Function at 0x43fd50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a48c4
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
mov eax, dword [0x5f237c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x564], edi
mov esi, dword [ebp + 8]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x590], edi
mov dword [ebp - 0x570], esi
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x594], 7
lea edx, [ecx + 2]
mov word [ebp - 0x5a8], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43fdc4
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x5a8]
call fcn.0040cb10
push 2
push 0x5afe90
lea ecx, [ebp - 0x5a8]
mov dword [ebp - 4], 0
call fcn.0040c880
mov dword [ebp - 0x248], 0
xor ecx, ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x574], 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x258], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x248], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x594]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x43fe85
mov ecx, dword [ebp - 0x5a8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43fe7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4404a3
push edx
push ecx
call fcn.0045a50f
add esp, 8
xor eax, eax
mov dword [ebp - 0x598], 0
cmp dword [ebp - 0x244], 8
lea ecx, [ebp - 0x560]
mov word [ebp - 0x5a8], ax
lea eax, [ebp - 0x258]
cmovae eax, dword [ebp - 0x258]
push ecx
push eax
mov dword [ebp - 0x594], 7
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, eax
mov dword [ebp - 0x568], ecx
cmp ecx, 0xffffffff
je 0x440441
nop word [eax + eax]
cmp word [ebp - 0x534], 0x2e
je 0x44041e
mov eax, dword [ebp - 0x560]
test al, 0x10
je 0x43ffff
call fcn.00408cf0
mov ecx, eax
test ecx, ecx
je 0x4404a8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x56c]
call fcn.00407960
test al, al
jne 0x43ff62
lea eax, [ebp - 0x534]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43ff40
sub eax, edx
lea ecx, [ebp - 0x56c]
sar eax, 1
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.0040a9f0
mov esi, dword [ebp - 0x56c]
mov byte [ebp - 4], 2
cmp dword [esi - 0xc], 0
jge 0x43ff77
or edi, 0xffffffff
jmp 0x43ff94
push str.Microsoft
push esi
call fcn.0056ae4b
mov edi, eax
add esp, 8
test edi, edi
jne 0x43ff90
or edi, 0xffffffff
jmp 0x43ff94
sub edi, esi
sar edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43ffac
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0xffffffff
jne 0x44040c
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0056acc0
mov esi, dword [ebp - 0x570]
lea eax, [ebp - 0x534]
add esp, 0xc
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, dword [ebp - 0x564]
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.0043fd50
jmp 0x440418
test al, 2
jne 0x44041e
test al, 4
jne 0x44041e
mov ecx, esi
mov dword [ebp - 0x57c], 0
xor eax, eax
mov dword [ebp - 0x578], 7
mov word [ebp - 0x58c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440031
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x58c]
call fcn.0040cb10
push 0x5b02d4
lea eax, [ebp - 0x58c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x5c0]
push eax
call fcn.004033f0
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004033f0
add esp, 0x18
push eax
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 6
call fcn.00462f80
lea ecx, [ebp - 0x270]
call fcn.00406670
lea ecx, [ebp - 0x5c0]
call fcn.00406670
lea ecx, [ebp - 0x58c]
call fcn.00406670
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
lea eax, [ebp - 0x5c0]
mov byte [ebp - 4], 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
push eax
lea ecx, [ebp - 0x2a0]
movq qword [ebp - 0x228], xmm0
call fcn.0046ab80
push eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 0xd
push eax
call fcn.0044b470
add esp, 8
lea ecx, [ebp - 0x5c0]
mov byte [ebp - 4], 0xf
call fcn.00406620
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
sub ecx, eax
cmp ecx, 2
jb 0x4404d3
cmp byte [eax], 0xff
jne 0x4404d3
cmp byte [eax + 1], 0xfe
jne 0x4404d3
push 0
push 0
push 0
push 0
lea esi, [ecx - 2]
add eax, 2
shr esi, 1
push esi
push eax
push 0
push 0xfde9
mov dword [ebp - 0x56c], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x4404b2
push 0
push edi
lea ecx, [ebp - 0x58c]
call fcn.00410360
or dword [ebp - 0x574], 2
lea eax, [ebp - 0x58c]
cmp dword [ebp - 0x578], 0x10
push 0
cmovae eax, dword [ebp - 0x58c]
push 0
push edi
push eax
push esi
push dword [ebp - 0x56c]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x240]
call fcn.00406620
movups xmm0, xmmword [ebp - 0x58c]
lea ecx, [ebp - 0x58c]
mov byte [ebp - 0x58c], 0
movups xmmword [ebp - 0x240], xmm0
movq xmm0, qword [ebp - 0x57c]
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x578], 0xf
call fcn.00406620
lea ecx, [ebp - 0x228]
call fcn.0041dc60
push 0x70
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0xb
push 0
push eax
call fcn.0056acc0
add esp, 0xc
lea ecx, [ebp - 0x310]
call fcn.0052af60
cmp dword [ebp - 0x22c], 0x10
lea eax, [ebp - 0x240]
push 0
cmovae eax, dword [ebp - 0x240]
lea ecx, [ebp - 0x310]
push 0
push eax
mov byte [ebp - 4], 0x11
call fcn.0052e2c0
lea ecx, [ebp - 0x310]
call fcn.0052ca60
test eax, eax
je 0x4403aa
push str.Task
lea ecx, [ebp - 0x310]
call fcn.0052ca20
test eax, eax
je 0x4403aa
push str.Actions
mov ecx, eax
call fcn.0052ca20
test eax, eax
je 0x4403aa
push str.Exec
mov ecx, eax
call fcn.0052ca20
test eax, eax
je 0x4403aa
push str.Command
mov ecx, eax
call fcn.0052ca20
test eax, eax
je 0x4403aa
mov ecx, eax
call fcn.0052cac0
mov esi, eax
test esi, esi
je 0x4403aa
lea ecx, [ebp - 0x288]
call fcn.0041d290
lea eax, [ebp - 0x5c0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0046ab60
push eax
lea ecx, [ebp - 0x288]
call fcn.0041ec70
lea ecx, [ebp - 0x5c0]
call fcn.00406670
push 0xfde9
lea eax, [ebp - 0x5c0]
push esi
push eax
call fcn.004811c0
add esp, 0xc
lea ecx, [ebp - 0x270]
push eax
call fcn.0041ec70
lea ecx, [ebp - 0x5c0]
call fcn.00406670
cmp dword [ebp - 0x25c], 8
lea ecx, [ebp - 0x270]
mov edx, dword [ebp - 0x270]
lea edi, [ebp - 0x270]
mov eax, dword [ebp - 0x260]
cmovae ecx, edx
push fcn.0057e98e
cmovae edi, edx
push edi
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x270]
cmovae ecx, edx
lea eax, [ebp - 0x5c4]
push ecx
push eax
call fcn.0041bc90
mov edi, dword [ebp - 0x564]
lea eax, [ebp - 0x288]
add esp, 0x14
lea ecx, [edi + 0x2f8]
push eax
call fcn.0044b260
lea ecx, [ebp - 0x288]
call fcn.0041de80
jmp 0x4403b0
mov edi, dword [ebp - 0x564]
lea ecx, [ebp - 0x310]
call fcn.00406950
lea ecx, [ebp - 0x240]
call fcn.00406620
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 2
call fcn.00406670
jmp 0x440412
mov edi, dword [ebp - 0x564]
mov esi, dword [ebp - 0x570]
mov ecx, dword [ebp - 0x568]
lea eax, [ebp - 0x560]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0x568]
test eax, eax
jne 0x43fee0
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x244]
mov esi, dword [edi + 0x2fc]
cmp edx, 8
jb 0x440483
mov ecx, dword [ebp - 0x258]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x440479
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4404f4
push edx
push ecx
call fcn.0045a50f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a51d
mov esp, ebp
pop ebp
ret 4
call fcn.0056eeea
push 0x80004005
call fcn.00407940
push str.Error_in_WideCharToMultiByte
lea ecx, [ebp - 0x5d0]
call fcn.00406040
push 0x5df2a0
lea eax, [ebp - 0x5d0]
push eax
call fcn.0056a89c
push str.No_UTF_16_LE_BOM_found
lea ecx, [ebp - 0x5dc]
call fcn.00406040
push 0x5df2a0
lea eax, [ebp - 0x5dc]
push eax
call fcn.0056a89c
call fcn.0056eeea
int3