Function at 0x10001cf0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x37c
mov eax, 0x1003b68e
call fcn.1000ace4
mov esi, ecx
mov edi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x384], edi
mov dword [ebp - 0x380], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
mov edx, edi
push str..
lea ecx, [ebp - 0x70]
call fcn.10007917
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10006619
push 0
push 1
lea ecx, [ebp - 0x70]
call fcn.10006b0c
cmp byte [esi + 0x29], 0
jne 0x100021e2
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x380]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100021e2
test dword [ebp - 0x380], 0x400
jne 0x10001f8e
test byte [ebp - 0x380], 0x10
je 0x10001eca
cmp byte [ebp + 0xc], 0
je 0x10001f8e
mov ecx, 0x10045a78
lea eax, [ebp - 0x354]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001dd0
test dx, dx
je 0x10001dcc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001dd0
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001daa
xor eax, eax
jmp 0x10001dd5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10001f8e
mov ecx, 0x10045a7c
lea eax, [ebp - 0x354]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001e0e
test dx, dx
je 0x10001e0a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001e0e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001de8
xor eax, eax
jmp 0x10001e13
sbb eax, eax
or eax, 1
test eax, eax
je 0x10001f8e
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
push 0x100461f8
mov edx, edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.10007917
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.100078e2
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10006619
push 0
push 1
lea ecx, [ebp - 0x88]
call fcn.10006b0c
push 0
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.10006b0c
push dword [ebp + 0xc]
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.10001cf0
cmp byte [0x10050a9b], 0
jne 0x10001eb9
cmp byte [esi + 0x29], 0
jne 0x10001eb9
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10006b0c
jmp 0x10001f8e
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
lea ecx, [ebp - 0x40]
jmp 0x100021d2
sub esp, 0x18
lea eax, [ebp - 0x354]
mov ecx, esp
push eax
call fcn.1000668f
mov ecx, esi
call fcn.1000172d
test al, al
je 0x10001f8e
lea edi, [esi + 0x407c]
cmp dword [edi + 0x10], 0x10000
jbe 0x10001f0d
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x408c], 0x10000
ja 0x10001ef9
push 0x10050cb8
call fcn.100011cf
mov edx, dword [ebp - 0x384]
lea ecx, [ebp - 0xd0]
mov dword [esp], 0x100461f8
call fcn.10007917
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 3
push ecx
mov edx, eax
lea ecx, [ebp - 0xb8]
call fcn.100078e2
pop ecx
pop ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.100063c6
push 0
push 1
lea ecx, [ebp - 0xb8]
call fcn.10006b0c
push 0
push 1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0
call fcn.10006b0c
inc dword [esi + 0x40fc]
push 0x10050cb8
call fcn.100011ee
mov edi, dword [ebp - 0x384]
pop ecx
lea eax, [ebp - 0x380]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100021db
test dword [ebp - 0x380], 0x400
jne 0x100021aa
test byte [ebp - 0x380], 0x10
je 0x100020ec
cmp byte [ebp + 0xc], 0
je 0x100021aa
mov ecx, 0x10045a78
lea eax, [ebp - 0x354]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001ffc
test dx, dx
je 0x10001ff8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001ffc
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001fd6
xor eax, eax
jmp 0x10002001
sbb eax, eax
or eax, 1
test eax, eax
je 0x100021aa
mov ecx, 0x10045a7c
lea eax, [ebp - 0x354]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000203a
test dx, dx
je 0x10002036
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000203a
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002014
xor eax, eax
jmp 0x1000203f
sbb eax, eax
or eax, 1
test eax, eax
je 0x100021aa
and dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
push 0x100461f8
mov edx, edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x100]
call fcn.10007917
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0xe8]
call fcn.100078e2
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.10006619
xor edi, edi
lea ecx, [ebp - 0xe8]
push edi
push 1
call fcn.10006b0c
push edi
push 1
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 5
call fcn.10006b0c
push dword [ebp + 0xc]
lea eax, [ebp - 0x58]
mov ecx, esi
push eax
call fcn.10001cf0
cmp byte [0x10050a9b], 0
jne 0x100021c7
cmp byte [esi + 0x29], 0
jne 0x100021c7
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.10006b0c
jmp 0x100021aa
sub esp, 0x18
lea eax, [ebp - 0x354]
mov ecx, esp
push eax
call fcn.1000668f
mov ecx, esi
call fcn.1000172d
test al, al
je 0x100021aa
lea edi, [esi + 0x407c]
cmp dword [edi + 0x10], 0x10000
jbe 0x1000212f
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x408c], 0x10000
ja 0x1000211b
push 0x10050cb8
call fcn.100011cf
mov edx, dword [ebp - 0x384]
lea ecx, [ebp - 0x130]
mov dword [esp], 0x100461f8
call fcn.10007917
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 7
push ecx
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.100078e2
pop ecx
pop ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.100063c6
push 0
push 1
lea ecx, [ebp - 0x118]
call fcn.10006b0c
push 0
push 1
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0
call fcn.10006b0c
inc dword [esi + 0x40fc]
push 0x10050cb8
call fcn.100011ee
pop ecx
lea eax, [ebp - 0x380]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100021db
mov edi, dword [ebp - 0x384]
jmp 0x10001fa4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
lea ecx, [ebp - 0x58]
push 1
call fcn.10006b0c
jmp 0x100021e2
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10006b0c
call fcn.1000ac9f
ret 8