Function at 0x4f7d98
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x7f
push 0
push 0
dec ecx
jne 0x4f7da0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x4f832b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c0]
call fcn.0040afc8
mov edx, dword [ebp - 0x3c0]
lea eax, [ebp - 0x130]
mov ecx, 0xff
call fcn.004057cc
mov eax, dword [ebp - 4]
call fcn.00403174
call fcn.00403138
lea eax, [ebp - 0x270]
push eax
push 0x4f833c
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x4f82b8
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x244]
mov ecx, 0x104
call fcn.004057a0
mov eax, dword [ebp - 0xc]
mov edx, 0x4f8348
call fcn.00405958
je 0x4f8298
mov eax, dword [ebp - 0xc]
mov edx, 0x4f8354
call fcn.00405958
je 0x4f8298
cmp dword [ebp - 0x270], 0x10
jne 0x4f7ed9
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4f8298
mov eax, dword [ebp - 4]
test eax, eax
je 0x4f7e7d
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4f7eb5
push dword [ebp - 4]
push 0x4f8360
push dword [ebp - 0xc]
lea eax, [ebp - 0x3c4]
mov edx, 3
call fcn.004058c4
mov edx, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x1c]
call fcn.004f7d98
jmp 0x4f8298
lea eax, [ebp - 0x3c8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405848
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x1c]
call fcn.004f7d98
jmp 0x4f8298
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4f7ee5
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x3d0]
push eax
mov edx, ebx
sub edx, 2
mov ecx, 3
mov eax, dword [ebp - 0xc]
call fcn.00405a28
mov eax, dword [ebp - 0x3d0]
lea edx, [ebp - 0x3cc]
call fcn.0040a40c
mov eax, dword [ebp - 0x3cc]
lea edx, [ebp - 8]
call fcn.00409ee4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x634]
mov edx, dword [ebp - 8]
call fcn.004412d8
test al, al
jne 0x4f7f4d
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x634]
mov edx, 0x4f836c
call fcn.004412d8
test al, al
je 0x4f8298
push dword [ebp - 4]
push 0x4f8360
push dword [ebp - 0xc]
lea eax, [ebp - 0x3d4]
mov edx, 3
call fcn.004058c4
mov edx, dword [ebp - 0x3d4]
lea eax, [ebp - 0x3bc]
call fcn.004036b8
xor eax, eax
push ebp
push 0x4f8079
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
lea eax, [ebp - 0x3bc]
call fcn.00403d1c
call fcn.00403138
xor eax, eax
push ebp
push 0x4f8068
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3bc]
call fcn.0040395c
call fcn.00403138
mov ebx, eax
mov eax, ebx
sub eax, 0x400
jb 0x4f7fce
sub eax, 0xffc00
jb 0x4f7ff0
jmp 0x4f801e
lea edx, [ebp - 0x3d8]
mov eax, ebx
call fcn.0040a628
mov edx, dword [ebp - 0x3d8]
lea eax, [ebp - 0x10]
mov ecx, 0x4f8378
call fcn.00405848
jmp 0x4f804a
lea edx, [ebp - 0x3dc]
mov eax, ebx
test eax, eax
jns 0x4f8001
add eax, 0x3ff
sar eax, 0xa
call fcn.0040a628
mov edx, dword [ebp - 0x3dc]
lea eax, [ebp - 0x10]
mov ecx, 0x4f8388
call fcn.00405848
jmp 0x4f804a
lea edx, [ebp - 0x3e0]
mov eax, ebx
test eax, eax
jns 0x4f802f
add eax, 0xfffff
sar eax, 0x14
call fcn.0040a628
mov edx, dword [ebp - 0x3e0]
lea eax, [ebp - 0x10]
mov ecx, 0x4f8394
call fcn.00405848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f806f
lea eax, [ebp - 0x3bc]
call fcn.00403780
call fcn.00403138
ret
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4f7e12
jmp 0x4f82dd
lea eax, [ebp - 0x3f4]
lea edx, [ebp - 0x130]
call fcn.00405794
mov eax, dword [ebp - 0x3f4]
call fcn.00403174
call fcn.00403138
xor ebx, ebx
jmp 0x4f8300
lea eax, [ebp - 0x3f8]
lea edx, [ebp - 0x130]
call fcn.00405794
mov eax, dword [ebp - 0x3f8]
call fcn.00403174
call fcn.00403138
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8332
lea eax, [ebp - 0x3f8]
mov edx, 0xf
call fcn.00405554
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405554
ret