Function at 0x482cac
Capabilities:
Enumerate files on windows

Disassembly:
push 0x55c
mov eax, 0x4c4112
call fcn.004ac3e5
mov eax, dword [ebp + 8]
and dword [ebp - 0x53c], 0
mov dword [ebp - 0x550], eax
mov ebx, 0x4cb648
lea eax, [ebp - 0x2e4]
mov edi, ecx
mov esi, edx
push ebx
push eax
mov dword [ebp - 0x554], edi
mov dword [ebp - 0x544], esi
call fcn.00408817
and dword [ebp - 4], 0
lea ecx, [ebp - 0x274]
push esi
push ecx
mov ecx, eax
call fcn.00408ce7
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x2e4]
mov byte [ebp - 4], 2
call fcn.0040a3ed
mov eax, dword [ebp - 0x544]
xor esi, esi
cmp dword [eax + 0x10], esi
jne 0x482d82
mov edi, dword [ebp - 0x554]
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.00408817
push str..lnk
push eax
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 3
call fcn.004088bd
add esp, 0x10
mov ebx, eax
lea eax, [ebp - 0x274]
mov byte [ebp - 4], 4
call fcn.00409d73
push 1
xor edi, edi
lea esi, [ebp - 0x23c]
call fcn.0040a3ed
push 1
lea esi, [ebp - 0x258]
call fcn.0040a3ed
mov ebx, 0x4cb648
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x548], esi
mov dword [ebp - 0x54c], esi
lea eax, [ebp - 0x548]
push eax
push 0x4c862c
xor edi, edi
inc edi
push edi
push esi
push 0x4cb5fc
mov byte [ebp - 4], 6
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x482dd4
mov eax, dword [ebp - 0x548]
mov ecx, dword [eax]
lea edx, [ebp - 0x54c]
push edx
push 0x4cb60c
push eax
call dword [ecx]
test eax, eax
jns 0x482e15
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x54c]
cmp eax, esi
je 0x482de8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x548]
cmp eax, esi
je 0x482dfc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x274]
call fcn.0040a3ed
mov al, bl
call fcn.004ac468
ret
mov dword [ebp - 0x568], esi
mov dword [ebp - 0x564], esi
mov dword [ebp - 0x560], esi
mov byte [ebp - 4], 7
cmp dword [ebp - 0x260], 8
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x558], edi
jae 0x482e46
lea eax, [ebp - 0x274]
lea ecx, [ebp - 0x538]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x544], eax
cmp eax, 0xffffffff
je 0x48308d
cmp dword [ebp - 0x558], esi
je 0x48308d
test byte [ebp - 0x538], 0x10
jne 0x482e63
mov edi, dword [ebp - 0x554]
mov esi, dword [ebp - 0x54c]
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.00408817
lea ecx, [ebp - 0x50c]
push ecx
push eax
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 8
call fcn.004088bd
add esp, 0x10
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 8
jb 0x482eb7
mov eax, dword [eax]
mov ecx, dword [esi]
push 0
push eax
push esi
call dword [ecx + 0x14]
push 1
xor edi, edi
lea esi, [ebp - 0x23c]
call fcn.0040a3ed
push 1
lea esi, [ebp - 0x258]
mov byte [ebp - 4], 7
call fcn.0040a3ed
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004a63e0
mov eax, dword [ebp - 0x548]
mov ecx, dword [eax]
add esp, 0xc
push 2
push edi
push 0x105
lea edx, [ebp - 0x220]
push edx
push eax
call dword [ecx + 0xc]
cmp byte [ebp + 0xc], 0
lea eax, [ebp - 0x220]
push eax
je 0x482f3e
lea eax, [ebp - 0x2ac]
call fcn.00409d45
mov byte [ebp - 4], 0xa
or dword [ebp - 0x53c], 1
jmp 0x482f78
lea eax, [ebp - 0x258]
call fcn.00409d45
lea eax, [ebp - 0x2c8]
mov dword [ebp - 4], 0xb
or dword [ebp - 0x53c], 2
push eax
lea ecx, [ebp - 0x258]
call fcn.00479f66
pop ecx
mov dword [ebp - 4], 0xc
or dword [ebp - 0x53c], 4
mov ebx, eax
lea esi, [ebp - 0x290]
call fcn.00409dc6
mov dword [ebp - 4], 0xd
test byte [ebp - 0x53c], 4
je 0x482fab
and dword [ebp - 0x53c], 0xfffffffb
push 1
xor edi, edi
lea esi, [ebp - 0x2c8]
call fcn.0040a3ed
test byte [ebp - 0x53c], 2
je 0x482fca
and dword [ebp - 0x53c], 0xfffffffd
push 1
xor edi, edi
lea esi, [ebp - 0x258]
call fcn.0040a3ed
mov byte [ebp - 4], 0x10
test byte [ebp - 0x53c], 1
je 0x482fed
and dword [ebp - 0x53c], 0xfffffffe
push 1
xor edi, edi
lea esi, [ebp - 0x2ac]
call fcn.0040a3ed
mov eax, dword [ebp - 0x550]
cmp dword [eax + 0x10], 0
je 0x483023
cmp dword [eax + 0x14], 8
jb 0x483001
mov eax, dword [eax]
cmp dword [ebp - 0x27c], 8
mov ecx, dword [ebp - 0x290]
jae 0x483016
lea ecx, [ebp - 0x290]
push eax
push ecx
call fcn.004a6dda
pop ecx
pop ecx
test eax, eax
jne 0x483055
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x23c]
call fcn.00409d45
lea ebx, [ebp - 0x23c]
lea edi, [ebp - 0x568]
mov byte [ebp - 4], 0x11
call fcn.00407b75
push 1
xor edi, edi
mov esi, ebx
call fcn.0040a3ed
lea eax, [ebp - 0x538]
push eax
push dword [ebp - 0x544]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 1
xor edi, edi
lea esi, [ebp - 0x290]
mov dword [ebp - 0x558], eax
mov byte [ebp - 4], 7
call fcn.0040a3ed
mov ebx, 0x4cb648
xor esi, esi
jmp 0x482e63
push dword [ebp - 0x544]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x548]
cmp eax, esi
je 0x4830af
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x548], esi
mov eax, dword [ebp - 0x54c]
cmp eax, esi
je 0x4830c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x54c], esi
mov eax, dword [ebp - 0x564]
mov ecx, dword [ebp - 0x568]
sub eax, ecx
push 0x1c
cdq
pop edi
idiv edi
mov dword [ebp - 0x550], eax
cmp eax, esi
jbe 0x483158
mov dword [ebp - 0x53c], ecx
mov dword [ebp - 0x544], eax
mov edi, dword [ebp - 0x554]
lea eax, [ebp - 0x2c8]
push ebx
push eax
call fcn.00408817
mov byte [ebp - 4], 0x12
push dword [ebp - 0x53c]
lea ecx, [ebp - 0x2ac]
push ecx
mov ecx, eax
call fcn.00408ce7
push eax
mov byte [ebp - 4], 0x13
call fcn.0047a5a1
add esp, 0x14
push 1
xor edi, edi
lea esi, [ebp - 0x2ac]
call fcn.0040a3ed
push 1
lea esi, [ebp - 0x2c8]
mov byte [ebp - 4], 7
call fcn.0040a3ed
add dword [ebp - 0x53c], 0x1c
dec dword [ebp - 0x544]
jne 0x4830ef
xor esi, esi
cmp dword [ebp - 0x550], esi
lea ebx, [ebp - 0x568]
seta byte [ebp - 0x53d]
call fcn.004083a6
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x54c]
test eax, eax
je 0x483184
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x548]
test eax, eax
je 0x483198
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov bl, byte [ebp - 0x53d]
jmp 0x482dfe