Function at 0x403fa0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x1a98
call fcn.004118b0
mov eax, dword [0x41a07c]
xor eax, esp
mov dword [esp + 0x1a94], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1aa8]
lea edx, [esp + 0xa9c]
push edi
mov dword [esp + 0x10], ecx
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403fd2
xor eax, eax
mov word [esp + 0x12a0], ax
lea eax, [esp + 0xaa0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403ff5
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0xa9e]
lea ecx, [esp + 0xaa0]
cmp eax, ecx
jb 0x404055
movzx ecx, word [eax]
cmp cx, 0x2f
je 0x404035
cmp cx, 0x5c
je 0x404035
sub eax, 2
lea edx, [esp + 0xaa0]
cmp eax, edx
jae 0x404016
jmp 0x404055
xor ecx, ecx
mov word [eax], cx
add eax, 2
lea edx, [esp + 0x12a0]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404046
lea edx, [esp + 0x50]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404204
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x416d6c
lea eax, [esp + 0x7c]
jmp 0x404080
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4040a6
test dx, dx
je 0x4040a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4040a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x404080
xor eax, eax
jmp 0x4040ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4041e9
mov ecx, 0x416d70
lea eax, [esp + 0x7c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4040e6
test dx, dx
je 0x4040e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4040e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4040c0
xor eax, eax
jmp 0x4040eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4041e9
xor eax, eax
jmp 0x404100
movzx ecx, word [esp + eax + 0xaa0]
mov word [esp + eax + 0x2a0], cx
add eax, 2
test cx, cx
jne 0x404100
lea edi, [esp + 0x2a0]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404122
mov eax, dword [0x4170e0]
mov dword [edi], eax
lea eax, [esp + 0x7c]
mov edx, eax
jmp 0x404140
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404140
lea edi, [esp + 0x2a0]
sub eax, edx
add edi, 0xfffffffe
jmp 0x404160
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x404160
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x50], 0x10
rep movsb byte es:[edi], byte [esi]
jne 0x4041e9
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
push 0
push 0
push 0x1004
push ecx
call ebp
mov ecx, dword [edi + 0x3c]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x104d
lea edx, [esp + 0x2ac]
push ecx
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x38], edx
call ebp
mov eax, dword [edi + 0x3c]
lea edx, [esp + 0x14]
push edx
push esi
push 0x1074
push eax
call ebp
mov ecx, dword [edi + 0x3c]
push 0
push 1
push 0x115
push ecx
call ebp
lea edx, [esp + 0x50]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404072
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x12a0]
push 0x2a
push eax
call fcn.00408f84
add esp, 8
test eax, eax
jne 0x404234
lea ecx, [esp + 0x12a0]
push 0x3f
push ecx
call fcn.00408f84
add esp, 8
test eax, eax
je 0x404448
xor eax, eax
jmp 0x404240
movzx ecx, word [esp + eax + 0xaa0]
mov word [esp + eax + 0x2a0], cx
add eax, 2
test cx, cx
jne 0x404240
lea edi, [esp + 0x2a0]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404262
mov edx, dword [0x4170e0]
mov dword [edi], edx
lea edi, [esp + 0x2a0]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404280
mov eax, dword [0x4170e4]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x2a4]
push edx
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404448
mov ecx, 0x416d6c
lea eax, [esp + 0x7c]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4042e6
test dx, dx
je 0x4042e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4042e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4042c0
xor eax, eax
jmp 0x4042eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40442d
mov ecx, 0x416d70
lea eax, [esp + 0x7c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404326
test dx, dx
je 0x404322
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404326
add eax, 4
add ecx, 4
test dx, dx
jne 0x404300
xor eax, eax
jmp 0x40432b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40442d
xor eax, eax
jmp 0x404340
movzx ecx, word [esp + eax + 0xaa0]
mov word [esp + eax + 0x2a0], cx
add eax, 2
test cx, cx
jne 0x404340
lea edi, [esp + 0x2a0]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404362
mov ebp, dword [0x4170e0]
lea eax, [esp + 0x7c]
mov dword [edi], ebp
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404380
lea edi, [esp + 0x2a0]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4043a0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4043a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x50], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x40442d
lea edi, [esp + 0x2a0]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4043d0
lea eax, [esp + 0x12a0]
mov dword [edi], ebp
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4043e7
lea edi, [esp + 0x2a0]
sub eax, edx
add edi, 0xfffffffe
mov edi, edi
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x404400
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x2a0]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push eax
call fcn.00403fa0
lea ecx, [esp + 0x50]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4042b1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1aa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408c7e
add esp, 0x1a98
ret 4