Function at 0x1000843b
Capabilities:
Enumerate files on windows
Enumerate files recursively
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x100b02c0]
xor eax, esp
mov dword [esp + 0x278], eax
cmp dword [ebp + 0x24], 0x32
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x20]
push esi
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
jbe 0x1000847d
mov al, 1
jmp 0x10008780
mov edi, ecx
mov eax, ebx
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x18], edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10008492
sub eax, edx
sar eax, 1
lea eax, [ebx + eax*2]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
cmp word [ecx], si
je 0x100085ca
movzx eax, word [edi]
push 0x3f
pop ecx
cmp cx, ax
je 0x100085a0
push 0x2a
pop ecx
cmp cx, ax
je 0x100085a0
push 0x25
pop ecx
cmp cx, ax
jne 0x10008587
push 2
pop ecx
add edi, ecx
mov ebx, edi
jmp 0x100084ef
test ax, ax
je 0x10008644
add edi, ecx
movzx eax, word [edi]
push 0x25
pop edx
cmp dx, ax
jne 0x100084e4
cmp word [edi], 0
je 0x10008644
add edi, ecx
mov esi, edi
xor eax, eax
sub esi, ebx
mov dword [esp + 0x20], eax
sar esi, 1
mov eax, esi
mul ecx
mov ecx, dword [esp + 0x20]
seto cl
mov dword [esp + 0x18], edi
neg ecx
or ecx, eax
push ecx
call fcn.1005fb39
mov edi, eax
pop ecx
test edi, edi
je 0x10008644
lea eax, [esi - 1]
push eax
push ebx
push esi
push edi
call fcn.1006049d
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x10
push 0
push 0
push edi
call ebx
mov esi, eax
cmp dword [ebp + 0x10], esi
jb 0x1000863d
push dword [ebp + 0x10]
push dword [esp + 0x18]
push edi
call ebx
mov eax, dword [esp + 0x14]
sub dword [ebp + 0x10], esi
lea eax, [eax + esi*2 - 2]
push edi
mov dword [esp + 0x18], eax
call fcn.10060146
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
pop ecx
jmp 0x100085c0
push 0x5c
pop ecx
cmp cx, ax
jne 0x100085a5
cmp byte [esp + 0x13], 0
jne 0x100085ca
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
jmp 0x100085a5
mov byte [esp + 0x13], 1
dec dword [ebp + 0x10]
je 0x10008644
mov ecx, dword [esp + 0x14]
add dword [esp + 0x14], 2
inc edi
inc edi
mov word [ecx], ax
mov dword [esp + 0x18], edi
cmp word [edi], 0
jne 0x100084b4
mov ecx, dword [esp + 0x14]
xor eax, eax
mov word [ecx], ax
cmp word [ebx], ax
je 0x10008644
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100085dd
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebx + eax*2]
je 0x10008644
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x10008772
push 4
pop ebx
mov ecx, 0x10099c6c
lea eax, [esp + 0x5c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000864b
test dx, dx
je 0x10008639
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000864b
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x10008619
xor eax, eax
jmp 0x10008650
push edi
call fcn.10060146
pop ecx
xor al, al
jmp 0x10008780
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000875b
mov ecx, 0x10099c70
lea eax, [esp + 0x5c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10008685
test dx, dx
je 0x10008681
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10008685
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x10008661
xor eax, eax
jmp 0x1000868a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000875b
mov esi, dword [esp + 0x14]
sub esi, dword [esp + 0x1c]
sar esi, 1
add esi, dword [ebp + 0x10]
je 0x1000875b
lea eax, [esp + 0x5c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100086ac
sub eax, edx
sar eax, 1
dec esi
mov edi, eax
je 0x10008772
mov ecx, dword [esp + 0x1c]
push 0x5c
pop eax
mov word [ecx], ax
cmp esi, edi
jbe 0x1000875b
lea eax, [esp + 0x5c]
push eax
mov eax, ecx
add eax, 2
push esi
push eax
call fcn.10060b10
mov eax, dword [esp + 0x24]
add esp, 0xc
sub esi, edi
cmp word [eax], 0
jne 0x10008728
cmp byte [ebp + 0x14], 0
je 0x10008702
test byte [esp + 0x30], 0x10
jne 0x10008712
cmp byte [ebp + 0x18], 0
je 0x1000875b
test dword [esp + 0x30], 0x10
jne 0x1000875b
push dword [esp + 0x2c]
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x2c]
call dword [esp + 0x34]
add esp, 0xc
jmp 0x10008753
test byte [esp + 0x30], 0x10
je 0x1000875b
mov eax, dword [ebp + 0x24]
inc eax
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call fcn.1000843b
add esp, 0x20
mov byte [esp + 0x12], al
test al, al
jne 0x10008772
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10008610
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0x12]
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005fc2b
mov esp, ebp
pop ebp
ret