Function at 0x1009ec0
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x101a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x27c], eax
xor eax, eax
push ebx
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp + 8]
push esi
mov ebx, ecx
mov dword [ebx + 0x14], eax
push edi
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.01009c92
mov esi, eax
mov edi, 0x10017fc
test esi, esi
jge 0x1009f63
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x33
jmp 0x100a343
push dword [ebp - 0x264]
call fcn.010099fe
mov esi, eax
test esi, esi
jge 0x1009f97
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x34
jmp 0x100a343
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.010098fb
mov esi, eax
test esi, esi
jge 0x1009fd3
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x35
jmp 0x100a343
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x260]
push dword [ebp - 0x258]
call fcn.01005600
mov esi, eax
test esi, esi
jge 0x100a014
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x36
jmp 0x100a343
mov eax, dword [ebp - 0x270]
add eax, 0x10a
mov dword [ebp - 0x260], eax
add eax, eax
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.01005b30
mov esi, eax
test esi, esi
jge 0x100a05d
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x37
jmp 0x100a343
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x100a1bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100a093
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070012
jne 0x100a0a4
xor esi, esi
jmp 0x100a388
test esi, esi
jge 0x100a1bd
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x38
jmp 0x100a343
push dword [ebp - 0x278]
push dword [ebp - 0x264]
push dword [ebp - 0x258]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x100a17c
push 0x20
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x100a10d
mov ecx, eax
call fcn.01007a06
mov dword [ebp - 0x25c], eax
jmp 0x100a114
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0
je 0x100a21c
mov ecx, dword [ebp - 0x25c]
push ebx
push 0x1009264
push dword [ebp - 0x260]
push dword [ebp - 0x258]
call fcn.01007bbe
mov esi, eax
test esi, esi
jge 0x100a15d
mov ecx, dword [ebp - 0x25c]
call fcn.01007a50
test al, al
je 0x100a155
xor esi, esi
test esi, esi
jl 0x100a254
push dword [ebp - 0x25c]
lea ecx, [ebx + 4]
call fcn.0100819c
mov esi, eax
test esi, esi
jl 0x100a277
and dword [ebp - 0x25c], 0
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100a1bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100a1a7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070012
je 0x100a29a
test esi, esi
jl 0x100a32d
mov edx, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x258]
xor eax, eax
mov word [ecx + edx*2], ax
push 1
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
push dword [ebp - 0x260]
push dword [ebp - 0x258]
call fcn.0100758d
mov esi, eax
test esi, esi
jge 0x100a0cf
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x39
jmp 0x100a343
mov esi, 0x8007000e
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a373
test byte [eax + 0x1c], 1
je 0x100a357
push esi
push edi
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003005
mov eax, dword [section..data]
jmp 0x100a357
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x3b
jmp 0x100a343
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x3c
jmp 0x100a343
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x268]
push eax
mov ecx, ebx
call fcn.0100914a
mov esi, eax
test esi, esi
jge 0x100a2d5
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x3e
jmp 0x100a343
cmp dword [ebp - 0x274], 0
jne 0x100a2e5
xor esi, esi
jmp 0x100a373
push 0
push dword [ebp - 0x27c]
push dword [ebp - 0x274]
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_ProcessTrace]
test eax, eax
je 0x100a2de
jle 0x100a30f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x100a2de
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x3f
jmp 0x100a343
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a353
test byte [eax + 0x1c], 1
je 0x100a353
push esi
push edi
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003005
mov eax, dword [section..data]
test esi, esi
jge 0x100a373
cmp eax, section..data
je 0x100a373
test byte [eax + 0x1c], 1
je 0x100a373
push esi
push edi
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003005
cmp dword [ebp - 0x26c], 0xffffffff
je 0x100a388
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
cmp dword [ebp - 0x258], ebx
je 0x100a3b3
push dword [ebp - 0x258]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
mov dword [ebp - 0x258], ebx
cmp dword [ebp - 0x264], ebx
je 0x100a3d0
push dword [ebp - 0x264]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x268], ebx
je 0x100a3ed
push dword [ebp - 0x268]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
mov ecx, dword [ebp - 0x25c]
cmp ecx, ebx
je 0x100a3fd
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010110df
leave
ret 8