Function at 0x497f2f
Capabilities:
Enumerate files on windows

Disassembly:
push 0x35c
mov eax, 0x524a7a
call fcn.004f3f50
mov esi, ecx
mov dword [ebp - 0x328], esi
mov dword [ebp - 0x334], esi
push 0x53ea18
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00435df3
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x497f6c
mov eax, dword [eax]
lea ecx, [ebp - 0x31c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x340], ebx
lea ecx, [ebp - 0xcc]
call fcn.00410d88
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp ebx, 0xffffffff
jne 0x497fa6
xor edi, edi
jmp 0x498365
xor ebx, ebx
mov dword [ebp - 0x324], ebx
lea eax, [ebp - 0x324]
push eax
call fcn.0043e8d8
mov dword [esp], 0x527fb4
lea ecx, [ebp - 0x5c]
call fcn.004108e3
xor edi, edi
inc edi
push 0x529aac
lea eax, [ebp - 0x2f0]
push eax
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x49832c
push 0x529ab0
lea eax, [ebp - 0x2f0]
push eax
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x49832c
test byte [ebp - 0x31c], 0x10
jne 0x49832c
cmp dword [ebp - 0x300], edi
jae 0x49832c
mov eax, dword [ebp - 0x2fc]
dec eax
cmp eax, 0x1ffffe
ja 0x49832c
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00435df3
add esp, 0xc
push eax
lea ecx, [ebp - 0x5c]
call fcn.004132cc
lea ecx, [ebp - 0x74]
call fcn.00410d88
sub esp, 0x18
mov ecx, esp
push str.DumpFile.dat
call fcn.004108e3
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
lea eax, [ebp - 0x5c]
push eax
call fcn.0041992a
call fcn.00495bd7
add esp, 0x30
test eax, eax
jne 0x49832c
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
jb 0x498094
mov eax, dword [ebp - 0x5c]
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0045997a
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
jb 0x4980ae
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x320]
call fcn.00402af5
push 2
lea eax, [ebp - 0x320]
push eax
call fcn.00446a65
mov ecx, eax
call fcn.00446abf
test eax, eax
je 0x4980ee
mov ecx, dword [ebp - 0x320]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea ecx, [ebp - 0x2c]
call fcn.00410d88
jmp 0x49832c
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00435df3
add esp, 0xc
mov eax, dword [ebp - 0x324]
test eax, eax
je 0x498155
lea edx, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
jb 0x49811b
mov edx, dword [ebp - 0x44]
mov ecx, dword [eax]
push edi
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x498155
mov eax, dword [ebp - 0x324]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
mov ecx, dword [ebp - 0x324]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x1c]
test esi, esi
je 0x49814f
lea ecx, [ebp - 0x44]
call fcn.00410d88
jmp 0x4980d3
mov esi, dword [ebp - 0x328]
lea eax, [ebp - 0x2f0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..dmp
push eax
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x498145
lea eax, [ebp - 0x308]
push eax
mov ecx, esi
call fcn.004995cc
test eax, eax
jne 0x498145
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x358]
call fcn.004276c6
mov esi, dword [eax]
mov edi, dword [eax + 4]
push 0xffffffffffffffff
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x360]
call fcn.004276c6
mov ecx, dword [eax]
sub ecx, esi
mov eax, dword [eax + 4]
sbb eax, edi
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x32c], eax
or dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x328]
jmp 0x498246
push ebx
push 0xe10
push eax
push ecx
call fcn.00522e80
mov ecx, eax
mov dword [ebp - 0x338], ecx
mov esi, edx
mov dword [ebp - 0x33c], esi
imul eax, dword [ebp + 8], 0x18
cdq
cmp esi, edx
jg 0x49830b
jl 0x49827a
cmp ecx, eax
ja 0x49830b
lea esi, [edi + 0x30]
test esi, esi
je 0x498288
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00435df3
add esp, 0xc
mov ecx, dword [ebp - 0x338]
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp - 0x33c]
mov dword [ebp - 0x90], ecx
push eax
lea ecx, [ebp - 0x8c]
call fcn.004243ad
lea eax, [ebp - 0x94]
push eax
lea ecx, [edi + 0x940]
call fcn.00492772
push eax
add eax, 0x10
push eax
push ebx
lea eax, [ebp - 0x368]
push eax
lea ecx, [edi + 0x940]
call fcn.004934b0
lea ecx, [ebp - 0x8c]
call fcn.00410d88
lea ecx, [ebp - 0x74]
call fcn.00410d88
test esi, esi
je 0x49830b
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x44]
call fcn.00410d88
mov ecx, dword [ebp - 0x320]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea ecx, [ebp - 0x2c]
call fcn.00410d88
xor edi, edi
inc edi
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x340]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov esi, dword [ebp - 0x328]
jne 0x497fcc
lea ecx, [ebp - 0x5c]
call fcn.00410d88
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x498365
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
lea ecx, [ebp + 0xc]
call fcn.00410d88
mov eax, edi
call fcn.004f3eb0
ret 0x1c