Function at 0x40cd70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2bc
lea esi, [esp + 0x60]
mov ebp, dword [esp + 0x2e0]
mov dword [esp], 0x418aa0
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
cmp eax, 0xffffffff
je 0x40d0f0
mov edi, eax
rdtsc
mov ecx, eax
shrd ecx, edx, 0x1a
cmp dword [0x419a9c], ecx
jne 0x40d0c5
lea ebx, [esp + 0x8c]
mov dword [esp + 0x2e0], ebp
jmp 0x40cf48
mov dword [esp + 4], 0
mov dword [esp], 0x4184a0
call fcn.004035f0
test eax, eax
jg 0x40d0e0
mov dword [esp + 4], 0
mov eax, dword [0x4184b0]
mov dword [esp + 8], 0
mov dword [esp], 0x4184a0
mov dword [esp + 0x28], eax
call fcn.004033e0
test eax, eax
jg 0x40d0e0
mov dword [esp + 4], 0xffffffff
mov edx, dword [0x4184b0]
mov dword [esp], 0x4184a0
mov dword [esp + 0x2c], edx
call fcn.004034a0
test eax, eax
jg 0x40d0e0
mov dword [esp + 8], 0x7d0
mov dword [esp + 4], ebx
mov dword [esp], 0x4184a0
call fcn.004036a0
test eax, eax
jg 0x40d0e0
mov dword [esp + 4], ebx
mov dword [esp], 0x418aa0
call fcn.00401ed0
mov eax, dword [esp + 0x2e0]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add byte [eax], 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x48]
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.0040cd70
test eax, eax
jne 0x40d0e0
mov eax, dword [esp + 0x2e0]
sub byte [eax], 1
mov dword [esp], 0x418aa0
call fcn.00401f30
mov ecx, dword [esp + 0x2d8]
mov ebp, dword [esp + 0x2d4]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
add dword [ecx], eax
adc dword [ecx + 4], edx
mov ecx, dword [esp + 0x40]
add dword [ebp], ecx
mov ecx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2d0]
add ecx, 1
add dword [ebp], ecx
mov ecx, dword [0x4184a0]
mov ebp, dword [esp + 0x28]
mov dword [ecx + ebp], eax
mov eax, dword [esp + 0x44]
mov dword [ecx + ebp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + edx], eax
nop
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x40d0a9
mov dword [esp + 4], 0x4121da
mov dword [esp], ebx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x40cf30
mov dword [esp + 4], 0x4121de
mov dword [esp], ebx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x40cf30
test byte [esp + 0x60], 2
jne 0x40cf30
mov dword [esp], 0x4184a0
call fcn.004032b0
test eax, eax
jg 0x40d0e0
mov eax, dword [esp + 0x2e0]
movzx eax, byte [eax]
mov dword [esp], 0x4184a0
mov dword [esp + 4], eax
call fcn.004035f0
test eax, eax
jg 0x40d0e0
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x54], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
sub esp, 8
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp], 0x4184a0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00403870
test eax, eax
jg 0x40d0e0
test byte [esp + 0x60], 0x10
jne 0x40cdd0
mov dword [esp + 4], 2
mov dword [esp], 0x4184a0
call fcn.004035f0
test eax, eax
jg 0x40d0e0
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x2d8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
add dword [ecx], eax
adc dword [ecx + 4], edx
mov ecx, dword [esp + 0x2d4]
add dword [ecx], 1
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0x4184a0
call fcn.004033e0
test eax, eax
jg 0x40d0e0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], 0x4184a0
call fcn.004033e0
test eax, eax
jg 0x40d0e0
mov dword [esp + 8], 0x7d0
mov dword [esp + 4], ebx
mov dword [esp], 0x4184a0
call fcn.004036a0
test eax, eax
jle 0x40cf30
mov eax, dword [esp + 0x2dc]
mov edx, dword [0x4184b0]
mov dword [eax], edx
add esp, 0x2bc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x419a9c], ecx
call fcn.0040a930
call fcn.0040be80
jmp 0x40cdb8
add esp, 0x2bc
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2bc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret