Function at 0x1005280
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x100a370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x148], eax
cmp word [0x100ac40], si
jne 0x10052db
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
push esi
push 0x30
push 0x100ac40
push esi
push 0x2770
push esi
mov ebx, 0x800
push ebx
call edi
push esi
push 0x30
push 0x100abd8
push esi
push 0x2771
push esi
push ebx
call edi
push 0x9c44
push esi
mov dword [0x100ba44], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor eax, eax
cmp ebx, esi
jne 0x1005304
mov dword [0x100ba44], 0x100abd8
jmp 0x1005523
push dword [ebp - 0x148]
mov ecx, 0x2711
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x150], esi
call fcn.01005046
mov edi, eax
cmp edi, esi
jne 0x100533b
push ebx
mov dword [0x100ba44], 0x100abd8
call fcn.010088e5
xor eax, eax
jmp 0x1005523
push dword [ebp - 0x148]
call fcn.010050d9
mov dword [ebp - 0x14c], eax
cmp eax, esi
je 0x1005324
mov esi, dword [sym.imp.msvcrt.dll__mbscmp]
push 0x1001338
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x10054bf
push 0x10013f8
push dword [ebp - 0x14c]
call esi
pop ecx
pop ecx
test eax, eax
je 0x10054bf
push 0x10015a8
push dword [ebp - 0x148]
call esi
pop ecx
pop ecx
test eax, eax
je 0x10054bf
push 0x10015a4
push dword [ebp - 0x148]
call esi
pop ecx
pop ecx
test eax, eax
je 0x10054bf
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp eax, 0xffffffff
jne 0x10053f1
push ebx
mov dword [0x100ba44], 0x100ac40
call fcn.010088e5
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call esi
push dword [ebp - 0x14c]
call esi
jmp 0x1005334
mov esi, 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 0x150]
mov dword [ebx + ecx*4], eax
test eax, eax
je 0x100549e
push esi
push edi
push eax
call dword [sym.imp.msvcrt.dll__mbsnbcpy]
push edi
call dword [sym.imp.msvcrt.dll__mbslen]
push eax
push edi
call dword [sym.imp.msvcrt.dll__mbsnbcnt]
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x150]
push dword [ebx + eax*4]
call dword [sym.imp.msvcrt.dll__mbsnbcat]
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebx + eax*4]
add esp, 0x24
mov byte [ecx + 0x103], 0
and dword [ebx + eax*4 + 4], 0
inc eax
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1005489
cmp dword [ebp - 0x150], 0x2710
jl 0x10053f6
push dword [ebp - 0x148]
and dword [0x100ba44], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1005510
push ebx
mov dword [0x100ba44], 0x100abd8
call fcn.010088e5
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10053db
mov esi, 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x1005324
push esi
push edi
push eax
call dword [sym.imp.msvcrt.dll__mbsnbcpy]
push edi
call dword [sym.imp.msvcrt.dll__mbslen]
push eax
push edi
call dword [sym.imp.msvcrt.dll__mbsnbcnt]
sub esi, eax
push esi
push dword [ebp - 0x14c]
push dword [ebx]
call dword [sym.imp.msvcrt.dll__mbsnbcat]
mov eax, dword [ebx]
add esp, 0x24
mov byte [eax + 0x103], 0
and dword [ebx + 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call esi
push dword [ebp - 0x14c]
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008359
leave
ret 4