Function at 0x1009da60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov eax, 0x531c
mov ebp, esp
push edi
push esi
push ebx
call fcn.100ab7d0
lea esi, [ebp - 0x18]
sub esp, eax
mov dword [ebp - 0x5300], ecx
mov dword [ebp - 0x52d4], 0x100cfd60
mov dword [ebp - 0x52d0], 0x100d3fa8
mov dword [ebp - 0x52cc], esi
lea esi, [ebp - 0x52ec]
mov dword [ebp - 0x52c8], 0x1009e04c
mov dword [ebp - 0x52c4], esp
mov dword [ebp - 0x52f0], esi
mov dword [esp], esi
call fcn.100ac520
mov eax, dword [ebp - 0x5300]
mov esi, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], esi
mov dword [eax], 0x100f22dc
mov byte [eax + 0x10], 0
mov byte [eax + 0x11], 0
lea eax, [ebp - 0x505c]
mov dword [esp + 8], 0x1000
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [ebp - 0x52e8], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1009db30
mov eax, dword [ebp - 0x52f0]
mov dword [esp], eax
call fcn.100ac5b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [ebp - 0x505c]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_wcsrchr
test eax, eax
je 0x1009dff0
lea esi, [ebp - 0x505c]
mov edx, eax
sub edx, esi
sar edx, 1
lea esi, [edx + 1]
mov dword [ebp - 0x5304], edx
add edx, 0x2b
cmp edx, 0xfff
mov dword [ebp - 0x52f4], esi
ja 0x1009db17
add eax, 2
mov dword [esp + 4], str.________________________________
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
lea eax, [ebp - 0x52ac]
mov dword [ebp - 0x52fc], eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x505c]
mov dword [esp], eax
mov dword [ebp - 0x52e8], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x52f8], eax
je 0x1009db17
mov eax, dword [ebp - 0x52f4]
lea ebx, [ebp - 0x505c]
lea eax, [ebp + eax*2 - 0x505c]
mov dword [ebp - 0x5308], eax
mov eax, dword [ebp - 0x5304]
lea eax, [eax + eax + 0x42]
add ebx, eax
lea eax, [ebp + eax - 0x505a]
mov dword [ebp - 0x530c], ebx
mov dword [ebp - 0x5310], eax
jmp 0x1009dc2e
mov eax, dword [ebp - 0x52fc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x52f8]
mov dword [esp], eax
mov dword [ebp - 0x52e8], 1
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x1009dfcd
test byte [ebp - 0x52ac], 0x10
je 0x1009dc00
lea eax, [ebp - 0x5280]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
cmp eax, 0x20
jne 0x1009dc00
lea edi, [ebp - 0x305c]
xor eax, eax
mov ecx, 0x10
lea edx, [ebp - 0x301c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x101c]
xor ecx, ecx
add edx, 2
mov word [edx - 2], cx
cmp eax, edx
jne 0x1009dc65
lea edx, [ebp - 0x1c]
mov byte [eax], 0
add eax, 1
cmp eax, edx
jne 0x1009dc75
mov eax, dword [ebp + 8]
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1c], 1
mov dword [ebp - 0x52f4], 0
mov dword [ebp - 0x3040], eax
lea eax, [ebp - 0x5280]
mov dword [ebp - 0x52f0], eax
jmp 0x1009dcd2
mov edi, dword [ebp - 0x52f4]
add dword [ebp - 0x52f0], 4
mov byte [ebp + edi - 0x303c], al
add edi, 1
cmp edi, 0x10
mov dword [ebp - 0x52f4], edi
je 0x1009dd3c
lea eax, [ebp - 0x52b0]
mov dword [ebp - 0x52b0], 0
mov dword [esp + 4], 0x100edb26
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x52f0]
mov dword [esp], eax
call fcn.100d0460
cmp eax, 1
jne 0x1009dc00
mov eax, dword [ebp - 0x52b0]
test eax, eax
jne 0x1009dcb0
mov dword [esp + 4], 0x100edb2e
mov eax, dword [ebp - 0x52f0]
mov dword [esp], eax
call sub.msvcrt.dll_wcsstr
cmp dword [ebp - 0x52f0], eax
jne 0x1009dc00
mov eax, dword [ebp - 0x52b0]
jmp 0x1009dcb0
lea eax, [ebp - 0x5280]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5308]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], 0x100edb34
mov eax, dword [ebp - 0x530c]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
lea eax, [ebp - 0x505c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x301c]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], str.plugin.cfg
mov eax, dword [ebp - 0x5310]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
lea eax, [ebp - 0x505c]
mov dword [ebp - 0x52b0], 0
mov dword [esp + 8], 0x100edb38
mov dword [esp + 4], eax
lea eax, [ebp - 0x52b0]
mov dword [esp], eax
mov dword [ebp - 0x52e8], 1
call dword [sym.imp.msvcrt.dll__wfopen_s]
mov eax, dword [ebp - 0x52b0]
test eax, eax
je 0x1009dc00
lea ebx, [ebp - 0x305c]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov ecx, dword [ebp - 0x5300]
call fcn.1009d990
sub esp, 8
test al, al
je 0x1009dfa4
mov eax, dword [ebp - 0x5300]
mov eax, dword [eax + 8]
mov dword [ebp - 0x52f0], eax
add eax, 1
mov ebx, eax
mov dword [ebp - 0x52f4], eax
mov eax, 0xffffffff
imul edx, ebx, 0x3044
cmp ebx, 0x2a000
cmovbe eax, edx
mov dword [esp], eax
mov dword [ebp - 0x52e8], 2
call fcn.100cf390
mov dword [ebp - 0x52fc], eax
lea ebx, [eax + 0x2040]
xor esi, esi
xor eax, eax
cmp dword [ebp - 0x52f0], 0xffffffff
je 0x1009decb
mov ecx, dword [ebp - 0x52f4]
mov dword [ebp - 0x52f0], ecx
lea edi, [ebx - 0x2040]
mov ecx, 0x10
lea edx, [ebx - 0x2000]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x52f0]
lea esi, [esi]
xor edi, edi
add edx, 2
mov word [edx - 2], di
cmp ebx, edx
jne 0x1009de80
mov edi, ecx
lea ecx, [ebx + 0x1000]
mov edx, ebx
mov esi, esi
lea edi, [edi]
mov byte [edx], 0
add edx, 1
cmp edx, ecx
jne 0x1009dea0
add esi, 1
mov byte [ebx + 0x1000], 0
mov byte [ebx + 0x1001], 0
add ebx, 0x3044
cmp edi, esi
mov dword [ebp - 0x52f0], edi
jne 0x1009de63
mov eax, dword [ebp - 0x5300]
mov eax, dword [eax + 8]
mov dword [ebp - 0x5314], eax
test eax, eax
mov eax, dword [ebp - 0x5300]
mov eax, dword [eax + 4]
mov dword [ebp - 0x52f4], eax
je 0x1009e00f
imul eax, dword [ebp - 0x5314], 0x3044
mov dword [ebp - 0x52f0], 0
mov dword [ebp - 0x5304], eax
mov esi, dword [ebp - 0x52f0]
mov eax, dword [ebp - 0x52fc]
mov edx, dword [ebp - 0x52f4]
mov dword [esp + 8], 0x3042
add eax, esi
add edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
add dword [ebp - 0x52f0], 0x3044
mov esi, dword [ebp - 0x52f0]
cmp esi, dword [ebp - 0x5304]
jne 0x1009df0b
mov eax, dword [ebp - 0x5314]
lea ebx, [ebp - 0x305c]
add eax, 1
mov dword [ebp - 0x5304], eax
mov eax, dword [ebp - 0x52fc]
mov dword [esp + 8], 0x3042
mov dword [esp + 4], ebx
add eax, esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x52f4]
mov dword [esp], eax
call fcn.100cf370
mov eax, dword [ebp - 0x5300]
mov esi, dword [ebp - 0x52fc]
mov ebx, dword [ebp - 0x5304]
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
mov eax, dword [ebp - 0x52b0]
mov dword [esp], eax
mov dword [ebp - 0x52e8], 1
call sub.msvcrt.dll_fclose
lea eax, [ebp - 0x52ac]
mov dword [ebp - 0x52fc], eax
jmp 0x1009dc00
mov eax, dword [ebp - 0x52f8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x52ec]
sub esp, 4
mov dword [ebp - 0x52f0], eax
jmp 0x1009db17
mov dword [ebp - 0x52f4], 1
mov dword [ebp - 0x5304], 0
lea eax, [ebp - 0x505c]
jmp 0x1009db74
lea esi, [ebp - 0x305c]
mov dword [esp + 8], 0x3042
mov dword [esp + 4], esi
mov ebx, dword [ebp - 0x52fc]
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x52f4]
mov dword [ebp - 0x5304], 1
test eax, eax
je 0x1009df8c
jmp 0x1009df7e