Function at 0x408dc0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x4355c9
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x449fb0]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449fb0]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x290]
mov edi, ecx
mov ebx, dword [edi + 0x68]
mov eax, dword [esp + 0x28c]
xor esi, esi
mov dword [esp + 0x284], esi
mov dword [esp + 0x14], esi
test bl, 1
jne 0x408e68
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
cmp ecx, esi
jl 0x40929f
cmp ecx, edx
jg 0x40929f
movzx ecx, word [eax + ecx*2]
cmp cx, 0x3a
jne 0x408ee0
test bl, 6
je 0x408e68
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.WARNING:_Recursion_is_not_possible_for_local_file_system_roots._You_may_want_to_append_a_backslash__c:_.
call fcn.00407160
mov ecx, edi
call fcn.00403a30
mov eax, dword [esp + 0x28c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.004021b0
add eax, 0x10
add esp, 4
mov ecx, edi
mov dword [esi], eax
call ebp
mov esi, eax
mov eax, dword [esp + 0x28c]
add eax, 0xfffffff0
mov dword [esp + 0x284], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408eb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.00421a20
add esp, 0x274
ret 8
push 0x438814
lea ecx, [esp + 0x290]
call fcn.00403570
mov ecx, dword [esp + 0x28c]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
cmp eax, esi
jl 0x40929f
cmp eax, edx
jg 0x40929f
movzx eax, word [ecx + eax*2]
cmp ax, 0x3a
jne 0x408f22
mov eax, 1
jmp 0x408fc3
push 7
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x294]
call fcn.00402970
mov eax, dword [eax]
push str._UNC
push eax
call fcn.00420d5f
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408f6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40901d
mov eax, 1
jmp 0x408f80
add eax, 1
mov edx, dword [esp + 0x28c]
mov ecx, dword [edx - 0xc]
js 0x408fb0
cmp eax, ecx
jge 0x408fb0
lea ecx, [edx + eax*2]
push 0x5c
push ecx
call fcn.00420e53
add esp, 8
test eax, eax
je 0x408fb0
sub eax, dword [esp + 0x28c]
sar eax, 1
jmp 0x408fb3
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x408fbb
inc esi
jmp 0x408f80
cmp esi, 3
jne 0x40901d
lea eax, [esi - 1]
test byte [edi + 0x68], 2
je 0x40900c
push ecx
mov dword [esp + 0x24], esp
cmp eax, 1
jne 0x408fed
mov edx, esp
push 0x438814
lea eax, [esp + 0x294]
push eax
push edx
call fcn.00403780
add esp, 0xc
jmp 0x408ffc
lea edx, [esp + 0x290]
mov ecx, esp
push edx
call fcn.00402820
mov ecx, edi
call ebp
mov dword [esp + 0x14], eax
test eax, eax
jne 0x409249
push 0x439654
lea ecx, [esp + 0x290]
call fcn.004045c0
mov ecx, dword [esp + 0x28c]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, 0xffffffff
je 0x40925e
mov edx, dword [esp + 0x28c]
push 0x5c
push edx
call fcn.00420e79
add esp, 8
test eax, eax
jne 0x40905a
or eax, 0xffffffff
jmp 0x409063
sub eax, dword [esp + 0x28c]
sar eax, 1
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x294]
call fcn.00402970
mov byte [esp + 0x284], 1
mov ebx, 4
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.00407160
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x284], 2
mov ecx, 0x439650
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4090c6
test dx, dx
je 0x4090c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4090c6
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4090a2
xor eax, eax
jmp 0x4090cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x4091cf
lea edx, [esp + 0x1c]
push 0x439648
push edx
call fcn.00401e90
add esp, 8
test al, al
jne 0x4091cf
test byte [esp + 0x28], 0x10
je 0x4091a4
test byte [edi + 0x68], 2
je 0x40912b
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00403780
add esp, 0xc
mov ecx, edi
call ebp
mov esi, eax
test esi, esi
jne 0x409214
push ebp
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00403780
add esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x439654
push eax
push ecx
mov byte [esp + 0x298], 3
call fcn.00403780
add esp, 0xc
mov ecx, edi
call fcn.00408dc0
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x14], esi
mov byte [esp + 0x284], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409195
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x409214
test byte [esp + 0x28], 0x10
mov esi, dword [esp + 0x20]
jne 0x4091cf
test byte [edi + 0x68], bl
je 0x4091cf
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00403780
add esp, 0xc
mov ecx, edi
call ebp
mov dword [esp + 0x14], eax
test eax, eax
jne 0x409237
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x284], 1
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409083
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x409240
lea ecx, [esp + 0x1c]
call fcn.00402050
lea ecx, [esp + 0x18]
call fcn.00402050
lea ecx, [esp + 0x28c]
call fcn.00402050
jmp 0x408eb4
lea ecx, [esp + 0x1c]
call fcn.00402050
lea ecx, [esp + 0x18]
call fcn.00402050
lea ecx, [esp + 0x28c]
call fcn.00402050
mov eax, dword [esp + 0x14]
jmp 0x408eb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x44], eax
mov eax, dword [esp + 0x28c]
add eax, 0xfffffff0
mov dword [esp + 0x284], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409295
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x10
jmp 0x408eb6
push 0x80070057
call fcn.00401090
int3