Function at 0x1004dfb0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100c5328]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x100c5eb8], 0
jne 0x1004e0d8
mov al, byte [0x100c30d9]
xor al, 0x86
mov byte [0x100c30e3], al
mov al, byte [0x100c30da]
xor al, 0x93
mov byte [0x100c30e4], al
mov al, byte [0x100c30db]
xor al, 0xa9
mov byte [0x100c30e5], al
mov al, byte [0x100c30dc]
xor al, 0xa2
mov byte [0x100c30e6], al
mov al, byte [0x100c30dd]
xor al, 0xc4
mov byte [0x100c30e7], al
mov al, byte [0x100c30de]
xor al, 0xd9
mov byte [0x100c30e8], al
mov al, byte [0x100c30df]
xor al, 0x63
mov byte [0x100c30e9], al
mov al, byte [0x100c30e0]
xor al, 0xe7
mov byte [0x100c30ea], al
mov al, byte [0x100c30e1]
xor al, 0xc7
mov byte [0x100c30eb], al
mov al, byte [0x100c30e2]
xor al, 0xfe
mov byte [0x100c30ec], al
mov al, byte [0x100c30ed]
xor al, 0xd4
mov byte [0x100c30f8], al
mov al, byte [0x100c30ee]
xor al, 0xe3
mov byte [0x100c30f9], al
mov al, byte [0x100c30ef]
xor al, 0xf2
mov byte [0x100c30fa], al
mov al, byte [0x100c30f0]
xor al, 0xe5
mov byte [0x100c30fb], al
mov al, byte [0x100c30f1]
xor al, 0xd4
mov byte [0x100c30fc], al
mov al, byte [0x100c30f2]
xor al, 0xc6
mov byte [0x100c30fd], al
mov al, byte [0x100c30f3]
xor al, 0x40
mov byte [0x100c30fe], al
mov al, byte [0x100c30f4]
xor al, 0x75
mov byte [0x100c30ff], al
mov al, byte [0x100c30f5]
xor al, 9
mov byte [0x100c3100], al
mov al, byte [0x100c30f6]
xor al, 0xbc
mov byte [0x100c3101], al
mov al, byte [0x100c30f7]
xor al, 6
mov byte [0x100c3102], al
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov dword [0x100c5eb8], 1
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov ecx, esp
mov dword [ebp - 0x38], ecx
push eax
mov edx, esp
mov dword [ebp - 0x34], edx
sub esp, 0x140
mov eax, esp
mov dword [ebp - 0x30], eax
push eax
mov ebx, esp
mov dword [ebp - 0x1c], ebx
sub esp, 0xc8
mov ebx, esp
mov dword [ebp - 0x20], ebx
sub esp, 0x1f4
mov ebx, esp
mov dword [ebp - 0x2c], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x28], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x24], ebx
mov dword [ecx], edi
mov dword [edx], esi
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x20]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
lea eax, str.Program_Files
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc8
call fcn.1006fef0
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov eax, dword [eax]
mov ecx, 0xffffffff
cmp eax, ecx
je 0x1004e474
jmp 0x1004e188
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0x10
cmp eax, 0
je 0x1004e3f2
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100b848c
call fcn.1008de30
add esp, 8
cmp eax, 0
je 0x1004e3ed
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100b848e
call fcn.1008de30
add esp, 8
cmp eax, 0
je 0x1004e3ed
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [0x100b8491]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004b970
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov edx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1008dd30
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov eax, dword [ebp - 0x30]
add eax, 0x2c
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1008dd40
mov ecx, dword [ebp - 0x2c]
add esp, 8
lea eax, [0x100b8493]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1008dd40
add esp, 8
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call fcn.1004cf30
add esp, 4
test al, 1
jne 0x1004e26e
jmp 0x1004e273
jmp 0x1004e430
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004e4a0
add esp, 8
cmp eax, 0
jne 0x1004e2e6
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x96
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004e4a0
add esp, 8
cmp eax, 0
jne 0x1004e2e6
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x32
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004e4a0
add esp, 8
cmp eax, 0
jne 0x1004e2e6
jmp 0x1004e430
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, dword [0x100c30f8]
mov dword [esi], edi
mov edi, dword [0x100c30fc]
mov dword [esi + 4], edi
mov di, word [0x100c3100]
mov word [esi + 8], di
mov bl, byte [0x100c3102]
mov byte [esi + 0xa], bl
mov esi, dword [0x100c30e3]
mov dword [edx], esi
mov esi, dword [0x100c30e7]
mov dword [edx + 4], esi
mov si, word [0x100c30eb]
mov word [edx + 8], si
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004e4a0
add esp, 8
cmp eax, 0
je 0x1004e39d
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004e4a0
add esp, 8
cmp eax, 0
jne 0x1004e398
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004e4a0
add esp, 8
cmp eax, 0
jne 0x1004e398
jmp 0x1004e430
jmp 0x1004e39d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004dfb0
add esp, 8
cmp eax, 0
je 0x1004e3e8
sub esp, 8
mov dword [esp], 5
mov dword [esp + 4], 8
call fcn.1000d700
add esp, 8
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
jmp 0x1004e47d
jmp 0x1004e3ed
jmp 0x1004e42b
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1008de30
add esp, 8
cmp eax, 0
jne 0x1004e426
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
jmp 0x1004e47d
jmp 0x1004e42b
jmp 0x1004e430
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 0
jne 0x1004e188
sub esp, 4
mov dword [esp], 5
call fcn.1001ed20
mov eax, dword [ebp - 0x1c]
add esp, 4
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d02f
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret