Function at 0x4ad1bf0c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x268], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x264], edi
xor esi, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x4ad1bf4d
sub eax, ecx
sar eax, 1
mov ecx, edi
cmp word [edi], si
je 0x4ad1bf85
mov edx, ecx
mov bx, word [ecx]
inc ecx
inc ecx
test bx, bx
jne 0x4ad1bf64
mov ebx, ecx
sub ebx, edx
sar ebx, 1
add ebx, eax
add esi, ebx
cmp word [ecx], 0
jne 0x4ad1bf62
xor eax, eax
cmp ax, si
jne 0x4ad1bf8c
xor eax, eax
jmp 0x4ad1c209
inc esi
movzx eax, si
mov dword [ebp - 0x258], eax
add eax, eax
push eax
call fcn.4ad01896
mov ebx, eax
test ebx, ebx
jne 0x4ad1bfac
xor eax, eax
inc eax
jmp 0x4ad1c209
mov eax, edi
cmp word [eax], 0
mov esi, ebx
je 0x4ad1bffa
push dword [ebp - 0x25c]
mov eax, dword [ebp - 0x258]
mov ecx, esi
sub ecx, ebx
sar ecx, 1
sub eax, ecx
push eax
push esi
mov dword [ebp - 0x26c], eax
call fcn.4ad0185a
push edi
push dword [ebp - 0x26c]
push esi
call fcn.4ad020a9
push edi
call fcn.4ad0413b
push esi
mov edi, eax
call fcn.4ad0413b
cmp word [edi], 0
mov esi, eax
jne 0x4ad1bfb6
push 1
push ebx
push dword [ebp + 0x14]
xor eax, eax
push dword [ebp - 0x260]
mov word [esi], ax
push dword [ebp - 0x268]
call fcn.4ad0e342
push ebx
mov edi, eax
call fcn.4ad0142e
mov eax, dword [ebp - 0x25c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad1c027
sub eax, ecx
sar eax, 1
lea ebx, [eax + 2]
lea eax, [ebx + ebx]
push eax
call fcn.4ad01896
mov esi, eax
mov dword [ebp - 0x258], esi
test esi, esi
je 0x4ad1bfa4
push dword [ebp - 0x25c]
push ebx
push esi
call fcn.4ad0185a
push esi
call fcn.4ad02ed1
push 0x4ad09ffc
mov esi, eax
push ebx
push dword [ebp - 0x258]
inc esi
inc esi
call fcn.4ad020a9
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
mov dword [ebp - 0x25c], eax
mov word [esi], cx
cmp eax, 0xffffffff
je 0x4ad1c1fc
test byte [ebp - 0x254], 0x10
je 0x4ad1c1d1
mov ecx, 0x4ad02ec4
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ad1c0de
test dx, dx
je 0x4ad1c0da
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad1c0de
add eax, 4
add ecx, 4
test dx, dx
jne 0x4ad1c0b8
xor eax, eax
jmp 0x4ad1c0e3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad1c1d1
mov ecx, 0x4ad02ebc
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ad1c11c
test dx, dx
je 0x4ad1c118
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad1c11c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4ad1c0f6
xor eax, eax
jmp 0x4ad1c121
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad1c1d1
mov eax, dword [ebp - 0x258]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1c132
sub eax, edx
sar eax, 1
mov ecx, eax
lea eax, [ebp - 0x228]
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x4ad1c14b
sub eax, edx
sar eax, 1
lea edi, [eax + ecx + 2]
cmp edi, ebx
jle 0x4ad1c186
lea eax, [edi + edi]
push eax
push dword [ebp - 0x258]
call fcn.4ad02536
test eax, eax
je 0x4ad1c1ed
push eax
mov dword [ebp - 0x258], eax
mov ebx, edi
call fcn.4ad02ed1
mov esi, eax
inc esi
inc esi
lea eax, [ebp - 0x228]
push eax
push ebx
push dword [ebp - 0x258]
call fcn.4ad020a9
push 0x4ad02ec8
push ebx
push dword [ebp - 0x258]
call fcn.4ad020a9
push dword [ebp - 0x264]
push dword [ebp + 0x14]
push dword [ebp - 0x260]
push dword [ebp - 0x268]
push dword [ebp - 0x258]
call fcn.4ad1bf0c
mov edi, eax
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4ad1c1f0
jmp 0x4ad1c0a0
xor edi, edi
inc edi
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x258]
call fcn.4ad0142e
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 0x14