Function at 0x440020
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a63b4
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x564], edi
mov esi, dword [ebp + 8]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x590], edi
mov dword [ebp - 0x570], esi
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x594], 7
lea edx, [ecx + 2]
mov word [ebp - 0x5a8], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440094
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x5a8]
call fcn.0040cb10
push 2
push 0x5b1e98
lea ecx, [ebp - 0x5a8]
mov dword [ebp - 4], 0
call fcn.0040c880
mov dword [ebp - 0x248], 0
xor ecx, ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x574], 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x258], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x248], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x594]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x440155
mov ecx, dword [ebp - 0x5a8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44014b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x440773
push edx
push ecx
call fcn.0045a8df
add esp, 8
xor eax, eax
mov dword [ebp - 0x598], 0
cmp dword [ebp - 0x244], 8
lea ecx, [ebp - 0x560]
mov word [ebp - 0x5a8], ax
lea eax, [ebp - 0x258]
cmovae eax, dword [ebp - 0x258]
push ecx
push eax
mov dword [ebp - 0x594], 7
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, eax
mov dword [ebp - 0x568], ecx
cmp ecx, 0xffffffff
je 0x440711
nop word [eax + eax]
cmp word [ebp - 0x534], 0x2e
je 0x4406ee
mov eax, dword [ebp - 0x560]
test al, 0x10
je 0x4402cf
call fcn.00408cf0
mov ecx, eax
test ecx, ecx
je 0x440778
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x56c]
call fcn.00407960
test al, al
jne 0x440232
lea eax, [ebp - 0x534]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440210
sub eax, edx
lea ecx, [ebp - 0x56c]
sar eax, 1
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.0040a9f0
mov esi, dword [ebp - 0x56c]
mov byte [ebp - 4], 2
cmp dword [esi - 0xc], 0
jge 0x440247
or edi, 0xffffffff
jmp 0x440264
push str.Microsoft
push esi
call fcn.0056c8db
mov edi, eax
add esp, 8
test edi, edi
jne 0x440260
or edi, 0xffffffff
jmp 0x440264
sub edi, esi
sar edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44027c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0xffffffff
jne 0x4406dc
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0056c750
mov esi, dword [ebp - 0x570]
lea eax, [ebp - 0x534]
add esp, 0xc
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, dword [ebp - 0x564]
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.00440020
jmp 0x4406e8
test al, 2
jne 0x4406ee
test al, 4
jne 0x4406ee
mov ecx, esi
mov dword [ebp - 0x57c], 0
xor eax, eax
mov dword [ebp - 0x578], 7
mov word [ebp - 0x58c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440301
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x58c]
call fcn.0040cb10
push 0x5b22d4
lea eax, [ebp - 0x58c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x5c0]
push eax
call fcn.004033f0
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004033f0
add esp, 0x18
push eax
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 6
call fcn.00463350
lea ecx, [ebp - 0x270]
call fcn.00406670
lea ecx, [ebp - 0x5c0]
call fcn.00406670
lea ecx, [ebp - 0x58c]
call fcn.00406670
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
lea eax, [ebp - 0x5c0]
mov byte [ebp - 4], 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
push eax
lea ecx, [ebp - 0x2a0]
movq qword [ebp - 0x228], xmm0
call fcn.0046af50
push eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 0xd
push eax
call fcn.0044b830
add esp, 8
lea ecx, [ebp - 0x5c0]
mov byte [ebp - 4], 0xf
call fcn.00406620
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
sub ecx, eax
cmp ecx, 2
jb 0x4407a3
cmp byte [eax], 0xff
jne 0x4407a3
cmp byte [eax + 1], 0xfe
jne 0x4407a3
push 0
push 0
push 0
push 0
lea esi, [ecx - 2]
add eax, 2
shr esi, 1
push esi
push eax
push 0
push 0xfde9
mov dword [ebp - 0x56c], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x440782
push 0
push edi
lea ecx, [ebp - 0x58c]
call fcn.00410360
or dword [ebp - 0x574], 2
lea eax, [ebp - 0x58c]
cmp dword [ebp - 0x578], 0x10
push 0
cmovae eax, dword [ebp - 0x58c]
push 0
push edi
push eax
push esi
push dword [ebp - 0x56c]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x240]
call fcn.00406620
movups xmm0, xmmword [ebp - 0x58c]
lea ecx, [ebp - 0x58c]
mov byte [ebp - 0x58c], 0
movups xmmword [ebp - 0x240], xmm0
movq xmm0, qword [ebp - 0x57c]
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x578], 0xf
call fcn.00406620
lea ecx, [ebp - 0x228]
call fcn.0041dc70
push 0x70
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0xb
push 0
push eax
call fcn.0056c750
add esp, 0xc
lea ecx, [ebp - 0x310]
call fcn.0052c9d0
cmp dword [ebp - 0x22c], 0x10
lea eax, [ebp - 0x240]
push 0
cmovae eax, dword [ebp - 0x240]
lea ecx, [ebp - 0x310]
push 0
push eax
mov byte [ebp - 4], 0x11
call fcn.0052fd30
lea ecx, [ebp - 0x310]
call fcn.0052e4d0
test eax, eax
je 0x44067a
push str.Task
lea ecx, [ebp - 0x310]
call fcn.0052e490
test eax, eax
je 0x44067a
push str.Actions
mov ecx, eax
call fcn.0052e490
test eax, eax
je 0x44067a
push str.Exec
mov ecx, eax
call fcn.0052e490
test eax, eax
je 0x44067a
push str.Command
mov ecx, eax
call fcn.0052e490
test eax, eax
je 0x44067a
mov ecx, eax
call fcn.0052e530
mov esi, eax
test esi, esi
je 0x44067a
lea ecx, [ebp - 0x288]
call fcn.0041d2a0
lea eax, [ebp - 0x5c0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0046af30
push eax
lea ecx, [ebp - 0x288]
call fcn.0041ec80
lea ecx, [ebp - 0x5c0]
call fcn.00406670
push 0xfde9
lea eax, [ebp - 0x5c0]
push esi
push eax
call fcn.004815a0
add esp, 0xc
lea ecx, [ebp - 0x270]
push eax
call fcn.0041ec80
lea ecx, [ebp - 0x5c0]
call fcn.00406670
cmp dword [ebp - 0x25c], 8
lea ecx, [ebp - 0x270]
mov edx, dword [ebp - 0x270]
lea edi, [ebp - 0x270]
mov eax, dword [ebp - 0x260]
cmovae ecx, edx
push fcn.0058041e
cmovae edi, edx
push edi
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x270]
cmovae ecx, edx
lea eax, [ebp - 0x5c4]
push ecx
push eax
call fcn.0041bc90
mov edi, dword [ebp - 0x564]
lea eax, [ebp - 0x288]
add esp, 0x14
lea ecx, [edi + 0x2f8]
push eax
call fcn.0044b620
lea ecx, [ebp - 0x288]
call fcn.0041de90
jmp 0x440680
mov edi, dword [ebp - 0x564]
lea ecx, [ebp - 0x310]
call fcn.00406950
lea ecx, [ebp - 0x240]
call fcn.00406620
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 2
call fcn.00406670
jmp 0x4406e2
mov edi, dword [ebp - 0x564]
mov esi, dword [ebp - 0x570]
mov ecx, dword [ebp - 0x568]
lea eax, [ebp - 0x560]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0x568]
test eax, eax
jne 0x4401b0
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x244]
mov esi, dword [edi + 0x2fc]
cmp edx, 8
jb 0x440753
mov ecx, dword [ebp - 0x258]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x440749
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4407c4
push edx
push ecx
call fcn.0045a8df
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret 4
call fcn.0057097a
push 0x80004005
call fcn.00407940
push str.Error_in_WideCharToMultiByte
lea ecx, [ebp - 0x5d0]
call fcn.00406040
push 0x5e1518
lea eax, [ebp - 0x5d0]
push eax
call fcn.0056c336
push str.No_UTF_16_LE_BOM_found
lea ecx, [ebp - 0x5dc]
call fcn.00406040
push 0x5e1518
lea eax, [ebp - 0x5dc]
push eax
call fcn.0056c336
call fcn.0057097a
int3