Function at 0x40efe0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x48ee3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x550
mov eax, dword [esp + 0x564]
push ebx
push ebp
push esi
mov esi, ecx
cmp eax, 3
push edi
mov dword [esp + 0x10], esi
jb 0x40f01b
mov eax, 1
jmp 0x40f273
lea ecx, [esp + 0x358]
call fcn.00419b20
xor ebx, ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x259]
mov byte [esp + 0x258], bl
mov ebp, dword [esp + 0x570]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebp
lea eax, [esp + 0x25c]
push str._s.
push eax
mov dword [esp + 0x574], ebx
call fcn.004246dd
add esp, 0xc
mov ecx, esi
push ebp
push 0x3fb
call fcn.00480a2f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x258]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
mov esi, 0x4ad7d0
lea eax, [esp + 0x44]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f0b8
cmp cl, bl
je 0x40f0b4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f0b8
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40f094
xor eax, eax
jmp 0x40f0bd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40f238
mov esi, 0x4af27c
lea eax, [esp + 0x44]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f0f2
cmp cl, bl
je 0x40f0ee
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f0f2
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40f0ce
xor eax, eax
jmp 0x40f0f7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40f238
test byte [esp + 0x18], 0x10
je 0x40f1cf
mov esi, str.WINDOWS
lea eax, [esp + 0x44]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f137
cmp cl, bl
je 0x40f133
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f137
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40f113
xor eax, eax
jmp 0x40f13c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40f238
mov esi, str.Windows
lea eax, [esp + 0x44]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f171
cmp cl, bl
je 0x40f16d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f171
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40f14d
xor eax, eax
jmp 0x40f176
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40f238
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x159]
mov byte [esp + 0x158], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x44]
lea ecx, [esp + 0x158]
push eax
push ebp
push str._s_s_
push ecx
call fcn.004246dd
mov edx, dword [esp + 0x584]
mov ecx, dword [esp + 0x20]
add esp, 0x10
inc edx
lea eax, [esp + 0x158]
push edx
push eax
call fcn.0040efe0
jmp 0x40f238
lea ecx, [esp + 0x44]
push str.Config
push ecx
call fcn.00424290
add esp, 8
test eax, eax
jne 0x40f1fb
lea edx, [esp + 0x44]
push str.config
push edx
call fcn.00424290
add esp, 8
test eax, eax
je 0x40f238
lea eax, [esp + 0x44]
lea ecx, [esp + 0x45c]
push eax
push ebp
push str._s_s
push ecx
call fcn.004246dd
add esp, 0x10
lea edx, [esp + 0x45c]
lea ecx, [esp + 0x358]
push edx
push str.GatePort
push str.LoginGate
call fcn.00419b90
cmp eax, ebx
jne 0x40f251
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40f25a
jmp 0x40f08b
mov ecx, dword [esp + 0x10]
call fcn.0040dba0
lea ecx, [esp + 0x358]
mov dword [esp + 0x568], 0xffffffff
call fcn.00419b50
xor eax, eax
mov ecx, dword [esp + 0x560]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x55c
ret 8