Function at 0x10001099
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x10021f34
call fcn.10021c80
sub esp, 0x444
lea ecx, [ebp - 0x444]
call fcn.100028a7
and dword [ebp - 4], 0
and dword [0x100343e0], 0
and dword [ebp - 0x224], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
and dword [ebp - 0x228], 0
and dword [ebp - 0x10], 0
and dword [0x1004162c], 0
and dword [ebp - 0x43c], 0
jmp 0x100010f6
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x43c]
cmp eax, dword [0x10035b08]
jge 0x1000142b
cmp dword [ebp - 0x10], 0
jne 0x1000142b
mov eax, dword [ebp - 0x43c]
imul eax, eax, 0x20a
add eax, 0x100388dc
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
push 0x5c
lea eax, [ebp - 0x21c]
push eax
call fcn.10001458
pop ecx
pop ecx
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x10001168
push 0x3a
lea eax, [ebp - 0x21c]
push eax
call fcn.10001458
pop ecx
pop ecx
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x1000117e
mov eax, dword [ebp - 0x220]
and word [eax + 2], 0
jmp 0x10001186
and word [ebp - 0x21c], 0
push 0x100343e8
mov eax, dword [ebp - 0x43c]
imul eax, eax, 0x20a
add eax, 0x100388dc
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x440], eax
xor eax, eax
cmp dword [ebp - 0x440], 0xffffffff
setne al
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x100011ec
mov eax, dword [ebp - 0x43c]
imul eax, eax, 0x20a
add eax, 0x100388dc
push eax
push str.No_files_found_matching_search_string___s_._n
call fcn.10005df8
pop ecx
pop ecx
mov dword [0x1004162c], 1
cmp dword [ebp - 0x448], 0
je 0x1000141a
cmp dword [ebp - 0x10], 0
jne 0x1000141a
mov eax, dword [0x100343e8]
and eax, 0x10
test eax, eax
jne 0x100013fe
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
push 0x10034414
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x444]
call fcn.100028ec
test eax, eax
je 0x100013d8
lea ecx, [ebp - 0x444]
call fcn.1000299e
test eax, eax
je 0x100013a5
cmp dword [0x10034404], 0
je 0x1000129e
mov eax, dword [ebp - 0x43c]
imul eax, eax, 0x20a
add eax, 0x100388dc
push eax
lea eax, [ebp - 0x438]
push eax
push str.Found___s__matching_search_string___s___but_it_is_too_large____4GB___therefore_will_not_be_attached_or_sent._n
call fcn.10005df8
add esp, 0xc
jmp 0x100013a3
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [0x10034408]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x44c]
jae 0x100012d8
mov eax, dword [ebp + 8]
and dword [eax], 0
mov dword [ebp - 0x10], 1
jmp 0x100013a3
cmp dword [0x100343e0], 0
jne 0x100012fc
push 0x10
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [0x100343e0], eax
mov eax, dword [0x100343e0]
mov dword [ebp - 0x224], eax
jmp 0x1000131b
push 0x10
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov ecx, dword [ebp - 0x224]
mov dword [ecx], eax
mov eax, dword [ebp - 0x224]
mov eax, dword [eax]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
and dword [eax], 0
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
mov dword [ebp - 0x22c], eax
push dword [ebp - 0x22c]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov ecx, dword [ebp - 0x224]
mov dword [ecx + 4], eax
push dword [ebp - 0x22c]
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x224]
push dword [eax + 4]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x43c]
movzx eax, word [eax*2 + 0x1004187c]
mov ecx, dword [ebp - 0x224]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x224]
mov ecx, dword [0x10034408]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
jmp 0x100013cb
mov eax, dword [ebp - 0x43c]
imul eax, eax, 0x20a
add eax, 0x100388dc
push eax
lea eax, [ebp - 0x438]
push eax
push str.Found___s__matching_search_string___s___but_it_appears_to_not_be_a_file_that_can_be_opened._n
call fcn.10005df8
add esp, 0xc
lea ecx, [ebp - 0x444]
call fcn.100028ca
jmp 0x100013fe
mov eax, dword [ebp - 0x43c]
imul eax, eax, 0x20a
add eax, 0x100388dc
push eax
lea eax, [ebp - 0x438]
push eax
push str.Found___s__matching_search_string___s___but_the_file_cannot_be_opened._n
call fcn.10005df8
add esp, 0xc
push 0x100343e8
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x448], eax
jmp 0x100011ec
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x100010e9
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x450], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.100028b9
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret