Function at 0x1000d220
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ee30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x480
mov al, byte [0x10025224]
push ebx
xor ecx, ecx
xor edx, edx
push esi
push edi
mov byte [ebp - 0x3c], al
mov dword [ebp - 0x3b], ecx
mov byte [ebp - 0x2c], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2b], edx
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x37], ecx
mov dword [ebp - 0x27], edx
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x33], ecx
mov dword [ebp - 0x23], edx
mov dword [ebp - 4], ebx
call fcn.1000da90
add esp, 4
cmp eax, ebx
je 0x1000d5f7
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x34c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1c], 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [ebp - 0x1a], 0x2e
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 0x2a
and ecx, 3
mov byte [ebp - 0x1b], al
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x19], al
lea edi, [ebp - 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x18], bl
lea edx, [ebp - 0x34c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edi
mov edi, 0xe18e3d6d
mov edi, 0xa043e78e
pop edi
lea eax, [ebp - 0x48c]
lea ecx, [ebp - 0x34c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edx, [ebp - 0x48c]
mov dword [ebp - 0x40], eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x1000d326
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
call fcn.10011a22
push eax
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.100036e0
lea ecx, [ebp - 0x3c]
push 9
lea edx, [ebp - 0x2c]
push ecx
push edx
call fcn.10011da0
add esp, 0x1c
mov byte [ebp - 0x23], 0x77
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x76
push eax
mov eax, 0xdbad8157
mov eax, 0xe0a8723e
xor eax, eax
xor eax, edx
pop eax
cmp dword [ebp - 0x1c], ebx
je 0x1000d5c0
mov eax, dword [ebp + 0x14]
cmp dword [eax], ebx
jne 0x1000d5c0
call fcn.100115c0
cmp eax, 0xffffffff
jge 0x1000d389
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 0x40]
lea ecx, [ebp - 0x48c]
push ecx
push edx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
mov dword [ebp - 0x1c], eax
jne 0x1000d365
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x144]
lea edx, [ebp - 0x144]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x14], 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [ebp - 0x13], bl
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [ebp - 0x144]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x144]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x460]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
mov ebp, 0xcdb59f8b
or ebp, ebx
sub ebp, ebx
pop ebp
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x248]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x248]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x248]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x460]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
add eax, esi
xor eax, edx
add eax, esi
add eax, edx
pop eax
cmp byte [ebp + 0x18], bl
je 0x1000d500
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x248]
push eax
lea edx, [ebp - 0x144]
push ecx
push edx
call fcn.1000d610
add esp, 0xc
jmp 0x1000d54c
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x144]
push eax
push ecx
call fcn.10012670
add esp, 8
lea ecx, [ebp - 0x144]
test eax, eax
seta dl
lea eax, [ebp - 0x3c]
push edx
push eax
push ecx
call fcn.10012670
add esp, 8
lea ecx, [ebp - 0x248]
test eax, eax
mov eax, dword [ebp + 0x14]
seta dl
push edx
push eax
lea edx, [ebp - 0x144]
push ecx
push edx
call fcn.1000ced0
add esp, 0x14
and eax, 0xff
cmp eax, ebx
je 0x1000d365
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1000d365
mov esi, eax
lea edi, [ebp - 0x144]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
push ecx
lea eax, [ebp - 0x144]
push 1
push eax
call fcn.10011fcd
lea edi, [ebp - 0x12]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x12], 0xa
mov byte [ebp - 0x11], bl
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [ebp - 0x12]
push 1
push ecx
call fcn.10011fcd
push ecx
add ecx, esi
xor ecx, esp
add ecx, edx
add ecx, eax
nop
pop ecx
push esi
call fcn.10012305
add esp, 0x24
jmp 0x1000d365
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret