Function at 0x43fca0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61584e
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x278], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x280], esi
mov dword [ebp - 4], 0
or edi, 0xffffffff
mov eax, dword [eax + 0x40]
test eax, eax
je 0x43fcfa
mov al, byte [eax]
test al, al
jne 0x43fed7
push 0x67a140
lea edx, [ebp + 8]
lea ecx, [ebp - 0x288]
call fcn.004146f0
add esp, 4
lea ecx, [ebp - 0x260]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x288]
mov ebx, eax
mov dword [ebp - 0x284], ebx
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x43fd44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp ebx, 0xffffffff
je 0x43fed7
push 1
push 0x67d71c
lea ecx, [ebp + 8]
call fcn.0040d6f0
call fcn.0044b060
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], edx
mov ecx, dword [ebp - 0x278]
call fcn.0043c0f0
test al, al
jne 0x43fecb
push 0x679f20
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x43feb0
push 0x67a148
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x43feb0
call fcn.00403fe0
test eax, eax
je 0x440060
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x274], eax
call fcn.00403fe0
test eax, eax
je 0x440060
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov dword [ebp - 0x26c], 0
lea ebx, [eax + 0x10]
mov dword [ebp - 0x270], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x234]
test byte [ebp - 0x260], 0x10
je 0x43ff14
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x27c]
call fcn.004146f0
add esp, 4
push esi
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x264], esi
mov ecx, dword [ebp - 0x27c]
lea ecx, [ecx - 0x10]
call fcn.00407830
mov ecx, dword [ebp - 0x278]
add eax, 0x10
mov dword [esi], eax
call fcn.0043fca0
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x27c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fe6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x280]
mov byte [ebp - 4], 0
lea edx, [ebx - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fe8d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x274]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43feaa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43fd73
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x43fef6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43ff17
sub eax, edx
lea ecx, [ebp - 0x274]
sar eax, 1
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00407780
push dword [ebp - 0x274]
mov eax, dword [ebp - 0x240]
push dword [ebp + 8]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x270]
push 0x67d390
push eax
call fcn.00403390
mov ebx, dword [ebp - 0x270]
add esp, 0x10
lea ecx, [ebx - 0x10]
call fcn.00407830
push 0
push 0x80
push 3
push 0
push 4
add eax, 0x10
push 0xc0000000
push eax
mov dword [ebp - 0x264], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x43ffbd
mov edx, dword [ebp - 0x264]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fe72
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x43fe72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x264]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ffe1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x248]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x264], 0
push eax
push ecx
call fcn.005c9de0
mov ecx, dword [ebp - 0x28c]
sub ecx, eax
mov eax, dword [ebp - 0x290]
sbb eax, edx
mov dword [ebp - 0x264], eax
js 0x43fe72
jg 0x44003a
cmp ecx, 0xe10
jbe 0x43fe72
lea eax, [ebp - 0x274]
mov ecx, esi
push eax
call fcn.00440170
mov eax, dword [ebp - 0x26c]
add dword [esi + 0x10], eax
mov ebx, dword [ebp - 0x270]
adc dword [esi + 0x14], 0
jmp 0x43fe72
push 0x80004005
call fcn.00403d40
int3