Function at 0x1001b210
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x674
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x670], eax
mov eax, dword [esp + 0x67c]
push ebp
mov ebp, dword [esp + 0x67c]
push esi
push edi
push 0x206
lea ecx, [esp + 0x26e]
push 0
push ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov word [esp + 0x274], 0
call fcn.1003d360
add esp, 0xc
push 0x206
lea edx, [esp + 0x476]
push 0
push edx
mov word [esp + 0x47c], 0
call fcn.1003d360
lea eax, [esp + 0x274]
mov esi, ebp
mov ecx, eax
add esp, 0xc
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001b2c0
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b2c0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b2a0
jmp 0x1001b2c4
test edx, edx
jne 0x1001b2c7
sub eax, 2
lea edx, [esp + 0x268]
push edx
mov word [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, 0x104
lea eax, [esp + 0x268]
cmp word [eax], 0
je 0x1001b2f6
add eax, 2
sub ecx, 1
jne 0x1001b2e6
jmp 0x1001b319
test ecx, ecx
je 0x1001b319
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x268]
mov eax, str..WIM
call fcn.100067e0
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x26c]
push ecx
call edi
cmp eax, 0xffffffff
je 0x1001b3d9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x44]
push str.winre.wim
push edx
call fcn.1003c8ff
add esp, 8
test eax, eax
je 0x1001b3d9
lea eax, [esp + 0x44]
push str.boot.wim
push eax
call fcn.1003c8ff
add esp, 8
test eax, eax
je 0x1001b3d9
mov esi, dword [esp + 0x68c]
test esi, esi
je 0x1001b392
cmp esi, 0x7fffffff
ja 0x1001b392
mov edi, dword [esp + 0xc]
mov eax, ebp
mov edx, esi
mov ecx, edi
call fcn.10002060
jmp 0x1001b396
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [esp + 0x44]
push ecx
push esi
push edi
call fcn.10006750
push edi
push str._s_found_as_Recovery_Image.
call fcn.100020c0
call fcn.1001e660
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x670]
xor ecx, esp
call fcn.1003c13d
add esp, 0x674
ret
mov edx, 0x104
lea eax, [esp + 0x268]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001b405
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b405
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b3e5
jmp 0x1001b409
test edx, edx
jne 0x1001b40c
sub eax, 2
lea edx, [esp + 0x268]
push edx
mov word [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, 0x104
lea eax, [esp + 0x268]
jmp 0x1001b430
cmp word [eax], 0
je 0x1001b440
add eax, 2
sub ecx, 1
jne 0x1001b430
jmp 0x1001b463
test ecx, ecx
je 0x1001b463
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x268]
mov eax, 0x1005877c
call fcn.100067e0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x26c]
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x1001b5e7
mov ebp, dword [esp + 0x68c]
mov ecx, 0x10058784
lea eax, [esp + 0x44]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001b4b6
test dx, dx
je 0x1001b4b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001b4b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001b490
xor eax, eax
jmp 0x1001b4bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1001b5c2
mov ecx, 0x10058788
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001b4f6
test dx, dx
je 0x1001b4f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001b4f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001b4d0
xor eax, eax
jmp 0x1001b4fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1001b5c2
mov eax, dword [esp + 0x18]
test al, 0x10
je 0x1001b5c2
test eax, 0x400
jne 0x1001b5c2
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x470]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001b550
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b550
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b530
jmp 0x1001b554
test edx, edx
jne 0x1001b557
sub eax, 2
lea edx, [esp + 0x470]
push edx
mov word [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, 0x104
lea eax, [esp + 0x470]
cmp word [eax], 0
je 0x1001b586
add eax, 2
sub ecx, 1
jne 0x1001b576
jmp 0x1001b5a8
test ecx, ecx
je 0x1001b5a8
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x470]
lea eax, [esp + 0x44]
call fcn.100067e0
mov eax, dword [esp + 0xc]
push ebp
push eax
lea ecx, [esp + 0x478]
push ecx
call fcn.1001b210
add esp, 0xc
test eax, eax
jne 0x1001b5d8
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001b484
jmp 0x1001b5e0
mov dword [esp + 0x10], 1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x67c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1003c13d
add esp, 0x674
ret