Function at 0x402d10
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c2bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x4e5d60]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov eax, dword [0x4e5d60]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
test edi, edi
je 0x402fa9
test eax, eax
je 0x402fa9
call fcn.004990cf
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402d88
push 0x80004005
call fcn.0040f160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x298], 0
call fcn.004990cf
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402dbd
push 0x80004005
call fcn.0040f160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push edi
mov byte [esp + 0x29c], 1
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x402e34
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x298], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x298], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402fa9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x402fa9
push edi
lea ecx, [esp + 0x18]
push str._s.
push ecx
call fcn.0040e520
mov ebx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x34]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x402de0
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x402f8c
mov ecx, 0x4cbd28
lea eax, [esp + 0x60]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402ea6
test dx, dx
je 0x402ea2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402ea6
add eax, 4
add ecx, 4
test dx, dx
jne 0x402e80
xor eax, eax
jmp 0x402eab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402f74
mov ecx, 0x4cbd2c
lea eax, [esp + 0x60]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402ee6
test dx, dx
je 0x402ee2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402ee6
add eax, 4
add ecx, 4
test dx, dx
jne 0x402ec0
xor eax, eax
jmp 0x402eeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402f74
lea edx, [esp + 0x60]
push edx
push edi
lea eax, [esp + 0x1c]
push 0x4cbd34
push eax
call fcn.0040e520
add esp, 0x10
test byte [esp + 0x34], 0x10
je 0x402f2f
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x28]
push edx
call fcn.00402d10
test eax, eax
jne 0x402fdc
jmp 0x402f74
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
lea ebx, [esp + 0x28]
call fcn.00401d50
test eax, eax
je 0x402f74
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040e410
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
jl 0x402f74
mov ecx, dword [esp + 0x20]
push ecx
push esi
call fcn.004a6d30
add esp, 8
test eax, eax
je 0x402f74
sub eax, esi
sar eax, 1
jns 0x402fd1
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402e74
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
call fcn.0040ed20
lea ecx, [esp + 0x14]
call fcn.0040ed20
xor eax, eax
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.004a6859
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
call fcn.0040ed20
lea ecx, [esp + 0x14]
call fcn.0040ed20
mov eax, 1
jmp 0x402fab