Function at 0x418cd7
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x477b82
call fcn.00477780
sub esp, 0x498
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push str.AppData
mov esi, eax
push ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x41900d
mov eax, dword [0x4a3a68]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x6022
push eax
call edi
xor ecx, ecx
test eax, eax
jle 0x418d5c
push 0x104
lea eax, [ebp - 0x4a4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x41900d
jmp 0x418d99
mov esi, dword [0x4a3a68]
add esi, 0x2d90
cmp word [esi], cx
je 0x418d96
push esi
call edi
mov dword [ebp - 0x18], eax
lea eax, [ebx + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41900d
mov eax, dword [ebp - 0x18]
lea esi, [esi + eax*2]
xor eax, eax
add esi, 2
cmp word [esi], ax
jne 0x418d6d
mov esi, dword [ebp - 0x14]
push 0xfffe
call fcn.0044b199
mov edi, eax
pop ecx
test edi, edi
je 0x41900d
push ebx
push str._s
push 0x7fff
push edi
call fcn.00402b62
add esp, 0x10
lea eax, [ebp - 0x29c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x419006
push str.Windows
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x418f89
lea eax, [ebp - 0x270]
push eax
push ebx
push str._s_s
push 0x7fff
push edi
call fcn.00402b62
add esp, 0x14
test byte [ebp - 0x29c], 0x10
je 0x418e6c
push 0x48ba9c
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x418e6c
push 0x48baa0
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x418e6c
push str.AppData
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x418f89
push edi
call fcn.00418cd7
pop ecx
jmp 0x418f89
push dword [0x4a3088]
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x418ed6
lea ecx, [ebp - 0x34]
call fcn.00418238
or esi, 1
mov dword [ebp - 0x14], esi
cmp dword [eax + 0x14], 8
jb 0x418e99
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x418ed6
mov eax, dword [0x4a3a68]
add eax, 0xc8
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x418ed6
test byte [ebp - 0x29c], 0xa7
je 0x418ed6
mov byte [ebp - 0xd], 1
jmp 0x418edb
xor eax, eax
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
test al, 1
je 0x418ef0
and eax, 0xfffffffe
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.0041c310
cmp byte [ebp - 0xd], 0
je 0x418f89
xor eax, eax
mov esi, eax
cmp dword [0x4a3098], eax
jbe 0x418f4a
mov eax, dword [0x4a3090]
mov dword [ebp - 0x1c], eax
push ecx
mov edx, eax
lea ecx, [ebp - 0x270]
call fcn.00401821
pop ecx
test al, al
jne 0x418f37
mov eax, dword [ebp - 0x1c]
inc esi
add eax, 0x104
mov dword [ebp - 0x1c], eax
cmp esi, dword [0x4a3098]
jb 0x418f0e
jmp 0x418f4a
mov ecx, dword [0x4a3090]
imul eax, esi, 0x104
inc dword [eax + ecx + 0x100]
sub esp, 0x28
lea ecx, [ebp - 0x34]
mov esi, esp
push edi
call fcn.0041bbfd
xor ecx, ecx
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov ecx, esp
push eax
mov dword [ecx], 0x4188a0
add ecx, 4
call fcn.0041bbca
mov ecx, esi
call fcn.0041ccf5
call fcn.00403509
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0041c310
lea eax, [ebp - 0x29c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x418ddc
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x4a3a68]
add eax, 0xc8
push eax
push ebx
push str._s_s
push 0x7fff
push edi
call fcn.00402b62
sub esp, 0x14
lea ecx, [ebp - 0x4c]
mov esi, esp
push edi
call fcn.0041bbfd
sub esp, 0x1c
mov dword [ebp - 4], 1
mov ecx, esp
push eax
mov dword [ecx], fcn.00418c73
add ecx, 4
call fcn.0041bbca
mov ecx, esi
call fcn.0041ccf5
call fcn.00403509
lea ecx, [ebp - 0x4c]
call fcn.0041c310
push edi
call fcn.0044a989
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret