Function at 0x401780
Capabilities:
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xa88
lea ecx, [esp + 0x678]
lea eax, [esp + 0x678]
push ebx
push ebp
push esi
push edi
mov ebx, 1
mov esi, 0x208
sub edx, ecx
mov cx, word [edx + eax]
test cx, cx
je 0x4017bc
mov word [eax], cx
add eax, 2
dec esi
jne 0x4017a8
jmp 0x4017c0
test esi, esi
jne 0x4017c3
sub eax, 2
lea edx, [esp + 0x10]
mov word [eax], 0
push edx
lea eax, [esp + 0x68c]
push 0x208
push eax
call fcn.00401650
test eax, eax
jl 0x401801
mov eax, dword [esp + 0x10]
mov ecx, 0x208
sub ecx, eax
push 0x4092c4
lea edx, [esp + eax*2 + 0x68c]
push ecx
push edx
call fcn.00401550
lea eax, [esp + 0x230]
lea ecx, [esp + 0x688]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x20], esi
jne 0x401836
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa88
ret
lea edx, [esp + 0x230]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x401b05
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
test byte [esp + 0x230], 0x10
je 0x40197a
lea eax, [esp + 0x25c]
push 0x4092c0
push eax
call fcn.0040216c
add esp, 8
test eax, eax
je 0x401aea
lea ecx, [esp + 0x25c]
push 0x4092b8
push ecx
call fcn.0040216c
add esp, 8
test eax, eax
je 0x401aea
test byte [esp + 0x230], 0x10
je 0x40197a
mov edx, dword [esp + 0xa9c]
lea eax, [esp + 0x480]
push edx
push 0x208
push eax
call fcn.00401550
lea ecx, [esp + 0x10]
lea edx, [esp + 0x480]
push ecx
push 0x208
push edx
call fcn.00401650
test eax, eax
jl 0x401902
mov eax, dword [esp + 0x10]
mov ecx, 0x208
sub ecx, eax
push 0x4092b4
lea edx, [esp + eax*2 + 0x484]
push ecx
push edx
call fcn.00401550
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x480]
push eax
push 0x208
push ecx
call fcn.00401650
test eax, eax
jl 0x40193e
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x25c]
mov ecx, 0x208
push edx
sub ecx, eax
lea edx, [esp + eax*2 + 0x484]
push ecx
push edx
call fcn.00401550
mov eax, dword [esp + 0xaa8]
mov ecx, dword [esp + 0xaa4]
mov edx, dword [esp + 0xaa0]
push eax
push ecx
lea eax, [esp + 0x488]
push edx
push eax
call fcn.00401780
add esp, 0x10
test eax, eax
jne 0x40196c
xor ebx, ebx
test byte [esp + 0x230], 0x10
jne 0x401aea
mov ecx, dword [esp + 0xa9c]
lea edx, [esp + 0x28]
push ecx
push 0x208
push edx
call fcn.00401550
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push 0x208
push ecx
call fcn.00401650
test eax, eax
jl 0x4019c4
mov eax, dword [esp + 0x14]
mov edx, 0x208
sub edx, eax
push 0x4092b4
lea eax, [esp + eax*2 + 0x2c]
push edx
push eax
call fcn.00401550
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
push 0x208
push edx
call fcn.00401650
test eax, eax
jl 0x4019fa
lea eax, [esp + 0x25c]
mov ecx, 0x208
push eax
mov eax, dword [esp + 0x1c]
sub ecx, eax
lea edx, [esp + eax*2 + 0x2c]
push ecx
push edx
call fcn.00401550
lea eax, [esp + 0x28]
push eax
call fcn.004020d4
mov ecx, dword [esp + 0xaa8]
mov esi, eax
push ecx
call fcn.004020d4
push esi
push eax
call fcn.00402093
add esp, 0x10
test eax, eax
jne 0x401aea
mov eax, dword [esp + 0xaa8]
cmp eax, 2
jne 0x401a53
mov eax, dword [esp + 0xaa0]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00401b20
add esp, 8
test eax, eax
je 0x401829
jmp 0x401aea
cmp eax, 1
jne 0x401aea
mov edx, dword [esp + 0xaa0]
lea ecx, [esp + 0x28]
push ecx
push edx
call fcn.00401d10
add esp, 8
test eax, eax
jne 0x401aea
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push 0x409294
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x401aea
push 2
push ebx
push ebx
push esi
call ebp
lea eax, [esp + 0x28]
lea ecx, [esp + 0x890]
push eax
push 0x409250
push 0x208
push ecx
call fcn.004014e0
add esp, 0x10
lea edx, [esp + 0x24]
lea eax, [esp + 0x890]
push ebx
push edx
push eax
call fcn.00402076
add esp, 4
lea ecx, [esp + 0x898]
shl eax, 1
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x230]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401859
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xa88
ret