Function at 0x4056a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x954
or ecx, 0xffffffff
xor eax, eax
mov byte [0x4164cc], 0
push ebx
push ebp
mov ebp, dword [esp + 0x960]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 6
ja 0x40577a
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x3a
mov eax, ecx
mov esi, edi
mov edi, 0x4163ac
push 0x4163ac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x40577a
mov byte [eax + 1], 0
mov edi, str.Program_Files
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0x4163ac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x4163ac
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x40577a
mov edi, str..
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x4164d0], 1
mov esi, edi
mov edx, ecx
mov edi, 0x4163ac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x258]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405987
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00405d00
mov al, byte [0x41639c]
test al, al
jne 0x405a8d
lea edi, [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x35c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [0x4130b0]
and ecx, 3
test al, al
rep movsb byte es:[edi], byte [esi]
jne 0x405859
lea ecx, [esp + 0x35c]
push 0x2e
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x405a78
mov byte [eax - 1], 0
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x35c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x35c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x564]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x3c
mov eax, ecx
mov esi, edi
mov edi, 0x415f84
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x80
lea edi, [esp + 0x568]
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esp + 0x768]
rep stosd dword es:[edi], eax
mov edi, 0x415f84
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x568]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x768]
push ecx
push edx
call fcn.00405d70
lea edi, [esp + 0x770]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, 0x415f84
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xa
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x415e54]
push ecx
call ebx
mov edx, dword [esp + 0x14]
and edx, 0x10
cmp dl, 0x10
je 0x405961
mov al, byte [0x4130b0]
test al, al
jne 0x405930
inc dword [0x4164b8]
mov eax, dword [str.W32_Palevo.Worm]
test eax, eax
je 0x405961
mov eax, 0x412eb8
mov esi, eax
mov edx, dword [eax]
lea ecx, [esp + 0x35c]
push ecx
push edx
call dword [esi + 4]
add esp, 8
test eax, eax
jne 0x405961
mov ecx, dword [esi + 8]
add esi, 8
test ecx, ecx
mov eax, esi
jne 0x405940
call fcn.00405d00
mov al, byte [0x41639c]
test al, al
jne 0x405a8d
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4057c4
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edi, [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x460]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [sym.imp.MSVCRT.dll_strrchr]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x2e
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x464]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x4059d6
mov byte [eax + 1], 0
mov edi, 0x413074
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x460]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
je 0x405c97
call fcn.00405d00
mov al, byte [0x41639c]
test al, al
jne 0x405cae
mov edx, dword [esp + 0x14]
and edx, 0x10
cmp dl, 0x10
jne 0x405ae4
mov esi, 0x413070
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405aa1
test cl, cl
je 0x405a74
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405aa1
add eax, 2
add esi, 2
test cl, cl
jne 0x405a54
xor eax, eax
jmp 0x405aa6
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x954
ret
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x954
ret
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405ae0
mov esi, 0x41306c
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405ad7
test cl, cl
je 0x405ad3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405ad7
add eax, 2
add esi, 2
test cl, cl
jne 0x405ab3
xor eax, eax
jmp 0x405adc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405afa
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405a29
jmp 0x405afe
mov esi, dword [esp + 0x10]
mov ebp, dword [sym.imp.MSVCRT.dll_strstr]
call fcn.00405d00
mov al, byte [0x41639c]
test al, al
jne 0x405cae
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x405c83
mov esi, 0x413070
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405b53
test cl, cl
je 0x405b4f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405b53
add eax, 2
add esi, 2
test cl, cl
jne 0x405b2f
xor eax, eax
jmp 0x405b58
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405c7f
mov esi, 0x41306c
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405b8d
test cl, cl
je 0x405b89
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405b8d
add eax, 2
add esi, 2
test cl, cl
jne 0x405b69
xor eax, eax
jmp 0x405b92
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405c7f
lea edi, [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x154]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x158]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x405cc2
mov byte [eax - 1], 0
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x154]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x154]
and ecx, 3
push str.Program_Files_
rep movsb byte es:[edi], byte [esi]
mov edi, str..
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
mov eax, dword [0x4164d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc eax
mov dword [0x4164d8], eax
lea eax, [esp + 0x158]
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
add esp, 8
test eax, eax
je 0x405c6a
mov dword [0x4164d4], 1
lea ecx, [esp + 0x154]
push ecx
call fcn.004056a0
add esp, 4
cmp eax, 0xffffffff
je 0x405cdb
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405b04
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x4164b8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x954
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x954
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x954
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x954
ret