Function at 0x403bb0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x14c
push ebx
mov ebx, dword [esp + 0x154]
test ebx, ebx
push edi
jne 0x403bce
pop edi
xor eax, eax
pop ebx
add esp, 0x14c
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
ja 0x403be8
pop edi
pop ebx
add esp, 0x14c
ret
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x403c10
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x403c10
pop edi
mov eax, 1
pop ebx
add esp, 0x14c
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x18]
mov edx, ecx
mov ecx, 0x50
mov dword [esp + 0x10], edx
add edx, 5
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0xc], ebp
je 0x403dbe
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, dword [str..]
dec edi
lea eax, [esp + 0x1c]
mov dword [edi], ecx
mov dl, byte [0x40740c]
push eax
push ebp
mov byte [edi + 4], dl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x403db3
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x403dac
cmp byte [esp + 0x48], 0x2e
je 0x403d98
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 2]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x403d94
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x407410]
or ecx, 0xffffffff
mov word [edi - 1], ax
lea edi, [esp + 0x48]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [esp + 0x1c], 0x10
je 0x403d6f
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x164]
push eax
push ecx
push ebp
call fcn.00403bb0
add esp, 0xc
jmp 0x403d80
mov edx, dword [esp + 0x168]
push edx
push ebp
call fcn.00403700
add esp, 8
push ebp
call dword [sym.imp.MSVCRT.dll_free]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
add esp, 4
jmp 0x403d98
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403cb3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
pop edi
mov eax, 1
pop ebx
add esp, 0x14c
ret