5
movzx eax, di
push eax
lea eax, [ebp - 0x48]
jne 0x4ab3c0
push str._c:Recycler__UserSID__
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
push 0
call fcn.004552fa
add esp, 0x18
jmp 0x4ab3ce
push str._c:Recycled
push eax
call fcn.0041ccda
add esp, 0xc
lea ecx, [ebp - 0xe0]
call fcn.004d2741
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf3c8
push eax
call fcn.0041ccda
add esp, 0xc
lea ecx, [ebp - 0x330]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4ab594
lea edi, [ebx + 0x818]
mov ecx, edi
call fcn.004c2c9d
mov ecx, edi
call fcn.00451480
test eax, eax
jne 0x4ab5af
lea eax, [ebp - 0x304]
push eax
push 0x6cf3d4
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab574
lea eax, [ebp - 0x304]
push eax
push 0x6cf3d8
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab574
lea eax, [ebp - 0x304]
push eax
push str.Desktop.ini
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab574
lea eax, [ebp - 0x304]
push eax
push 0x6cf3f8
call fcn.0064806f
pop ecx
pop ecx
test eax, eax
je 0x4ab574
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x304]
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push 0x6cf404
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
lea eax, [ebp - 0x28]
je 0x4ab4f5
cmp dword [ebp - 0x14], 8
mov ecx, ebx
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call fcn.004aa656
jmp 0x4ab565
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005655b9
cmp dword [ebp - 0x14], 8
pop ecx
mov ecx, eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edx
push ecx
push eax
mov ecx, ebx
call fcn.004a91f6
sub esp, 0x28
mov dword [ebp - 0x33c], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x4a919b
mov dword [eax + 8], ebx
call fcn.004a81c7
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push edi
cmovae eax, dword [ebp - 0x28]
push 0x7e7c80
push eax
mov byte [ebp - 4], 2
call fcn.005380d7
add esp, 0x34
test eax, eax
jne 0x4ab565
inc dword [ebx + 0x80c]
cmp eax, 0x18697
je 0x4ab5af
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x330]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ab420
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp eax, 0x19
jle 0x4ab36b
xor ebx, ebx
inc ebx
jmp 0x4ab5b5
mov ebx, dword [ebp - 0x338]
cmp esi, 0xffffffff
je 0x4ab5c1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.004d26ba
mov eax, ebx
call fcn.0056e1e5
ret