Function at 0x10005be0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebx + 0x1c], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, 0x2800
push esi
push 0x40
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 4], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
push 0x100014e0
push eax
lea ecx, [ebp - 0x250]
push 0x100014d8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x250]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x10005cbc
mov byte [ebp + 0xb], 0x68
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp + 0xb]
push 1
push ecx
mov ecx, ebx
call fcn.10008df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 0x68
mov ebx, 1
jmp 0x10005ccc
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
lea edx, [esi - 0x208]
cmp ebx, edx
jbe 0x10005d0a
add esi, 0x208
mov dword [ebp - 8], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x42
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 4], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0x100014d4
lea esi, [ebp - 0x120]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x10005d4c
test al, al
je 0x10005d48
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x10005d4c
add esi, 2
add edi, 2
test al, al
jne 0x10005d24
xor eax, eax
jmp 0x10005d51
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10005e5e
mov edi, 0x100014d0
lea esi, [ebp - 0x120]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x10005d8c
test al, al
je 0x10005d88
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x10005d8c
add esi, 2
add edi, 2
test al, al
jne 0x10005d64
xor eax, eax
jmp 0x10005d91
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10005e5e
mov al, byte [ebp - 0x14c]
mov edi, dword [ebp - 4]
and al, 0x10
mov byte [ebx + edi], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x120]
inc ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
lea esi, [ebp - 0x120]
mov edx, ecx
add edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
inc ebx
mov byte [ebx + eax - 1], 0
mov ecx, dword [ebp - 0x130]
mov dword [ebx + eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x12c]
mov dword [ebx + eax + 4], edx
add ebx, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x138]
mov dword [ebx + eax], ecx
mov edx, dword [ebp - 0x134]
mov dword [ebx + eax + 4], edx
add ebx, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10005cc6
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push ebx
push edi
call fcn.10008df0
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4