Function at 0x401000
Capabilities:
Create process on windows
Enumerate files on windows
Get common file path
Get file attributes
Set current directory

Disassembly:
push section..data
call sub.KERNEL32.dll_SetCurrentDirectoryA
push 0x40324c
push 0x100
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x40324c
call fcn.004014b8
push 0x403242
call fcn.004014b8
push 0x403100
push 0x403245
call sub.KERNEL32.dll_FindFirstFileA
mov dword [0x40323e], eax
push 0x40312c
push 0x40344c
call dword [sym.imp.msvcrt.dll__stricmp]
or eax, eax
jne 0x401067
push 0x403100
push dword [0x40323e]
call sub.KERNEL32.dll_FindNextFileA
jmp 0x401041
push 0x40312c
push 0x40344e
call dword [sym.imp.msvcrt.dll__stricmp]
or eax, eax
jne 0x40108d
push 0x403100
push dword [0x40323e]
call sub.KERNEL32.dll_FindNextFileA
jmp 0x401041
push 0x40312c
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0x10
je 0x4010a6
cmp eax, 4
je 0x4010a6
cmp eax, 2
jne 0x4010ea
push 0x40312c
call sub.KERNEL32.dll_SetCurrentDirectoryA
call 0x4011f8
push str.Done_Subfolder__Now_Back_To_Parent_Directory_r_n
call fcn.004014b8
push 0x40324c
call sub.KERNEL32.dll_SetCurrentDirectoryA
xor eax, eax
push 0x403100
push dword [0x40323e]
call sub.KERNEL32.dll_FindNextFileA
push 0x40312c
call fcn.004014b8
jmp 0x401041
push 0x40352a
push 0x100
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x40362a
push 0x40352a
call sub.KERNEL32.dll_lstrcatA
push 0x40312c
push 0x40352a
call sub.KERNEL32.dll_lstrcatA
call fcn.0040135c
push 0x40363e
push 0x40352a
call sub.KERNEL32.dll_lstrcpyA
push 0x403242
call fcn.004014b8
push 0x403100
push dword [0x40323e]
call sub.KERNEL32.dll_FindNextFileA
cmp eax, 0
jne 0x401041
push 0x403242
call fcn.004014b8
push str.Done__All_files_have_been_printed_in_the_directory:
call fcn.004014b8
push 0x40324c
call fcn.004014b8
push 0x104
push 0x403877
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x104
push 0x403773
push 0x403877
call sub.KERNEL32.dll_GetShortPathNameA
push 0x403773
push 0x403773
push str.:loc_r_ndel___s__r_nif_exist___s__goto_loc_r_ndel___0
push 0x403877
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov esi, eax
push str..bat
push 0x403773
call sub.KERNEL32.dll_lstrcatA
push 0
push 0x403773
call sub.KERNEL32.dll__lcreat
mov ebx, eax
push esi
push 0x403877
push ebx
call sub.KERNEL32.dll__lwrite
push ebx
call sub.KERNEL32.dll__lclose
push 0
push 0x403773
call sub.KERNEL32.dll_WinExec
push 0
call sub.KERNEL32.dll_ExitProcess
push 0
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffebc
mov dword [0x403248], 0
lea eax, [ebp - 0x142]
push eax
push 0x403245
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [0x403248], 5
jne 0x40122a
leave
ret
lea eax, [ebp - 0x116]
push eax
push 0x40344c
call dword [sym.imp.msvcrt.dll__stricmp]
or eax, eax
jne 0x401257
inc dword [0x403248]
lea eax, [ebp - 0x142]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
jmp 0x40121f
lea eax, [ebp - 0x116]
push eax
push 0x40344e
call dword [sym.imp.msvcrt.dll__stricmp]
or eax, eax
jne 0x40129e
inc dword [0x403248]
push 0x403b83
push dword [0x403248]
call fcn.00401450
push 0x403b83
call fcn.004014b8
lea eax, [ebp - 0x142]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
jmp 0x40121f
lea eax, [ebp - 0x116]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0x10
je 0x4012b9
cmp eax, 4
je 0x4012b9
cmp eax, 2
jne 0x4012ed
lea edx, [ebp - 0x116]
push edx
call sub.KERNEL32.dll_SetCurrentDirectoryA
call 0x4011f8
mov dword [0x403248], 0
push 0x40344e
call sub.KERNEL32.dll_SetCurrentDirectoryA
lea edx, [ebp - 0x142]
push edx
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
push 0x40352a
push 0x100
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x40362a
push 0x40352a
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x116]
push eax
push 0x40352a
call sub.KERNEL32.dll_lstrcatA
call fcn.0040135c
push 0x40363e
push 0x40352a
call sub.KERNEL32.dll_lstrcpyA
push 0x403242
call fcn.004014b8
lea eax, [ebp - 0x142]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
cmp eax, 0
jne 0x40121f
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
leave
ret