Function at 0x1000c191
Capabilities:
Enumerate files on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xea4
mov eax, dword [0x100400b0]
xor eax, esp
mov dword [esp + 0xea0], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
test edi, edi
je 0x1000c24c
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x1000c1ce
sub esi, ecx
lea eax, [esp + 0x270]
sar esi, 1
cmp edi, eax
je 0x1000c1fe
push ecx
push edi
mov edx, 0x104
mov ecx, eax
call fcn.1001a1a1
test eax, eax
je 0x1000c5f1
push 0x5c
pop eax
cmp ax, word [esp + esi*2 + 0x26e]
je 0x1000c230
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1000c5f1
push str..id
mov edx, 0x104
lea ecx, [esp + 0x274]
call fcn.1001a1a1
mov esi, dword [esp + 0x14]
jmp 0x1000c24e
mov eax, ebx
test eax, eax
je 0x1000c5f1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x1000c4be
test esi, esi
je 0x1000c3bf
test edi, edi
je 0x1000c301
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x1000c287
sub esi, ecx
lea eax, [esp + 0x478]
sar esi, 1
cmp edi, eax
je 0x1000c2b7
push ecx
push edi
mov edx, 0x104
mov ecx, eax
call fcn.1001a1a1
test eax, eax
je 0x1000c5f1
push 0x5c
pop eax
cmp ax, word [esp + esi*2 + 0x476]
je 0x1000c2e9
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x480]
push 0x104
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1000c5f1
push str.content.inf
mov edx, 0x104
lea ecx, [esp + 0x47c]
call fcn.1001a1a1
jmp 0x1000c303
mov eax, ebx
test eax, eax
je 0x1000c5f1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x1000c3bf
push eax
call dword [sym.imp.kernel32.dll_FindClose]
push ebx
push 0x4000080
push 3
push ebx
push ebx
push SysReAllocString
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c5f1
mov ecx, esi
call fcn.1001a1a1
cmp eax, 0xfeff
je 0x1000c383
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
test eax, eax
je 0x1000c383
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0x8000ffff
jmp 0x1000c5f6
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.1001a1a1
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test edi, edi
jns 0x1000c3a2
mov eax, edi
jmp 0x1000c5f6
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], ebx
jle 0x1000c5f1
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax], cx
xor eax, eax
jmp 0x1000c5f6
test edi, edi
je 0x1000c442
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x1000c3c8
sub esi, ecx
lea eax, [esp + 0x270]
sar esi, 1
cmp edi, eax
je 0x1000c3f8
push ecx
push edi
mov edx, 0x104
mov ecx, eax
call fcn.1001a1a1
test eax, eax
je 0x1000c5f1
push 0x5c
pop eax
cmp ax, word [esp + esi*2 + 0x26e]
je 0x1000c42a
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1000c5f1
push 0x10039754
mov edx, 0x104
lea ecx, [esp + 0x274]
call fcn.1001a1a1
jmp 0x1000c444
mov eax, ebx
test eax, eax
je 0x1000c5f1
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
cmp esi, 0xffffffff
jne 0x1000c474
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
setne al
jmp 0x1000c47b
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
je 0x1000c4b6
inc ebx
test byte [esp + 0x20], 0x10
jne 0x1000c450
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000c5f1
push 0xffffffffffffffff
lea ecx, [esp + 0x50]
push ecx
push 0x824
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
jne 0x1000c3b8
jmp 0x1000c5f1
cmp ebx, 2
jmp 0x1000c3a9
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test edi, edi
je 0x1000c548
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x1000c4ce
sub esi, ecx
lea eax, [esp + 0x270]
sar esi, 1
cmp edi, eax
je 0x1000c4fe
push ecx
push edi
mov edx, 0x104
mov ecx, eax
call fcn.1001a1a1
test eax, eax
je 0x1000c5f1
push 0x5c
pop eax
cmp ax, word [esp + esi*2 + 0x26e]
je 0x1000c530
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1000c5f1
lea eax, [esp + 0x4c]
mov edx, 0x104
push eax
lea ecx, [esp + 0x274]
call fcn.1001a1a1
jmp 0x1000c54a
mov eax, ebx
test eax, eax
je 0x1000c5f1
push ebx
push 0x4000080
push 3
push ebx
push ebx
push SysReAllocString
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c5f1
push ebx
lea eax, [esp + 0x1c]
mov edi, 0x824
push eax
push edi
lea eax, [esp + 0x68c]
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1000c5ea
cmp dword [esp + 0x18], edi
je 0x1000c5ea
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
cmp eax, edi
jae 0x1000c60d
mov byte [esp + eax + 0x680], bl
lea eax, [esp + 0x680]
push 0xd
push eax
call fcn.1001e0f5
pop ecx
pop ecx
test eax, eax
je 0x1000c5c8
mov byte [eax], bl
mov eax, dword [esp + 0x10]
push edi
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x68c]
push eax
push 1
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x1000c5f1
jmp 0x1000c3b8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0x80040013
mov ecx, dword [esp + 0xeac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c65c
mov esp, ebp
pop ebp
ret 8
call fcn.1001a1a1
int3