Function at 0x41df50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x348
lea eax, [esp + 0x140]
push ebx
push ebp
mov ebp, dword [esp + 0x354]
push esi
push edi
push 0x104
push ebp
push eax
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x150]
push 0x5c
push ecx
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x41df8e
mov cl, byte [eax + 1]
test cl, cl
je 0x41dfa5
push 0x104
lea edx, [esp + 0x154]
push 0x494fdc
push edx
call sub.Storm.dll_Ordinal_503
mov ebx, dword [esp + 0x360]
push 0x104
lea eax, [esp + 0x154]
push ebx
push eax
call sub.Storm.dll_Ordinal_503
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x150]
push ecx
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x41e04c
mov al, byte [esp + 0x10]
test al, 2
jne 0x41e035
test al, 0x10
je 0x41e00d
cmp byte [esp + 0x3c], 0x2e
jne 0x41e002
mov al, byte [esp + 0x3d]
test al, al
je 0x41e035
cmp al, 0x2e
jne 0x41e002
mov al, byte [esp + 0x3e]
test al, al
je 0x41e035
mov eax, dword [esp + 0x368]
test eax, eax
je 0x41e035
mov eax, dword [esp + 0x374]
mov ecx, dword [esp + 0x370]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push ebp
call dword [esp + 0x374]
add esp, 0x10
test eax, eax
je 0x41e1bb
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41dfdb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x36c]
test ebp, ebp
je 0x41e1d6
mov ecx, dword [esp + 0x35c]
push 0x104
lea edx, [esp + 0x154]
push ecx
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [esp + 0x150]
push 0x5c
push eax
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x41e08f
mov cl, byte [eax + 1]
test cl, cl
je 0x41e0a6
push 0x104
lea ecx, [esp + 0x154]
push 0x494fdc
push ecx
call sub.Storm.dll_Ordinal_503
push 0x104
lea edx, [esp + 0x154]
push 0x4965d0
push edx
call sub.Storm.dll_Ordinal_503
lea eax, [esp + 0x10]
lea ecx, [esp + 0x150]
push eax
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x41e1d6
mov al, byte [esp + 0x10]
test al, 2
jne 0x41e1a6
test al, 0x10
je 0x41e1a6
cmp byte [esp + 0x3c], 0x2e
jne 0x41e10e
mov al, byte [esp + 0x3d]
test al, al
je 0x41e1a6
cmp al, 0x2e
jne 0x41e10e
mov al, byte [esp + 0x3e]
test al, al
je 0x41e1a6
mov edx, dword [esp + 0x35c]
push 0x104
lea eax, [esp + 0x258]
push edx
push eax
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x254]
push 0x5c
push ecx
call sub.Storm.dll_Ordinal_572
test eax, eax
je 0x41e142
mov cl, byte [eax + 1]
test cl, cl
je 0x41e159
push 0x104
lea edx, [esp + 0x258]
push 0x494fdc
push edx
call sub.Storm.dll_Ordinal_503
lea eax, [esp + 0x3c]
push 0x104
lea ecx, [esp + 0x258]
push eax
push ecx
call sub.Storm.dll_Ordinal_503
mov edx, dword [esp + 0x374]
mov eax, dword [esp + 0x370]
mov ecx, dword [esp + 0x368]
push edx
mov edx, dword [esp + 0x368]
push eax
push ebp
push ecx
push edx
lea eax, [esp + 0x268]
push ebx
push eax
call fcn.0041df50
add esp, 0x1c
test eax, eax
je 0x41e1bb
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x41e1cf
jmp 0x41e0d7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x348
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x348
ret