Function at 0x10015980
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1002b11b
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
sub esp, 0x668
cmp eax, 6
jg 0x10015db7
push edi
xor edi, edi
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], edi
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x464]
push eax
push str._s.
push ecx
mov dword [esp + 0x680], edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x464]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x10015d97
push ebx
push ebp
mov ebp, dword [esp + 0x688]
push esi
test byte [esp + 0x18], 0x10
je 0x10015b83
mov esi, 0x10031888
lea eax, [esp + 0x44]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10015a44
test cl, cl
je 0x10015a40
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10015a44
add eax, 2
add esi, 2
test cl, cl
jne 0x10015a1c
xor eax, eax
jmp 0x10015a49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10015d22
mov esi, 0x10031884
lea eax, [esp + 0x44]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10015a82
test cl, cl
je 0x10015a7e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10015a82
add eax, 2
add esi, 2
test cl, cl
jne 0x10015a5a
xor eax, eax
jmp 0x10015a87
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10015d22
mov eax, edi
and eax, 0xf
test al, al
jne 0x10015b07
lea eax, [edi + 0x10]
mov ecx, eax
shl ecx, 4
add ecx, eax
lea edx, [eax + ecx*8]
shl edx, 2
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x36c]
mov ebx, eax
mov eax, edx
mov esi, dword [esp + 0x368]
shl eax, 4
add eax, edx
mov edi, ebx
lea edx, [edx + eax*8]
shl edx, 2
mov ecx, edx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x890
lea edi, [edx + ebx]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x368]
push ecx
call fcn.10010220
mov edi, dword [esp + 0x370]
add esp, 8
mov dword [esp + 0x364], ebx
mov eax, dword [esp + 0x688]
lea edx, [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x374]
push 0x10030690
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x374]
mov edx, edi
shl edx, 4
add edx, edi
add esp, 0x10
lea eax, [edi + edx*8]
inc edi
mov dword [esp + 0x368], edi
lea edi, [esp + 0x36c]
lea edx, [ecx + eax*4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
mov dword [edx + 0x214], ecx
mov eax, dword [esp + 0x30]
mov dword [edx + 0x218], eax
jmp 0x10015d1b
mov eax, dword [esp + 0x38]
cmp eax, 0x600000
mov dword [esp + 0x14], eax
jae 0x10015d22
mov eax, dword [esp + 0x34]
test eax, eax
ja 0x10015d22
lea ecx, [esp + 0x44]
push 0x2e
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x10015bf1
mov ebx, dword [esp + 0x690]
lea edx, [esp + 0x44]
sub eax, edx
inc eax
test ebx, ebx
mov edx, eax
je 0x10015bf8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10015bf8
lea eax, [esp + edx + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x10015d1b
jmp 0x10015bf8
mov ebx, dword [esp + 0x690]
mov eax, dword [ebp + 0x210]
mov ecx, eax
and ecx, 0xf
test cl, cl
jne 0x10015c80
add eax, 0x10
mov edx, eax
shl edx, 4
add edx, eax
lea eax, [eax + edx*8]
shl eax, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [ebp + 0x210]
mov ecx, eax
mov esi, dword [ebp + 0x20c]
shl ecx, 4
add ecx, eax
mov edi, ebx
lea ecx, [eax + ecx*8]
xor eax, eax
shl ecx, 2
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0x210]
mov ecx, 0x890
mov esi, edx
shl esi, 4
add esi, edx
lea edx, [edx + esi*8]
lea edi, [ebx + edx*4]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x20c]
push eax
call fcn.10010220
mov dword [ebp + 0x20c], ebx
mov ebx, dword [esp + 0x698]
add esp, 8
mov ecx, dword [esp + 0x688]
lea eax, [esp + 0x44]
push eax
push ecx
lea edx, [esp + 0x374]
push 0x10030690
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [ebp + 0x210]
add esp, 0x10
mov ecx, eax
lea edi, [esp + 0x36c]
shl ecx, 4
add ecx, eax
lea edx, [eax + ecx*8]
mov ecx, dword [ebp + 0x20c]
inc eax
lea edx, [ecx + edx*4]
mov dword [ebp + 0x210], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
mov dword [edx + 0x214], ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov dword [edx + 0x218], eax
mov dword [edx + 0x210], ecx
mov dword [edx + 0x20c], 0
cmp dword [ebp + 0x210], 0xc8
jg 0x10015d43
mov edi, dword [esp + 0x368]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10015a08
mov ebx, dword [esp + 0x690]
jmp 0x10015d4a
mov edi, dword [esp + 0x368]
xor esi, esi
test edi, edi
jle 0x10015d89
mov edi, dword [esp + 0x364]
cmp dword [ebp + 0x210], 0xc8
jg 0x10015d89
mov ecx, dword [esp + 0x694]
inc ecx
push ecx
push ebx
push ebp
push edi
call fcn.10015980
mov eax, dword [esp + 0x378]
add esp, 0x10
inc esi
add edi, 0x224
cmp esi, eax
jl 0x10015d57
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 0x358]
mov dword [esp + 0x674], 0xffffffff
test eax, eax
pop edi
je 0x10015db7
push eax
call fcn.10010220
add esp, 4
mov ecx, dword [esp + 0x668]
mov dword fs:[0], ecx
add esp, 0x674
ret