Function at 0x414850
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535d49
mov eax, dword fs:[0]
push eax
sub esp, 0xbd4
mov eax, dword [0x595834]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], 1
mov byte [ebp - 0x214], 0
push 0x1ff
push 0
lea eax, [ebp - 0x213]
push eax
call fcn.0051ab50
add esp, 0xc
mov byte [ebp - 0xb64], 0
push 0x1ff
push 0
lea ecx, [ebp - 0xb63]
push ecx
call fcn.0051ab50
add esp, 0xc
mov byte [ebp - 0x41c], 0
push 0x1ff
push 0
lea edx, [ebp - 0x41b]
push edx
call fcn.0051ab50
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.0040a830
mov byte [ebp - 4], 1
mov dword [ebp - 0x218], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0xb7c], ecx
cmp dword [ebp - 0xb7c], 0x200
jle 0x414949
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.0041b810
mov dword [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041b810
jmp 0x414d67
mov edx, dword [ebp + 8]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0xb88], 0x200
jae 0x4149c5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xbc4], ecx
lea edx, [ebp - 0x41c]
mov dword [ebp - 0xbc8], edx
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbcc], eax
mov ecx, dword [ebp - 0xbc4]
mov dl, byte [ecx]
mov byte [ebp - 0xbcd], dl
mov eax, dword [ebp - 0xbc8]
mov cl, byte [ebp - 0xbcd]
mov byte [eax], cl
mov edx, dword [ebp - 0xbc4]
add edx, 1
mov dword [ebp - 0xbc4], edx
mov eax, dword [ebp - 0xbc8]
add eax, 1
mov dword [ebp - 0xbc8], eax
cmp byte [ebp - 0xbcd], 0
jne 0x414982
lea ecx, [ebp - 0x41c]
add ecx, 0xffffffff
mov dword [ebp - 0xbd4], ecx
mov edx, dword [ebp - 0xbd4]
mov al, byte [edx + 1]
mov byte [ebp - 0xbd5], al
add dword [ebp - 0xbd4], 1
cmp byte [ebp - 0xbd5], 0
jne 0x4149d4
mov edi, dword [ebp - 0xbd4]
mov ecx, dword [0x54ca9c]
mov dword [edi], ecx
mov dl, byte [0x54caa0]
mov byte [edi + 4], dl
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xffffffff
jne 0x414a5b
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.0041b810
mov dword [ebp - 4], 5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041b810
jmp 0x414d67
mov dword [ebp - 0xb68], 0
mov byte [ebp - 0x964], 0
push 0x3ff
push 0
lea edx, [ebp - 0x963]
push edx
call fcn.0051ab50
add esp, 0xc
cmp dword [ebp - 0x424], 0
je 0x414d31
mov eax, dword [ebp - 0xb68]
add eax, 1
mov dword [ebp - 0xb68], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0xb94], edx
cmp dword [ebp - 0xb94], 0x200
jbe 0x414abb
jmp 0x414d31
lea eax, [ebp - 0x538]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x54ca94
lea edx, [ebp - 0x214]
push edx
call fcn.0051c994
add esp, 0x10
mov eax, dword [ebp - 0x564]
and eax, 0x10
je 0x414b4b
lea ecx, [ebp - 0x214]
push ecx
push 0x54ca90
lea edx, [ebp - 0xb64]
push edx
call fcn.0051c994
add esp, 0xc
movsx eax, byte [ebp - 0x538]
cmp eax, 0x2e
je 0x414b46
push ecx
mov ecx, esp
mov dword [ebp - 0xb6c], esp
lea edx, [ebp - 0x214]
push edx
call fcn.00401c80
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbe0], eax
mov byte [ebp - 4], 6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xbc0]
call fcn.00414850
jmp 0x414d12
push str.trojancut.exe
lea ecx, [ebp - 0x538]
push ecx
call fcn.00526ce1
add esp, 8
test eax, eax
jne 0x414b72
mov dword [0x5911e4], 0
jmp 0x414c1d
push str.truep.exe
lea edx, [ebp - 0x538]
push edx
call fcn.00526ce1
add esp, 8
test eax, eax
jne 0x414bfb
push 0x400
push 0
lea eax, [ebp - 0x964]
push eax
call fcn.0051ab50
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x964]
push ecx
push 0x54ca80
lea edx, [ebp - 0x214]
push edx
call fcn.00414420
add esp, 0x10
movsx eax, byte [ebp - 0x964]
test eax, eax
je 0x414bef
push str.PARASOLE
lea ecx, [ebp - 0x964]
push ecx
call fcn.00526ce1
add esp, 8
test eax, eax
jne 0x414bef
mov dword [0x5911e4], 3
jmp 0x414bf9
mov dword [0x5911e4], 1
jmp 0x414c1d
push str.rf.exe
lea edx, [ebp - 0x538]
push edx
call fcn.00526ce1
add esp, 8
test eax, eax
jne 0x414c1d
mov dword [0x5911e4], 2
mov eax, dword [ebp - 0xbc0]
cmp dword [eax + 0x7c], 0
jne 0x414c71
push str.tc_fltr.exe
lea ecx, [ebp - 0x538]
push ecx
call fcn.00526ce1
add esp, 8
test eax, eax
je 0x414cb0
push str.af_fltr.exe
lea edx, [ebp - 0x538]
push edx
call fcn.00526ce1
add esp, 8
test eax, eax
je 0x414cb0
push str.rf_fltr.exe
lea eax, [ebp - 0x538]
push eax
call fcn.00526ce1
add esp, 8
test eax, eax
je 0x414cb0
mov ecx, dword [ebp - 0xbc0]
cmp dword [ecx + 0x84], 0
jne 0x414ccf
push str.TC_RV.exe
lea edx, [ebp - 0x538]
push edx
call fcn.00526ce1
add esp, 8
test eax, eax
je 0x414cb0
push str.TC_R.exe
lea eax, [ebp - 0x538]
push eax
call fcn.00526ce1
add esp, 8
test eax, eax
jne 0x414ccf
lea ecx, [ebp - 0x564]
push ecx
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x424], eax
jmp 0x414a82
mov eax, dword [0x599368]
mov dword [ebp - 0xbb0], eax
lea ecx, [ebp + 8]
push ecx
mov edx, dword [ebp - 0xbb0]
push edx
mov ecx, 0x599360
call fcn.00426f16
mov eax, dword [0x59937c]
mov dword [ebp - 0xbb4], eax
lea ecx, [ebp - 0x538]
push ecx
mov edx, dword [ebp - 0xbb4]
push edx
mov ecx, 0x599374
call fcn.00426f68
lea eax, [ebp - 0x564]
push eax
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x424], eax
jmp 0x414a82
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.0041b810
mov dword [ebp - 4], 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041b810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051a243
mov esp, ebp
pop ebp
ret 4