Function at 0x100bb5b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8127
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x102a000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2e0], ecx
mov ecx, dword [ebp + 0xc]
mov edx, ecx
mov dword [ebp - 0x2e4], ecx
cmp dword [ecx + 0x14], 8
jb 0x100bb5f7
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
mov esi, ecx
lea ebx, [edx + eax*2]
jb 0x100bb603
mov esi, dword [ecx]
mov eax, ebx
mov dword [ebp - 0x88], 0
sub eax, esi
mov dword [ebp - 0x78], 0
sar eax, 1
lea ecx, [ebp - 0x88]
push eax
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000dd90
mov byte [ebp - 0x2dc], 0
lea ecx, [ebp - 0x88]
push dword [ebp - 0x2dc]
push ebx
push esi
call fcn.1001ce90
mov ebx, dword [ebp - 0x2e4]
mov eax, ebx
mov dword [ebp - 4], 0
cmp dword [ebx + 0x14], 8
jb 0x100bb665
mov eax, dword [ebx]
lea ecx, [ebp - 0x2d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2dc], eax
cmp eax, 0xffffffff
je 0x100bbb5f
mov edi, dword [ebp + 8]
mov esi, eax
nop word [eax + eax]
mov ecx, 0x102926a0
lea eax, [ebp - 0x2ac]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100bb6c6
test dx, dx
je 0x100bb6c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100bb6c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100bb6a0
xor eax, eax
jmp 0x100bb6cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x100bbb42
mov ecx, 0x102926a4
lea eax, [ebp - 0x2ac]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100bb706
test dx, dx
je 0x100bb702
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100bb706
add eax, 4
add ecx, 4
test dx, dx
jne 0x100bb6e0
xor eax, eax
jmp 0x100bb70b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100bbb42
test byte [ebp - 0x2d8], 0x10
je 0x100bb815
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x100bb72a
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bb750
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.1000e4e0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x30]
dec ecx
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x30], ecx
cmovae eax, dword [ebp - 0x40]
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x2ac]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bb790
sub ecx, edx
lea eax, [ebp - 0x2ac]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.1000f1a0
push 2
push 0x10292618
lea ecx, [ebp - 0x40]
call fcn.1000f1a0
mov ecx, dword [ebp - 0x2e0]
lea eax, [ebp - 0x40]
push eax
push edi
call fcn.100bb5b0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x100bbb3c
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100bb806
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100bbbd9
push edx
push ecx
call fcn.1001eec9
add esp, 8
jmp 0x100bbb3c
xor eax, eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x70], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bb840
sub ecx, edx
lea eax, [ebp - 0x2ac]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.1000e4e0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
lea edi, [ebp - 0x70]
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x70]
cmovae edi, dword [ebp - 0x70]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
lea ebx, [edx + eax*2]
mov dword [ebp - 0x14], 0xf
mov eax, ebx
mov byte [ebp - 0x28], 0
sub eax, edi
sar eax, 1
push eax
call fcn.1000dd90
mov byte [ebp - 0x2e8], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2e8]
push ebx
push edi
call fcn.1001ce90
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.10008560
mov byte [ebp - 4], 4
lea eax, [ebp - 0x58]
mov ecx, dword [ebp - 0x48]
dec ecx
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x48], ecx
cmovae eax, dword [ebp - 0x58]
mov byte [eax + ecx], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x58]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.1000ba50
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2ec], ecx
cmp eax, 5
jb 0x100bb996
lea ebx, [eax + ecx]
lea eax, [ebx - 4]
sub eax, ecx
push eax
push 0x2e
push ecx
call fcn.100234e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100bb996
mov ecx, esi
mov edx, str..cfpl
mov edi, 1
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100bb94e
add ecx, 4
mov edi, 0xfffffffd
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100bb975
cmp edi, 0xfffffffd
je 0x100bb971
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100bb975
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100bb975
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x100bb975
xor eax, eax
jmp 0x100bb97a
sbb eax, eax
or eax, 1
test eax, eax
je 0x100bb9f4
inc esi
lea eax, [ebx - 4]
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100234e0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100bb931
cmp dword [ebp - 0x14], 0x10
lea edi, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae edi, dword [ebp - 0x28]
cmp ecx, 4
jb 0x100bba3d
lea ebx, [ecx + edi]
lea eax, [ebx - 3]
sub eax, edi
push eax
push 0x2e
push edi
call fcn.100234e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100bba3d
mov edx, esi
mov ecx, str..hpl
mov eax, dword [edx]
cmp eax, dword [ecx]
je 0x100bb9f0
cmp al, byte [ecx]
jne 0x100bba18
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x100bba18
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x100bba18
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x100bba18
xor eax, eax
jmp 0x100bba1d
sub esi, dword [ebp - 0x2ec]
cmp esi, 0xffffffff
je 0x100bb996
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x2e0]
push edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.100bb330
jmp 0x100bba64
sbb eax, eax
or eax, 1
test eax, eax
je 0x100bbb8a
inc esi
lea eax, [ebx - 3]
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100234e0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100bb9c7
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov eax, dword [0x102b3490]
cmovae edx, dword [ebp - 0x28]
push str..cfpl
push edx
mov ecx, dword [eax]
push str._error__Unable_to_open__s_:_not_an__s_file_n
push eax
call dword [ecx + 4]
mov edi, dword [ebp + 8]
add esp, 0x10
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x100bba9c
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100bba92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100bbbd9
push edx
push ecx
call fcn.1001eec9
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x100bbae6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100bbadc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100bbbd9
push edx
push ecx
call fcn.1001eec9
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 8
jb 0x100bbb36
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100bbb2c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100bbbd9
push edx
push ecx
call fcn.1001eec9
add esp, 8
mov ebx, dword [ebp - 0x2e4]
mov esi, dword [ebp - 0x2dc]
lea eax, [ebp - 0x2d8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100bb690
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x74]
cmp edx, 0x10
jb 0x100bbbbb
mov ecx, dword [ebp - 0x88]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100bbbb1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100bbbd9
jmp 0x100bbbb1
sub esi, edi
cmp esi, 0xffffffff
je 0x100bba3d
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x2e0]
push edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.100bada0
jmp 0x100bba64
push edx
push ecx
call fcn.1001eec9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001e883
mov esp, ebp
pop ebp
ret 8
call fcn.1002d464
int3