Function at 0x10007ffd
Capabilities:
Enumerate files on windows
Enumerate files recursively
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x100a82b0]
xor eax, esp
mov dword [esp + 0x278], eax
cmp dword [ebp + 0x24], 0x32
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x20]
push esi
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
jbe 0x1000803f
mov al, 1
jmp 0x10008342
mov edi, ecx
mov eax, ebx
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x18], edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10008054
sub eax, edx
sar eax, 1
lea eax, [ebx + eax*2]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
cmp word [ecx], si
je 0x1000818c
movzx eax, word [edi]
push 0x3f
pop ecx
cmp cx, ax
je 0x10008162
push 0x2a
pop ecx
cmp cx, ax
je 0x10008162
push 0x25
pop ecx
cmp cx, ax
jne 0x10008149
push 2
pop ecx
add edi, ecx
mov ebx, edi
jmp 0x100080b1
test ax, ax
je 0x10008206
add edi, ecx
movzx eax, word [edi]
push 0x25
pop edx
cmp dx, ax
jne 0x100080a6
cmp word [edi], 0
je 0x10008206
add edi, ecx
mov esi, edi
xor eax, eax
sub esi, ebx
mov dword [esp + 0x20], eax
sar esi, 1
mov eax, esi
mul ecx
mov ecx, dword [esp + 0x20]
seto cl
mov dword [esp + 0x18], edi
neg ecx
or ecx, eax
push ecx
call fcn.10059bd9
mov edi, eax
pop ecx
test edi, edi
je 0x10008206
lea eax, [esi - 1]
push eax
push ebx
push esi
push edi
call fcn.1005a527
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x10
push 0
push 0
push edi
call ebx
mov esi, eax
cmp dword [ebp + 0x10], esi
jb 0x100081ff
push dword [ebp + 0x10]
push dword [esp + 0x18]
push edi
call ebx
mov eax, dword [esp + 0x14]
sub dword [ebp + 0x10], esi
lea eax, [eax + esi*2 - 2]
push edi
mov dword [esp + 0x18], eax
call fcn.1005a1d0
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
pop ecx
jmp 0x10008182
push 0x5c
pop ecx
cmp cx, ax
jne 0x10008167
cmp byte [esp + 0x13], 0
jne 0x1000818c
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
jmp 0x10008167
mov byte [esp + 0x13], 1
dec dword [ebp + 0x10]
je 0x10008206
mov ecx, dword [esp + 0x14]
add dword [esp + 0x14], 2
inc edi
inc edi
mov word [ecx], ax
mov dword [esp + 0x18], edi
cmp word [edi], 0
jne 0x10008076
mov ecx, dword [esp + 0x14]
xor eax, eax
mov word [ecx], ax
cmp word [ebx], ax
je 0x10008206
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1000819f
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebx + eax*2]
je 0x10008206
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x10008334
push 4
pop ebx
mov ecx, 0x100937a4
lea eax, [esp + 0x5c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000820d
test dx, dx
je 0x100081fb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000820d
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x100081db
xor eax, eax
jmp 0x10008212
push edi
call fcn.1005a1d0
pop ecx
xor al, al
jmp 0x10008342
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000831d
mov ecx, 0x100937a8
lea eax, [esp + 0x5c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10008247
test dx, dx
je 0x10008243
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10008247
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x10008223
xor eax, eax
jmp 0x1000824c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000831d
mov esi, dword [esp + 0x14]
sub esi, dword [esp + 0x1c]
sar esi, 1
add esi, dword [ebp + 0x10]
je 0x1000831d
lea eax, [esp + 0x5c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1000826e
sub eax, edx
sar eax, 1
dec esi
mov edi, eax
je 0x10008334
mov ecx, dword [esp + 0x1c]
push 0x5c
pop eax
mov word [ecx], ax
cmp esi, edi
jbe 0x1000831d
lea eax, [esp + 0x5c]
push eax
mov eax, ecx
add eax, 2
push esi
push eax
call fcn.1005ab9a
mov eax, dword [esp + 0x24]
add esp, 0xc
sub esi, edi
cmp word [eax], 0
jne 0x100082ea
cmp byte [ebp + 0x14], 0
je 0x100082c4
test byte [esp + 0x30], 0x10
jne 0x100082d4
cmp byte [ebp + 0x18], 0
je 0x1000831d
test dword [esp + 0x30], 0x10
jne 0x1000831d
push dword [esp + 0x2c]
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x2c]
call dword [esp + 0x34]
add esp, 0xc
jmp 0x10008315
test byte [esp + 0x30], 0x10
je 0x1000831d
mov eax, dword [ebp + 0x24]
inc eax
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call fcn.10007ffd
add esp, 0x20
mov byte [esp + 0x12], al
test al, al
jne 0x10008334
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100081d2
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0x12]
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10059ccb
mov esp, ebp
pop ebp
ret