Function at 0x416fdc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 0x100c], eax
mov edx, dword [ebx + 0x1000]
cmp dword [ebx + edx*4], 0
jne 0x41701f
push esi
lea ecx, [ebx + 0x1010]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
mov edx, dword [ebx + 0x1000]
sete cl
and ecx, 1
mov dword [ebx + edx*4], eax
mov edi, ecx
jmp 0x417039
push esi
mov eax, dword [ebx + 0x1000]
mov edx, dword [ebx + eax*4]
push edx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
sete cl
and ecx, 1
mov edi, ecx
mov eax, dword [ebx + 0x1000]
cmp dword [ebx + eax*4 + 0x800], 0
je 0x417054
test edi, edi
jne 0x417091
test byte [esi], 0x10
je 0x416ff0
jmp 0x417091
test edi, edi
jne 0x41705d
test byte [esi], 0x10
jne 0x416ff0
test edi, edi
je 0x417091
mov edx, dword [ebx + 0x1000]
mov ecx, dword [ebx + edx*4]
push ecx
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebx + 0x1000]
xor edx, edx
mov dword [ebx + eax*4], edx
mov ecx, dword [ebx + 0x1000]
mov dword [ebx + ecx*4 + 0x800], 1
jmp 0x416ff0
test edi, edi
jne 0x4170f1
lea eax, [esi + 0x2c]
mov edx, 0x45fc89
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4170bd
test cl, cl
je 0x416ff0
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4170bd
add eax, 2
add edx, 2
test cl, cl
jne 0x41709d
je 0x416ff0
lea eax, [esi + 0x2c]
mov edx, 0x45fc8c
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4170eb
test cl, cl
je 0x416ff0
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4170eb
add eax, 2
add edx, 2
test cl, cl
jne 0x4170cb
je 0x416ff0
test edi, edi
je 0x4171fd
mov eax, dword [ebx + 0x1000]
mov eax, dword [ebx + eax*4]
cmp eax, 0xffffffff
je 0x41711e
mov edx, dword [ebx + 0x1000]
push eax
call sub.KERNEL32.dll_FindClose
mov ecx, dword [ebx + 0x1000]
xor eax, eax
mov dword [ebx + ecx*4], eax
cmp dword [ebx + 0x1000], 0
jne 0x41712e
xor eax, eax
jmp 0x417322
mov edx, dword [ebx + 0x1000]
lea eax, [ebx + 0x1010]
add dword [ebx + 0x1000], 0xffffffff
xor ecx, ecx
mov dword [ebx + edx*4], ecx
push 0x5c
push eax
call fcn.00453124
add esp, 8
mov edi, eax
test eax, eax
je 0x41715a
mov byte [edi], 0
cmp dword [ebx + 0x1004], 0
je 0x41719f
mov ecx, dword [ebp + 0x10]
push esi
mov esi, ecx
lea edx, [ebx + 0x1010]
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push esi
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_FindFirstFileA
push eax
call sub.KERNEL32.dll_FindClose
push 0x5c
lea edx, [ebx + 0x1010]
push edx
call fcn.00453124
add esp, 8
mov edi, eax
test eax, eax
je 0x4171ba
mov byte [edi + 1], 0
lea edx, [ebx + 0x1410]
push edx
lea ecx, [ebx + 0x1010]
push ecx
call fcn.00452e5c
add esp, 8
cmp dword [ebx + 0x1004], 0
je 0x4171ed
mov dword [ebx + 0x100c], 1
mov eax, 1
jmp 0x417322
mov edx, dword [ebp + 0x10]
push edx
push esi
push ebx
call fcn.00416fdc
jmp 0x417322
test byte [esi], 0x10
je 0x4172bc
cmp dword [ebx + 0x1008], 0
je 0x4172bc
push 0x5c
lea ecx, [ebx + 0x1010]
push ecx
call fcn.00453124
add esp, 8
mov edi, eax
test eax, eax
je 0x41722e
mov byte [edi + 1], 0
add esi, 0x2c
push esi
lea eax, [ebx + 0x1010]
push eax
call fcn.00452e5c
mov ecx, dword [ebp + 0x10]
add esp, 8
mov esi, ecx
lea edx, [ebx + 0x1010]
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 0x1010]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x45fc8e
push eax
call fcn.00452e5c
add esp, 8
lea edx, [ebx + 0x1410]
push edx
lea ecx, [ebx + 0x1010]
push ecx
call fcn.00452e5c
add esp, 8
inc dword [ebx + 0x1000]
mov eax, dword [ebx + 0x1000]
xor edx, edx
mov dword [ebx + eax*4], edx
mov ecx, dword [ebx + 0x1000]
xor eax, eax
mov dword [ebx + ecx*4 + 0x800], eax
mov eax, 1
jmp 0x417322
mov eax, dword [ebp + 0x10]
push esi
mov esi, eax
add ebx, 0x1010
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x5c
mov eax, dword [ebp + 0x10]
push eax
call fcn.00453124
add esp, 8
mov edi, eax
test eax, eax
je 0x417300
mov byte [edi + 1], 0
add esi, 0x2c
push esi
mov eax, dword [ebp + 0x10]
push eax
call fcn.00452e5c
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004085c4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc