Function at 0x10002700
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022e53
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2d8], eax
xor eax, eax
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
cmp word [edx], ax
jne 0x10002760
xor ecx, ecx
jmp 0x10002774
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002765
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.100018b0
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
call fcn.10003740
add esp, 4
test eax, eax
jne 0x100027a4
push 1
push 0x1002434c
lea ecx, [ebp - 0x70]
call fcn.10003150
call fcn.1000ac10
test al, al
je 0x100027cb
push ecx
push esi
pop esi
pop esi
pop ebx
pop ebp
pop ebp
push ebx
pop ecx
push ebp
pop esp
push esp
push esi
push esp
pop edi
pop ebp
pop ecx
pop edi
pop esi
push edi
push ecx
push ebp
pop esi
pop esp
mov ebx, dword [ebp - 0x2dc]
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 0
push 1
xor eax, eax
mov byte [ebp - 4], 1
push 0x10024350
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.100018b0
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebx], ax
jne 0x10002831
xor ecx, ecx
jmp 0x10002845
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002836
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.100018b0
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10003820
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp eax, 8
jb 0x1000287f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001a00
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x100028ac
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10001a00
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x30], 0
push eax
call fcn.10001790
push 3
push 0x10024354
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.10003150
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x2c0]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2d4], eax
call fcn.1000b4d0
test al, al
je 0x10002929
pop eax
pop ebx
push edx
pop ebx
pop ebp
push eax
pop esp
pop esp
pop ecx
pop esi
push edx
pop ecx
push esp
push edx
push ebx
pop ebx
pop ebp
push eax
pop edi
pop esp
push esp
pop ebp
pop esi
push eax
pop ecx
pop edi
push edx
pop edx
push esi
pop ebp
push edi
cmp dword [ebp - 0x2d4], 0xffffffff
je 0x10002cb2
call fcn.1000ad60
test al, al
je 0x10002950
push eax
pop ebx
pop edx
push edi
push edi
pop esp
pop esp
push esi
push esi
pop edx
push edx
pop ebx
push edx
push esi
push edi
push ebp
pop ebp
call fcn.1000b5b0
test al, al
je 0x10002979
pop eax
pop edx
pop ecx
pop ebx
pop edx
push ebx
pop ebp
pop edi
push esp
pop esp
push esp
push edi
pop edx
push edi
push ebx
pop edx
push edx
push edx
push edx
pop esi
push eax
push ebx
pop edx
push esi
pop esp
push ebp
push edi
pop edx
pop ebx
push edx
pop edx
push ebx
call fcn.1000acf0
test al, al
je 0x10002995
push edi
pop ecx
push edi
push ebp
pop ecx
push edx
pop edx
push esi
pop esi
pop ebp
pop edi
push ebx
push ecx
push esp
pop esp
pop esi
push edx
pop ebp
push eax
mov ebx, dword [ebp + 0x14]
nop dword [eax + eax]
test byte [ebp - 0x2c0], 0x10
je 0x10002a66
cmp word [ebp - 0x294], 0x2e
je 0x10002c1f
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x18], 0
push eax
call fcn.10001790
cmp word [ebp - 0x294], 0
mov byte [ebp - 4], 5
jne 0x100029f0
xor ecx, ecx
jmp 0x10002a0f
lea ecx, [ebp - 0x294]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002a00
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x28]
call fcn.10003150
test bl, bl
je 0x10002a44
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
push dword [ebp - 0x2d8]
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x2dc]
push eax
call fcn.10002700
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x10002c1f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001a00
jmp 0x10002c1f
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10002640
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 6
push eax
call fcn.10003c20
mov esi, dword [ebp - 0x2d0]
xor al, al
mov ebx, dword [ebp - 0x2cc]
add esp, 0xc
mov byte [ebp - 0x2c1], al
cmp esi, ebx
je 0x10002af4
nop
cmp dword [esi + 0x14], 8
jb 0x10002aaa
mov edi, dword [esi]
jmp 0x10002aac
mov edi, esi
lea ecx, [ebp - 0x58]
call fcn.10005ba0
mov cx, word [eax]
cmp cx, word [edi]
jne 0x10002ada
test cx, cx
je 0x10002ad6
mov cx, word [eax + 2]
cmp cx, word [edi + 2]
jne 0x10002ada
add eax, 4
add edi, 4
test cx, cx
jne 0x10002ab4
xor eax, eax
jmp 0x10002adf
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002af2
add esi, 0x18
cmp esi, ebx
jne 0x10002aa0
mov al, byte [ebp - 0x2c1]
jmp 0x10002af4
mov al, 1
test al, al
je 0x10002bc5
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x18], 0
push eax
call fcn.10001790
cmp word [ebp - 0x294], 0
mov byte [ebp - 4], 7
jne 0x10002b31
xor ecx, ecx
jmp 0x10002b4f
lea ecx, [ebp - 0x294]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002b40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x28]
call fcn.10003150
mov ecx, dword [ebp - 0x2d8]
lea eax, [ebp - 0x28]
push eax
call fcn.100032e0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x10002bc5
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x7fffffff
ja 0x10002cc5
add eax, eax
cmp eax, 0x1000
jb 0x10002bbc
test cl, 0x1f
jne 0x10002cc5
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10002cc5
sub ecx, eax
cmp ecx, 4
jb 0x10002cc5
cmp ecx, 0x23
ja 0x10002cc5
mov ecx, eax
push ecx
call fcn.1000be25
add esp, 4
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x10002c1c
mov ecx, dword [ebp - 0x58]
inc eax
cmp eax, 0x7fffffff
ja 0x10002cc5
add eax, eax
cmp eax, 0x1000
jb 0x10002c13
test cl, 0x1f
jne 0x10002cc5
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10002cc5
sub ecx, eax
cmp ecx, 4
jb 0x10002cc5
cmp ecx, 0x23
ja 0x10002cc5
mov ecx, eax
push ecx
call fcn.1000be25
add esp, 4
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x2d4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100029a0
call fcn.1000b0e0
test al, al
je 0x10002c61
push edi
push edi
push ebp
pop edi
push esi
pop ebx
pop ecx
push ecx
push edi
push esp
pop ecx
pop esi
pop esp
push esi
pop esi
push ecx
push esi
pop edi
pop esi
pop ebp
push edx
push eax
pop edx
pop edx
push edi
push edx
push edi
push esi
pop ebp
pop esi
call fcn.1000b460
test al, al
je 0x10002c7e
push esp
pop esp
push esp
pop edx
push edx
pop edi
pop edi
pop eax
push ebx
push ecx
pop ecx
push ebx
push ebx
pop edi
pop ebp
pop ebx
push ecx
push edi
pop ebp
push edi
call fcn.1000b380
test al, al
je 0x10002ca6
pop esi
pop esp
pop edi
push edx
push ecx
push edi
push edi
pop ecx
push eax
push ebx
push ebp
push eax
push eax
pop ebx
push esp
pop ecx
push esp
pop ecx
pop ebx
push esp
pop edx
pop edx
push ecx
pop edi
pop edi
push ebp
pop esi
pop esi
push ebx
pop eax
pop esi
push dword [ebp - 0x2d4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x10002d0b
mov ecx, dword [ebp - 0x40]
inc eax
cmp eax, 0x7fffffff
jbe 0x10002cca
call fcn.1000fdb1
add eax, eax
cmp eax, 0x1000
jb 0x10002d02
test byte [ebp - 0x40], 0x1f
je 0x10002cde
call fcn.1000fdb1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x10002cea
call fcn.1000fdb1
sub ecx, eax
cmp ecx, 4
jae 0x10002cf6
call fcn.1000fdb1
cmp ecx, 0x23
jbe 0x10002d00
call fcn.1000fdb1
mov ecx, eax
push ecx
call fcn.1000be25
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x10002d8f
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x2d0]
push ecx
push dword [ebp - 0x2cc]
push eax
call fcn.100024a0
mov ecx, dword [ebp - 0x2c8]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x2d0]
add esp, 0x10
sub ecx, esi
imul ecx
lea ecx, [ebp - 0x2d0]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.10003280
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x10002da4
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.10001a00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000be6b
mov esp, ebp
pop ebp
ret