Function at 0x45e9b0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x24c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x260]
mov bl, cl
test edi, edi
mov ebp, edx
mov byte [esp + 0x13], bl
jne 0x45e9df
mov eax, 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret 8
mov al, byte [0x64a9f0]
test al, al
jne 0x45ea1b
mov ecx, 0x1c
call fcn.0045afd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x64a9f0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x260]
mov eax, dword [0x64a8b8]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov esi, ecx
test esi, esi
je 0x45ea46
call fcn.00443050
push 0
push 0xfffffffffffffffe
push str.._AULISTENTRY__
push esi
call sub.Storm.dll_Ordinal_403
jmp 0x45ea1b
test bl, 0x10
je 0x45ea55
call fcn.0045f220
jmp 0x45ebe3
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x158]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x158]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45eaaf
cmp byte [esp + ecx + 0x157], 0x5c
je 0x45eaaf
push 0x104
lea ecx, [esp + 0x15c]
push 0x4fac04
push ecx
call sub.Storm.dll_Ordinal_503
push 0x104
lea edx, [esp + 0x15c]
push 0x4faf08
push edx
call sub.Storm.dll_Ordinal_503
call fcn.004a16d0
mov edi, eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x158]
push eax
push ecx
inc edi
and bl, 0x70
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x45ebdc
mov al, byte [esp + 0x18]
test al, 0x10
je 0x45eb14
test byte [esp + 0x13], 8
je 0x45ebbd
lea edx, [esp + 0x44]
mov ecx, ebp
call fcn.0045ed10
jmp 0x45ebbd
test al, 2
jne 0x45ebbd
lea edx, [esp + 0x44]
push 0x2e
push edx
call fcn.004ce000
mov esi, eax
add esp, 8
inc esi
test eax, eax
je 0x45ebbd
mov al, byte [0x518a68]
test al, al
je 0x45eb53
mov ecx, dword [0x4ee004]
push ecx
push esi
call fcn.004ce4d0
add esp, 8
test eax, eax
je 0x45eb67
mov edx, dword [0x4ee000]
push edx
push esi
call fcn.004ce4d0
add esp, 8
test eax, eax
jne 0x45eb75
lea eax, [esp + 0x44]
mov cl, bl
push eax
mov edx, ebp
or cl, 4
jmp 0x45ebb8
mov al, byte [0x65aa4c]
test al, al
je 0x45eb9a
push edi
push esi
call fcn.004ce4d0
add esp, 8
test eax, eax
jne 0x45eb9a
lea ecx, [esp + 0x44]
mov edx, ebp
push ecx
mov cl, bl
or cl, 1
jmp 0x45ebb8
push 0x4ee008
push esi
call fcn.004ce4d0
add esp, 8
test eax, eax
jne 0x45ebbd
lea edx, [esp + 0x44]
mov cl, bl
push edx
mov edx, ebp
or cl, 0x80
call fcn.0045f000
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45eaf1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x260]
mov eax, dword [0x64a8b8]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov esi, ecx
test esi, esi
jle 0x45ec21
mov dl, byte [esi + 0x268]
lea eax, [esi + 8]
push edx
push eax
push esi
call edi
test esi, esi
mov dword [esi + 0x254], eax
jne 0x45ec15
mov esi, 0x64a8b4
mov esi, dword [esi + 4]
test esi, esi
jg 0x45ebf8
mov eax, dword [0x64a8b8]
mov ebx, dword [esp + 0x264]
test ebx, ebx
je 0x45ec76
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov esi, ecx
test esi, esi
jle 0x45ec76
lea edi, [esi + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + 9]
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffc
push ecx
push edx
push ebx
call fcn.004cde20
add esp, 0xc
test eax, eax
je 0x45ecfd
test esi, esi
jne 0x45ec6a
mov esi, 0x64a8b4
mov esi, dword [esi + 4]
test esi, esi
jg 0x45ec3c
mov eax, dword [0x64a8b8]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov esi, ecx
test esi, esi
jle 0x45ecdb
lea edx, [esi + 0x269]
push 0x2e
push edx
call fcn.004ce000
mov edi, eax
add esp, 8
inc edi
test eax, eax
je 0x45ecc6
mov ecx, dword [0x4ee004]
push ecx
push edi
call fcn.004ce4d0
add esp, 8
test eax, eax
je 0x45ecfd
mov edx, dword [0x4ee000]
push edx
push edi
call fcn.004ce4d0
add esp, 8
test eax, eax
je 0x45ecfd
test esi, esi
jne 0x45eccf
mov esi, 0x64a8b4
mov esi, dword [esi + 4]
test esi, esi
jg 0x45ec86
mov eax, dword [0x64a8b8]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and eax, ecx
neg eax
sbb eax, eax
and al, 1
add eax, 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret 8
mov eax, dword [esi + 0x254]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret 8