Function at 0x10001cc0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x878
push ebx
xor eax, eax
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x82
lea edi, [esp + 0x20]
lea edx, [esp + 0x228]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x228]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x680]
rep stosd dword es:[edi], eax
mov ecx, 0x94
lea edi, [esp + 0x430]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x88c]
xor bl, bl
push ecx
push edx
mov word [esp + 0x20], ax
call fcn.1000536c
lea eax, [esp + 0x230]
push eax
call fcn.1000580f
add esp, 0xc
cmp word [esp + eax*2 + 0x226], 0x5c
je 0x10001d55
lea ecx, [esp + 0x228]
push 0x10010094
push ecx
call fcn.10005342
add esp, 8
lea edx, [esp + 0x228]
lea eax, [esp + 0x680]
push edx
push eax
call fcn.1000536c
lea ecx, [esp + 0x230]
push 0x100100f4
push ecx
call fcn.10005342
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
lea edx, [esp + 0x10]
push esi
push str._04x
push edx
mov dword [esp + 0x28], esi
call fcn.1000562e
lea eax, [esp + 0x1c]
push eax
call fcn.100056d2
add esp, 0x10
xor ebp, ebp
jmp 0x10001db0
mov esi, dword [esp + 0x1c]
cmp bp, 1
jne 0x10001de1
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x680]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
call fcn.10001f70
add esp, 0xc
cmp al, 1
je 0x10001f37
lea eax, [esp + 0x430]
lea ecx, [esp + 0x228]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001ed8
lea edx, [esp + 0x430]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10001ec1
test byte [esp + 0x430], 0x10
je 0x10001eb5
lea eax, [esp + 0x45c]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.1000536c
lea edx, [esp + 0x28]
push edx
call fcn.100056d2
lea eax, [esp + 0x2c]
push eax
call fcn.1000580f
add esp, 0x10
cmp eax, 4
jne 0x10001eb5
movsx eax, bp
sub eax, 0
je 0x10001e9f
dec eax
jne 0x10001eb5
mov ax, word [esp + 0x14]
cmp word [esp + 0x24], ax
jne 0x10001eb5
mov cx, word [esp + 0x16]
cmp word [esp + 0x26], cx
jne 0x10001eb5
cmp ax, 0x30
jne 0x10001ebf
cmp cx, 0x39
jne 0x10001ebf
lea ecx, [esp + 0x20]
push str.0809
push ecx
call fcn.1000569d
add esp, 8
test eax, eax
je 0x10001ebf
jmp 0x10001e02
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.1000569d
add esp, 8
test eax, eax
je 0x10001ebf
cmp bl, 1
je 0x10001ec1
jmp 0x10001e02
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp bl, 1
je 0x10001ed8
inc ebp
cmp bp, 2
jl 0x10001dac
test bl, bl
jne 0x10001f3b
lea ecx, [esp + 0x680]
push str.0809
push ecx
call fcn.10005342
add esp, 8
lea edx, [esp + 0x430]
lea eax, [esp + 0x680]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001f1b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x878
ret
lea ecx, [esp + 0x45c]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.1000536c
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
jmp 0x10001f40
cmp bl, 1
jne 0x10001f55
mov ecx, dword [esp + 0x890]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.1000536c
add esp, 8
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x878
ret