Function at 0x417dd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x402516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x25c
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401898
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 0x11
push 0x4066ac
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov dword [ebp - 4], 2
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00418800
mov edx, eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x28]
push edx
call fcn.00418960
movsx eax, ax
test eax, eax
jne 0x417e7b
jmp 0x418771
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x406658
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x1fc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x184]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 8
cmp dword [ebp - 0x2c], 0xffffffff
je 0x418295
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x220], ecx
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x1fc], edx
lea eax, [ebp - 0x1fc]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1c8], 0x6011
push 0x409
push 0x40
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0x198]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcStrConvVar2]
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x184]
push ecx
call fcn.00416b50
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x198]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0xb
mov edx, dword [ebp - 0x30]
push edx
push 0x406668
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [ebp - 0x30]
push eax
push 0x406670
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
or esi, eax
test esi, esi
jne 0x418264
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x28]
push ecx
push 0x4062f8
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x180]
and eax, 0x10
test eax, eax
jne 0x41814b
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x40], 0
jne 0x418054
lea ecx, [ebp - 0x40]
push ecx
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea edx, [ebp - 0x40]
mov dword [ebp - 0x248], edx
jmp 0x41805d
lea eax, [ebp - 0x40]
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx]
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x1b0], 0x80020004
mov dword [ebp - 0x1b8], 0xa
mov dword [ebp - 0x1a0], 0x80020004
mov dword [ebp - 0x1a8], 0xa
mov dword [ebp - 0x190], 0x80020004
mov dword [ebp - 0x198], 0xa
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1c8], 0x4008
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
mov edx, dword [ebp - 0x200]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x200]
push ecx
call dword [eax + 0x20]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x41811c
push 0x20
push 0x406688
mov edx, dword [ebp - 0x200]
push edx
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x24c], eax
jmp 0x418126
mov dword [ebp - 0x24c], 0
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x198]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
jmp 0x418264
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x38], 0
jne 0x418172
lea ecx, [ebp - 0x38]
push ecx
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x250], edx
jmp 0x41817b
lea eax, [ebp - 0x38]
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx]
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x1b0], 0x80020004
mov dword [ebp - 0x1b8], 0xa
mov dword [ebp - 0x1a0], 0x80020004
mov dword [ebp - 0x1a8], 0xa
mov dword [ebp - 0x190], 0x80020004
mov dword [ebp - 0x198], 0xa
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1c8], 0x4008
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
mov edx, dword [ebp - 0x200]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x200]
push ecx
call dword [eax + 0x20]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x41823a
push 0x20
push 0x406688
mov edx, dword [ebp - 0x200]
push edx
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x254], eax
jmp 0x418244
mov dword [ebp - 0x254], 0
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x198]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
mov dword [ebp - 0x1fc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
cmp dword [ebp - 0x1fc], 0
jne 0x417efa
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x40], 0
jne 0x4182cd
lea ecx, [ebp - 0x40]
push ecx
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea edx, [ebp - 0x40]
mov dword [ebp - 0x258], edx
jmp 0x4182d6
lea eax, [ebp - 0x40]
mov dword [ebp - 0x258], eax
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx]
mov dword [ebp - 0x200], edx
lea eax, [ebp - 0x1fc]
push eax
mov ecx, dword [ebp - 0x200]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x200]
push eax
call dword [edx + 0x24]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x418331
push 0x24
push 0x406688
mov ecx, dword [ebp - 0x200]
push ecx
mov edx, dword [ebp - 0x204]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x25c], eax
jmp 0x41833b
mov dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x208], 1
mov dword [ebp - 0x24], 1
jmp 0x418366
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x208]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x20c]
jg 0x418546
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x40], 0
jne 0x41839c
lea eax, [ebp - 0x40]
push eax
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x260], ecx
jmp 0x4183a5
lea edx, [ebp - 0x40]
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
mov dword [ebp - 0x200], ecx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x1c8], 0x4003
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
mov edx, dword [ebp - 0x200]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x200]
push ecx
call dword [eax + 0x1c]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x41841a
push 0x1c
push 0x406688
mov edx, dword [ebp - 0x200]
push edx
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x264], eax
jmp 0x418424
mov dword [ebp - 0x264], 0
push 0
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0x184]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcSetFileAttr]
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x198]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x40], 0
jne 0x418480
lea eax, [ebp - 0x40]
push eax
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x268], ecx
jmp 0x418489
lea edx, [ebp - 0x40]
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax]
mov dword [ebp - 0x200], ecx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x1c8], 0x4003
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
mov edx, dword [ebp - 0x200]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x200]
push ecx
call dword [eax + 0x1c]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x4184fe
push 0x1c
push 0x406688
mov edx, dword [ebp - 0x200]
push edx
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x26c], eax
jmp 0x418508
mov dword [ebp - 0x26c], 0
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0x184]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
call fcn.00418ad0
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x198]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x19
jmp 0x41835a
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x38], 0
jne 0x41856d
lea eax, [ebp - 0x38]
push eax
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x270], ecx
jmp 0x418576
lea edx, [ebp - 0x38]
mov dword [ebp - 0x270], edx
mov eax, dword [ebp - 0x270]
mov ecx, dword [eax]
mov dword [ebp - 0x200], ecx
lea edx, [ebp - 0x1fc]
push edx
mov eax, dword [ebp - 0x200]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x200]
push edx
call dword [ecx + 0x24]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x4185d1
push 0x24
push 0x406688
mov eax, dword [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x204]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x274], eax
jmp 0x4185db
mov dword [ebp - 0x274], 0
mov edx, dword [ebp - 0x1fc]
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x24], 1
jmp 0x418606
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x210]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x214]
jg 0x418704
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x38], 0
jne 0x41863c
lea edx, [ebp - 0x38]
push edx
push 0x406698
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x278], eax
jmp 0x418645
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov dword [ebp - 0x200], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x1c8], 0x4003
lea edx, [ebp - 0x198]
push edx
lea eax, [ebp - 0x1c8]
push eax
mov ecx, dword [ebp - 0x200]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x200]
push eax
call dword [edx + 0x1c]
fnclex
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jge 0x4186ba
push 0x1c
push 0x406688
mov ecx, dword [ebp - 0x200]
push ecx
mov edx, dword [ebp - 0x204]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x27c], eax
jmp 0x4186c4
mov dword [ebp - 0x27c], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x184]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
call fcn.00417dd0
lea ecx, [ebp - 0x184]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x198]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x1c
jmp 0x4185fa
mov dword [ebp - 4], 0x1d
movsx edx, word [ebp + 0xc]
test edx, edx
je 0x418755
mov dword [ebp - 4], 0x1e
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 0x1f
push 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcSetFileAttr]
mov dword [ebp - 4], 0x20
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcRemoveDir]
mov dword [ebp - 4], 0x21
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 0x23
mov word [ebp - 0x34], 0xffff
jmp 0x418771
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x4187e6
jmp 0x4187b8
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
ret