Function at 0x49d020
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501199
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b0], ecx
lea ecx, [ebp - 0x2d4]
call fcn.00473ab0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.00403790
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049cc40
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x264]
call fcn.00406270
lea ecx, [ebp - 0x264]
call fcn.004037d0
movzx edx, al
test edx, edx
je 0x49d0d5
mov dword [ebp - 0x298], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.004036f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.00473a60
mov eax, dword [ebp - 0x298]
jmp 0x49d4b9
push 0x5c
lea ecx, [ebp - 0x264]
call fcn.004a2e60
push 0x52c550
lea ecx, [ebp - 0x264]
call fcn.004038f0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x264]
call fcn.004038a0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x49d154
mov ecx, dword [ebp + 0xc]
call fcn.00450970
mov dword [ebp - 0x29c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.004036f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.00473a60
mov eax, dword [ebp - 0x29c]
jmp 0x49d4b9
mov dword [ebp - 0x270], 0x52c558
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x26c]
mov ax, word [edx]
mov word [ebp - 0x27e], ax
mov ecx, dword [ebp - 0x270]
cmp ax, word [ecx]
jne 0x49d1d0
cmp word [ebp - 0x27e], 0
je 0x49d1c4
mov edx, dword [ebp - 0x26c]
mov ax, word [edx + 2]
mov word [ebp - 0x280], ax
mov ecx, dword [ebp - 0x270]
cmp ax, word [ecx + 2]
jne 0x49d1d0
add dword [ebp - 0x26c], 4
add dword [ebp - 0x270], 4
cmp word [ebp - 0x280], 0
jne 0x49d16a
mov dword [ebp - 0x28c], 0
jmp 0x49d1db
sbb edx, edx
or edx, 1
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x49d290
mov dword [ebp - 0x278], 0x52c55c
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x274]
mov ax, word [edx]
mov word [ebp - 0x282], ax
mov ecx, dword [ebp - 0x278]
cmp ax, word [ecx]
jne 0x49d270
cmp word [ebp - 0x282], 0
je 0x49d264
mov edx, dword [ebp - 0x274]
mov ax, word [edx + 2]
mov word [ebp - 0x284], ax
mov ecx, dword [ebp - 0x278]
cmp ax, word [ecx + 2]
jne 0x49d270
add dword [ebp - 0x274], 4
add dword [ebp - 0x278], 4
cmp word [ebp - 0x284], 0
jne 0x49d20a
mov dword [ebp - 0x290], 0
jmp 0x49d27b
sbb edx, edx
or edx, 1
mov dword [ebp - 0x290], edx
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jne 0x49d295
jmp 0x49d45b
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x49d2ad
mov edx, dword [ebp - 0x260]
and edx, 0x10
jne 0x49d2ad
jmp 0x49d45b
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x27c]
call fcn.0040e000
mov byte [ebp - 4], 2
push 0x2a
lea ecx, [ebp - 0x27c]
call fcn.004a2e60
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x27c]
call fcn.004038f0
push 0x40
call fcn.004d1f00
add esp, 4
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2a8]
call fcn.004945f0
mov dword [ebp - 0x294], eax
jmp 0x49d313
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x2ac], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
push ecx
mov edx, dword [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x260]
push ecx
lea edx, [ebp - 0x24c]
push edx
lea ecx, [ebp - 0x27c]
call fcn.004038a0
push eax
call fcn.0049d8f0
add esp, 0x18
mov ecx, dword [ebp - 0x268]
call fcn.004946c0
test eax, eax
je 0x49d43d
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax + 0xae0]
mov edx, dword [ecx + 0x44]
and edx, 1
je 0x49d43d
push 0
lea eax, [ebp - 0x2c8]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.00494760
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp - 0x2b8], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2b8]
call fcn.004038a0
push eax
lea edx, [ebp - 0x2c4]
push edx
call fcn.00494370
add esp, 8
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c0]
push ecx
mov ecx, dword [ebp - 0x268]
add ecx, 0x10
call fcn.00410ec0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c4]
call fcn.004036f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c8]
call fcn.004036f0
mov ecx, dword [ebp - 0x268]
add ecx, 0x10
call fcn.004038a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x268]
mov dword [edx + 0x14], eax
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00450a20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.004036f0
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x49d154
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0xc]
call fcn.00450970
mov dword [ebp - 0x2cc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.004036f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.00473a60
mov eax, dword [ebp - 0x2cc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret 0xc