Function at 0x40289d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2d8
mov byte [ebp - 0x246], 0
push dword [ebp + 8]
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
call sub.user32.dll_CharLowerA
push eax
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x405ea4
call sub.user32.dll_CharLowerA
push eax
push 0x405ea4
call sub.kernel32.dll_lstrcpyA
push 0x405ea4
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x402903
leave
ret 4
nop
push edi
push 0x4067d4
call sub.kernel32.dll_lstrlenA
mov edi, 0
jmp 0x40291e
mov byte [edi + 0x4067d4], 0
inc edi
cmp edi, eax
jbe 0x402916
mov al, byte [ebp - 0x246]
mov byte [0x4067d4], al
mov al, byte [ebp - 0x245]
mov byte [0x4067d5], al
mov al, byte [ebp - 0x244]
mov byte [0x4067d6], al
push str.Program_Files
call sub.user32.dll_CharLowerA
push eax
push str.Program_Files
call sub.kernel32.dll_lstrcpyA
push str.Program_Files
push 0x4067d4
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
push 0x4067d4
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x402981
pop edi
leave
ret 4
push 0x4067d4
call sub.kernel32.dll_lstrlenA
mov edi, 0
jmp 0x40299a
mov byte [edi + 0x4067d4], 0
inc edi
cmp edi, eax
jbe 0x402992
mov al, byte [ebp - 0x246]
mov byte [0x4067d4], al
mov al, byte [ebp - 0x245]
mov byte [0x4067d5], al
mov al, byte [ebp - 0x244]
mov byte [0x4067d6], al
push str.Documents_and_Settings
call sub.user32.dll_CharLowerA
push eax
push str.Documents_and_Settings
call sub.kernel32.dll_lstrcpyA
push str.Documents_and_Settings
push 0x4067d4
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
push 0x4067d4
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x4029fd
pop edi
leave
ret 4
pop edi
push str..
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x142]
push eax
lea eax, [ebp - 0x246]
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402a37
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
leave
ret 4
mov dword [ebp - 0x350], 1
jmp 0x402b03
lea eax, [ebp - 0x116]
push eax
lea eax, [ebp - 0x34a]
push eax
call sub.kernel32.dll_lstrcpyA
mov byte [ebp - 0xb20], 0
push dword [ebp + 8]
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
push 0x405034
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x34a]
push eax
lea eax, [ebp - 0xb20]
push eax
call sub.kernel32.dll_lstrcatA
test dword [ebp - 0x142], 0x10
je 0x402ab6
cmp byte [ebp - 0x116], 0x2e
je 0x402ae7
lea eax, [ebp - 0xb20]
push eax
call fcn.0040289d
jmp 0x402ae7
lea eax, [ebp - 0xb20]
push eax
call sub.shlwapi.dll_PathFindExtensionA
push eax
push str..exe
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x402ae7
lea eax, [ebp - 0xb20]
push eax
push 0x405180
call sub.kernel32.dll_lstrcpyA
call fcn.004027cd
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x142]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_FindNextFileA
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x402a46
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
leave
ret 4