Function at 0x4028a4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2d8
mov byte [ebp - 0x246], 0
push dword [ebp + 8]
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
call sub.user32.dll_CharLowerA
push eax
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x405eb4
call sub.user32.dll_CharLowerA
push eax
push 0x405eb4
call sub.kernel32.dll_lstrcpyA
push 0x405eb4
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x40290a
leave
ret 4
nop
push edi
push 0x4067e4
call sub.kernel32.dll_lstrlenA
mov edi, 0
jmp 0x402925
mov byte [edi + 0x4067e4], 0
inc edi
cmp edi, eax
jbe 0x40291d
mov al, byte [ebp - 0x246]
mov byte [0x4067e4], al
mov al, byte [ebp - 0x245]
mov byte [0x4067e5], al
mov al, byte [ebp - 0x244]
mov byte [0x4067e6], al
push str.Program_Files
call sub.user32.dll_CharLowerA
push eax
push str.Program_Files
call sub.kernel32.dll_lstrcpyA
push str.Program_Files
push 0x4067e4
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
push 0x4067e4
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x402988
pop edi
leave
ret 4
push 0x4067e4
call sub.kernel32.dll_lstrlenA
mov edi, 0
jmp 0x4029a1
mov byte [edi + 0x4067e4], 0
inc edi
cmp edi, eax
jbe 0x402999
mov al, byte [ebp - 0x246]
mov byte [0x4067e4], al
mov al, byte [ebp - 0x245]
mov byte [0x4067e5], al
mov al, byte [ebp - 0x244]
mov byte [0x4067e6], al
push str.Documents_and_Settings
call sub.user32.dll_CharLowerA
push eax
push str.Documents_and_Settings
call sub.kernel32.dll_lstrcpyA
push str.Documents_and_Settings
push 0x4067e4
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
push 0x4067e4
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x402a04
pop edi
leave
ret 4
pop edi
push str..
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x142]
push eax
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402a3e
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
leave
ret 4
mov dword [ebp - 0x350], 1
jmp 0x402b0a
lea eax, [ebp - 0x116]
push eax
lea eax, [ebp - 0x34a]
push eax
call sub.kernel32.dll_lstrcpyA
mov byte [ebp - 0xb20], 0
push dword [ebp + 8]
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
push 0x405034
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x34a]
push eax
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
test dword [ebp - 0x142], 0x10
je 0x402abd
cmp byte [ebp - 0x116], 0x2e
je 0x402aee
lea eax, [ebp - 0xb20]
push eax
call fcn.004028a4
jmp 0x402aee
lea eax, [ebp - 0xb20]
push eax
call sub.shlwapi.dll_PathFindExtensionA
push eax
push str..exe
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x402aee
lea eax, [ebp - 0xb20]
push eax
push 0x405190
call sub.kernel32.dll_lstrcpyA
call fcn.004027d4
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x142]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_FindNextFileA
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x402a4d
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
leave
ret 4