Function at 0x402875
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2d8
mov byte [ebp - 0x246], 0
push dword [ebp + 8]
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
call sub.user32.dll_CharLowerA
push eax
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x405eb4
call sub.user32.dll_CharLowerA
push eax
push 0x405eb4
call sub.kernel32.dll_lstrcpyA
push 0x405eb4
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x4028db
leave
ret 4
nop
push edi
push 0x4067e4
call sub.kernel32.dll_lstrlenA
mov edi, 0
jmp 0x4028f6
mov byte [edi + 0x4067e4], 0
inc edi
cmp edi, eax
jbe 0x4028ee
mov al, byte [ebp - 0x246]
mov byte [0x4067e4], al
mov al, byte [ebp - 0x245]
mov byte [0x4067e5], al
mov al, byte [ebp - 0x244]
mov byte [0x4067e6], al
push str.Program_Files
call sub.user32.dll_CharLowerA
push eax
push str.Program_Files
call sub.kernel32.dll_lstrcpyA
push str.Program_Files
push 0x4067e4
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
push 0x4067e4
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x402959
pop edi
leave
ret 4
push 0x4067e4
call sub.kernel32.dll_lstrlenA
mov edi, 0
jmp 0x402972
mov byte [edi + 0x4067e4], 0
inc edi
cmp edi, eax
jbe 0x40296a
mov al, byte [ebp - 0x246]
mov byte [0x4067e4], al
mov al, byte [ebp - 0x245]
mov byte [0x4067e5], al
mov al, byte [ebp - 0x244]
mov byte [0x4067e6], al
push str.Documents_and_Settings
call sub.user32.dll_CharLowerA
push eax
push str.Documents_and_Settings
call sub.kernel32.dll_lstrcpyA
push str.Documents_and_Settings
push 0x4067e4
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
push 0x4067e4
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x4029d5
pop edi
leave
ret 4
pop edi
push str..
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x142]
push eax
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402a0f
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
leave
ret 4
mov dword [ebp - 0x350], 1
jmp 0x402adb
lea eax, [ebp - 0x116]
push eax
lea eax, [ebp - 0x34a]
push eax
call sub.kernel32.dll_lstrcpyA
mov byte [ebp - 0xb20], 0
push dword [ebp + 8]
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
push 0x405034
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x34a]
push eax
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
test dword [ebp - 0x142], 0x10
je 0x402a8e
cmp byte [ebp - 0x116], 0x2e
je 0x402abf
lea eax, [ebp - 0xb20]
push eax
call fcn.00402875
jmp 0x402abf
lea eax, [ebp - 0xb20]
push eax
call sub.shlwapi.dll_PathFindExtensionA
push eax
push str..exe
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x402abf
lea eax, [ebp - 0xb20]
push eax
push 0x405190
call sub.kernel32.dll_lstrcpyA
call fcn.004027a5
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x142]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_FindNextFileA
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x402a1e
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
leave
ret 4