Function at 0x4a1440
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x34c
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x104
lea eax, [esp + 0x158]
mov esi, edx
push ebp
push eax
mov dword [esp + 0x1c], esi
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x154]
push 0x5c
push ecx
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x4a147f
mov cl, byte [eax + 1]
test cl, cl
je 0x4a1496
push 0x104
lea edx, [esp + 0x158]
push 0x4fac04
push edx
call sub.Storm.dll_Ordinal_503
push 0x104
lea eax, [esp + 0x158]
push esi
push eax
call sub.Storm.dll_Ordinal_503
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x154]
push ecx
push edx
call edi
mov esi, eax
mov ebx, dword [esp + 0x370]
cmp esi, 0xffffffff
je 0x4a1547
mov al, byte [esp + 0x14]
test al, 2
jne 0x4a1518
test al, 0x10
je 0x4a14fe
cmp byte [esp + 0x40], 0x2e
jne 0x4a14f3
mov al, byte [esp + 0x41]
test al, al
je 0x4a1518
cmp al, 0x2e
jne 0x4a14f3
mov al, byte [esp + 0x42]
test al, al
je 0x4a1518
mov eax, dword [esp + 0x364]
test eax, eax
je 0x4a1518
mov eax, dword [esp + 0x36c]
push ebx
push eax
lea edx, [esp + 0x1c]
mov ecx, ebp
call dword [esp + 0x368]
test eax, eax
je 0x4a152a
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4a1540
jmp 0x4a14cc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x368]
test esi, esi
je 0x4a16bd
push 0x104
lea edx, [esp + 0x158]
push ebp
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [esp + 0x154]
push 0x5c
push eax
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x4a1583
mov cl, byte [eax + 1]
test cl, cl
je 0x4a159a
push 0x104
lea ecx, [esp + 0x158]
push 0x4fac04
push ecx
call sub.Storm.dll_Ordinal_503
push 0x104
lea edx, [esp + 0x158]
push 0x4faf08
push edx
call sub.Storm.dll_Ordinal_503
lea eax, [esp + 0x14]
lea ecx, [esp + 0x154]
push eax
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x4a16bd
mov al, byte [esp + 0x14]
test al, 2
jne 0x4a168b
test al, 0x10
je 0x4a168b
cmp byte [esp + 0x40], 0x2e
jne 0x4a1602
mov al, byte [esp + 0x41]
test al, al
je 0x4a168b
cmp al, 0x2e
jne 0x4a1602
mov al, byte [esp + 0x42]
test al, al
je 0x4a168b
push 0x104
lea edx, [esp + 0x25c]
push ebp
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [esp + 0x258]
push 0x5c
push eax
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x4a162f
mov cl, byte [eax + 1]
test cl, cl
je 0x4a1646
push 0x104
lea ecx, [esp + 0x25c]
push 0x4fac04
push ecx
call sub.Storm.dll_Ordinal_503
lea edx, [esp + 0x40]
push 0x104
lea eax, [esp + 0x25c]
push edx
push eax
call sub.Storm.dll_Ordinal_503
mov ecx, dword [esp + 0x36c]
mov edx, dword [esp + 0x364]
mov eax, dword [esp + 0x360]
push ebx
push ecx
push esi
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x26c]
call fcn.004a1440
test eax, eax
je 0x4a16a0
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4a16b6
jmp 0x4a15cb
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 0x14
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34c
ret 0x14