Function at 0x100ee901
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, edx
mov byte [ebp - 0x261], cl
mov ebx, 0x10032878
push edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x100ee93e
push 0x10032864
mov edx, 0x1f9
mov ecx, ebx
call fcn.100e970f
test edi, edi
jne 0x100ee953
push 0x1003289c
mov edx, 0x1fa
mov ecx, ebx
call fcn.100e970f
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x260]
push esi
push eax
call fcn.100a7590
mov ebx, eax
test ebx, ebx
jns 0x100ee98e
push 0x1003173c
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100eec0e
lea ecx, [ebp - 0x260]
call fcn.100b15f5
mov ebx, eax
test ebx, ebx
jns 0x100ee9a6
push 0x10031634
jmp 0x100ee979
mov ecx, dword [ebp - 0x260]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x100ee9b1
sub ecx, edx
lea eax, [ebp - 0x268]
push edi
sar ecx, 1
push eax
mov dword [ebp - 0x270], ecx
call fcn.100a7590
mov ebx, eax
test ebx, ebx
js 0x100ee974
lea ecx, [ebp - 0x268]
call fcn.100b15f5
mov ebx, eax
test ebx, ebx
js 0x100ee99f
mov edi, dword [ebp - 0x268]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x100ee9f5
sub ecx, edx
mov edx, 0x10031664
sar ecx, 1
mov dword [ebp - 0x274], ecx
lea ecx, [ebp - 0x260]
call fcn.100a8220
mov ebx, eax
test ebx, ebx
jns 0x100eea2a
push 0x1003166c
jmp 0x100ee979
mov esi, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
je 0x100eec0e
mov ecx, 0x100081c0
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100eea7e
test dx, dx
je 0x100eea7a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100eea7e
add eax, 4
add ecx, 4
test dx, dx
jne 0x100eea58
xor eax, eax
jmp 0x100eea83
sbb eax, eax
or eax, 1
test eax, eax
je 0x100eebd8
mov ecx, 0x1003169c
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100eeabc
test dx, dx
je 0x100eeab8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100eeabc
add eax, 4
add ecx, 4
test dx, dx
jne 0x100eea96
xor eax, eax
jmp 0x100eeac1
sbb eax, eax
or eax, 1
test eax, eax
je 0x100eebd8
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x230]
xor ecx, ecx
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x260]
call fcn.100a8220
test eax, eax
jns 0x100eeb10
test ebx, ebx
js 0x100eeaf0
mov ebx, eax
push 0x100316a4
push 1
push eax
push 0x4000000
call fcn.100ab973
mov esi, dword [ebp - 0x260]
add esp, 0x10
jmp 0x100eebd8
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x230]
xor ecx, ecx
mov word [edi + eax*2], cx
lea ecx, [ebp - 0x268]
call fcn.100a8220
test eax, eax
jns 0x100eeb61
test ebx, ebx
js 0x100eeb37
mov ebx, eax
lea ecx, [ebp - 0x230]
push ecx
push 0x100328b8
push 1
push eax
push 0x4000000
call fcn.100ab973
mov esi, dword [ebp - 0x260]
add esp, 0x14
mov edi, dword [ebp - 0x268]
jmp 0x100eebd8
test byte [ebp - 0x25c], 0x10
mov edi, dword [ebp - 0x268]
je 0x100eeba6
mov ecx, edi
call fcn.100ec268
mov ebx, eax
push edi
test ebx, ebx
js 0x100eec37
mov esi, dword [ebp - 0x260]
mov edx, esi
mov cl, byte [ebp - 0x261]
call fcn.100ee901
mov ebx, eax
test ebx, ebx
jns 0x100eebd8
push esi
push 0x1003290c
jmp 0x100eec3c
mov esi, dword [ebp - 0x260]
xor eax, eax
cmp byte [ebp - 0x261], al
je 0x100eebc8
push 0x110
push eax
push eax
push eax
push edi
push esi
call dword [sym.imp.api_ms_win_core_kernel32_private_l1_1_1.dll_PrivCopyFileExW]
jmp 0x100eebd4
push eax
push eax
push eax
push eax
push edi
push esi
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CopyFileExW]
test eax, eax
je 0x100eec54
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x100eea4d
push dword [ebp - 0x26c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x100eec0e
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
lea ecx, [ebp - 0x268]
call fcn.100b61be
lea ecx, [ebp - 0x260]
call fcn.100b61be
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 4
push 0x100328ec
push 1
push ebx
push 0x4000000
call fcn.100ab973
mov eax, dword [ebp - 0x26c]
add esp, 0x14
jmp 0x100eec02
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100eec66
movzx eax, ax
or eax, 0x80070000
mov ebx, eax
test eax, eax
js 0x100eec73
mov ebx, 0x80004005
mov eax, ebx
push esi
push 0x10032938
push 1
push eax
jmp 0x100eec3f