Function at 0x1004fd20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 0x100c52b4
mov dword [ebp - 0xa70], eax
mov edi, ecx
lea eax, [ebp - 0x81c]
xor esi, esi
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_swprintf_s]
add esp, 0x10
lea eax, [ebp - 0xa6c]
push eax
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1005012c
lea ecx, [ecx]
lea eax, [ebp - 0xa40]
push eax
push dword [ebp - 0xa70]
lea eax, [ebp - 0x414]
push 0x100c1db8
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_swprintf_s]
add esp, 0x14
test byte [ebp - 0xa6c], 0x10
je 0x1004fe46
mov ecx, 0x100c52c4
lea eax, [ebp - 0xa40]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004fde6
test dx, dx
je 0x1004fde2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004fde6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004fdc0
xor eax, eax
jmp 0x1004fdeb
sbb eax, eax
or eax, 1
test eax, eax
je 0x10050107
mov ecx, 0x100c52c8
lea eax, [ebp - 0xa40]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004fe26
test dx, dx
je 0x1004fe22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004fe26
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004fe00
xor eax, eax
jmp 0x1004fe2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10050107
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call sym.HncFoundation.dll_private:_unsigned_int___thiscall_CHncAppShield::detectDir_unsigned_short_int_const__
jmp 0x10050101
push 0x100
lea eax, [ebp - 0x20c]
push eax
push 0x100
lea eax, [ebp - 0x614]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.MSVCR120.dll__wsplitpath_s]
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x614]
push 0x100
push eax
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, str..doc
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004fec6
test dx, dx
je 0x1004fec2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004fec6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004fea0
xor eax, eax
jmp 0x1004fecb
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500f3
mov ecx, str..ppt
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004ff06
test dx, dx
je 0x1004ff02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004ff06
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004fee0
xor eax, eax
jmp 0x1004ff0b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500f3
mov ecx, str..xls
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004ff46
test dx, dx
je 0x1004ff42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004ff46
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004ff20
xor eax, eax
jmp 0x1004ff4b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500f3
mov ecx, str.vbaProject.bin
lea eax, [ebp - 0x614]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004ff86
test dx, dx
je 0x1004ff82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004ff86
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004ff60
xor eax, eax
jmp 0x1004ff8b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500f3
mov ecx, str..docx
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004ffc6
test dx, dx
je 0x1004ffc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004ffc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004ffa0
xor eax, eax
jmp 0x1004ffcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500ef
mov ecx, str..pptx
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10050006
test dx, dx
je 0x10050002
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10050006
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004ffe0
xor eax, eax
jmp 0x1005000b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500ef
mov ecx, str..xlsx
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10050046
test dx, dx
je 0x10050042
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10050046
add eax, 4
add ecx, 4
test dx, dx
jne 0x10050020
xor eax, eax
jmp 0x1005004b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100500ef
mov ecx, str..xml
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10050086
test dx, dx
je 0x10050082
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10050086
add eax, 4
add ecx, 4
test dx, dx
jne 0x10050060
xor eax, eax
jmp 0x1005008b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100500a2
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call sym.HncFoundation.dll_private:_unsigned_int___thiscall_CHncAppShield::detectXML_unsigned_short_int_const__
jmp 0x10050101
mov ecx, str..bin
lea eax, [ebp - 0x20c]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100500d6
test dx, dx
je 0x100500d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100500d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100500b0
xor eax, eax
jmp 0x100500db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100500ef
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call sym.HncFoundation.dll_private:_unsigned_int___thiscall_CHncAppShield::detectBIN_unsigned_short_int_const__
jmp 0x10050101
xor esi, esi
jmp 0x10050107
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
call eax
add esp, 4
mov esi, eax
test esi, esi
jne 0x1005012c
lea eax, [ebp - 0xa6c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1004fd80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1004fd80
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4