Function at 0x4014c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x40aa17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
mov eax, dword [0x40e0b0]
push ebx
push ebp
push esi
mov dword [esp + 0x2b0], eax
push edi
mov edx, dword [esp + 0x2c8]
mov eax, dword [edx - 0xc]
test eax, eax
mov dword [esp + 0x2c0], 1
je 0x40152b
lea ecx, [eax - 1]
test ecx, ecx
jl 0x401762
cmp ecx, eax
jg 0x401762
cmp byte [ecx + edx], 0x5c
jne 0x40152b
dec eax
push eax
lea ecx, [esp + 0x2cc]
call fcn.00401290
mov ebx, dword [esp + 0x2dc]
test bl, bl
je 0x401713
mov ebp, dword [esp + 0x2c8]
add ebp, 0xfffffff0
push ebp
call fcn.004010a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 4
push str..
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c8], 2
call fcn.00401380
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x174]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x18], eax
jmp 0x401590
test byte [esp + 0x174], 0x10
je 0x4016cb
lea edx, [esp + 0x1a0]
push 0x40b434
push edx
call fcn.0040347c
add esp, 8
test eax, eax
je 0x4016cb
lea eax, [esp + 0x1a0]
push 0x40b430
push eax
call fcn.0040347c
add esp, 8
test eax, eax
je 0x4016cb
push ebp
call fcn.004010a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x10], eax
mov ecx, dword [eax - 0xc]
test ecx, ecx
mov byte [esp + 0x2c0], 3
je 0x401607
push 1
push 0x40b19c
lea ecx, [esp + 0x18]
call fcn.00401380
lea eax, [esp + 0x1a0]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401611
sub eax, ecx
push eax
lea ecx, [esp + 0x1a4]
push ecx
lea ecx, [esp + 0x18]
call fcn.00401380
mov edx, dword [esp + 0x2e8]
mov eax, dword [esp + 0x2e4]
mov ecx, dword [esp + 0x2e0]
push edx
mov edx, dword [esp + 0x2dc]
push eax
mov eax, dword [esp + 0x2dc]
push ecx
mov ecx, dword [esp + 0x2dc]
push ebx
push edx
push eax
mov eax, dword [esp + 0x2e4]
push ecx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x3c], esp
mov esi, esp
push eax
call fcn.004010a0
add eax, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
mov dword [esp + 0x44], esp
mov edi, esp
push esi
mov byte [esp + 0x2e8], 4
call fcn.004010a0
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x2e4], 3
call fcn.004014c0
add esp, 0x24
mov byte [esp + 0x2c0], 2
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4016cb
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x174]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401590
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x2c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401713
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x2cc]
lea eax, [esp + 0x174]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [esp + 0x2c8]
add ebx, 0xfffffff0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
jmp 0x401740
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [ebx + 0xc]
test edx, edx
lea ecx, [ebx + 0xc]
jl 0x40176c
cmp eax, dword [ebx]
jne 0x40176c
mov eax, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40179e
push 0x80070057
call fcn.00401060
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x401c5e
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ebx + 4]
inc ecx
mov edx, ecx
shr ecx, 2
lea esi, [ebx + 0x10]
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [eax - 0xc]
test ecx, ecx
mov byte [esp + 0x2c0], 5
je 0x4017c4
push 1
push 0x40b19c
lea ecx, [esp + 0x18]
call fcn.00401380
lea eax, [esp + 0x1a0]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4017d0
sub eax, edx
push eax
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x18]
call fcn.00401380
test byte [esp + 0x174], 0x10
je 0x401824
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401bca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x401bca
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 4]
mov edi, 1
cmp eax, edi
jle 0x401845
mov eax, dword [esi - 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00401170
mov esi, dword [esp + 0x10]
push esi
push str._n_n__Processing_file:_n____s
call fcn.00403ee8
mov eax, dword [esi - 4]
add esp, 8
cmp eax, edi
jle 0x40186b
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [esp + 0x14]
call fcn.00401170
mov esi, dword [esp + 0x10]
push 0
push esi
call fcn.00401020
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x401884
mov edi, dword [esp + 0x194]
xor ebp, ebp
or eax, 0xffffffff
mov dword [esp + 0x134], ebp
mov dword [esp + 0x168], ebp
mov dword [esp + 0x16c], ebp
mov dword [esp + 0x140], ebp
mov dword [esp + 0x138], ebp
mov byte [esp + 0x164], 0
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
cmp dword [esi - 4], 1
mov byte [esp + 0x2c0], 6
jle 0x4018df
mov edx, dword [esi - 0xc]
push edx
lea ecx, [esp + 0x14]
call fcn.00401170
mov esi, dword [esp + 0x10]
push 1
push ebp
push esi
lea ecx, [esp + 0x30]
call fcn.00402bb0
test eax, eax
jne 0x4018ff
push str._n___Error_opening_executable_
call fcn.00403ee8
add esp, 4
jmp 0x401922
lea ecx, [esp + 0x24]
call fcn.00402370
test eax, eax
jne 0x401967
push str._n___Is_not_a_valid_PE_
call fcn.00403ee8
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00402a90
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c0], 5
call fcn.00402660
lea ecx, [esp + 0x24]
call fcn.00402a90
add esi, 0xfffffff0
mov byte [esp + 0x2c0], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x401bca
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
jmp 0x401bca
mov ebx, dword [esp + 0x2d0]
lea ecx, [esp + 0x24]
call fcn.00402460
cmp eax, 1
je 0x4019b4
lea ecx, [esp + 0x24]
call fcn.00402480
cmp eax, 0x11000000
je 0x4019b4
push str._n__Identified_as_an_executable.
call fcn.00403ee8
mov eax, ebx
add esp, 4
cmp eax, 2
jne 0x4019f1
push str._n__Fixups_will_be_stripped.
call fcn.00403ee8
add esp, 4
mov ebx, 1
jmp 0x4019f1
lea ecx, [esp + 0x24]
call fcn.00402460
cmp eax, 1
jne 0x4019c9
push str._n__Identified_as_a_DLL__module_.
jmp 0x4019ce
push str._n__VB_.NET_app_detected._Not_stripping_fixups.
call fcn.00403ee8
mov eax, dword [esp + 0x2d4]
add esp, 4
cmp eax, 2
jne 0x4019f1
push str._n__Fixups_will_not_be_stripped.
call fcn.00403ee8
add esp, 4
xor ebx, ebx
mov al, byte [esp + 0x2d4]
test al, al
mov eax, str.stripped
jne 0x401a06
mov eax, str.not_stripped
push eax
push str._n__Debug_information_will_be__s.
call fcn.00403ee8
mov ebp, dword [esp + 0x2e0]
push ebp
push ebp
push str._n__File_alignment_will_be_set_to:__X___d_
call fcn.00403ee8
add esp, 0x14
cmp ebp, 0x200
jl 0x401a3f
mov eax, ebp
and eax, 0x8000000f
jns 0x401a3d
dec eax
or eax, 0xfffffff0
inc eax
je 0x401a4c
push str._n___WARNING:_Alignment_may_not_be_valid_for_all_win32_operating_systems.
call fcn.00403ee8
add esp, 4
cmp ebx, 1
jne 0x401a7f
push str._n__Stripping_fixups_...
call fcn.00403ee8
add esp, 4
lea ecx, [esp + 0x24]
call fcn.004029c0
test eax, eax
je 0x401a72
push str._success.
jmp 0x401a77
push str._none_found.
call fcn.00403ee8
add esp, 4
mov al, byte [esp + 0x2d4]
test al, al
je 0x401ab8
push str._n__Stripping_debug_info_...
call fcn.00403ee8
add esp, 4
lea ecx, [esp + 0x24]
call fcn.004029e0
test eax, eax
je 0x401aab
push str._success.
jmp 0x401ab0
push str._none_found.
call fcn.00403ee8
add esp, 4
push ebp
lea ecx, [esp + 0x28]
call fcn.00402780
test eax, eax
jne 0x401b21
push str._n___Error_realigning_executable.
call fcn.00403ee8
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00402a90
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c0], 5
call fcn.00402660
lea ecx, [esp + 0x24]
call fcn.00402a90
add esi, 0xfffffff0
mov byte [esp + 0x2c0], 1
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401bc6
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
jmp 0x401bc6
lea ecx, [esp + 0x24]
call fcn.00402a90
mov eax, dword [esp + 0x2e0]
inc dword [eax]
mov eax, dword [esp + 0x2e4]
add dword [eax], edi
cmp dword [esi - 4], 1
jle 0x401b53
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [esp + 0x14]
call fcn.00401170
mov esi, dword [esp + 0x10]
push 0
push esi
call fcn.00401020
mov ecx, eax
mov eax, dword [esp + 0x2f0]
add dword [eax], ecx
mov eax, ecx
imul eax, eax, 0x64
cdq
idiv edi
mov edx, 0x64
sub edx, eax
push edx
mov eax, edi
sub eax, ecx
push eax
push ecx
push edi
push str._n__Original_size:__d___New_size:__d___Reduced_by:__d_bytes____d___
call fcn.00403ee8
add esp, 0x1c
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c0], 5
call fcn.00402660
lea ecx, [esp + 0x24]
call fcn.00402a90
lea eax, [esi - 0x10]
mov byte [esp + 0x2c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401bc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x174]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401740
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0x2c0], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c0b
mov ecx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov eax, dword [esp + 0x2cc]
add eax, 0xfffffff0
mov dword [esp + 0x2c0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c37
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2b4]
mov al, 1
call fcn.0040352b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret
jmp fcn.00401090