Function at 0x1000ebd0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3dc
mov eax, dword [0x100a0f80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5c
lea ecx, [ebp + 8]
call fcn.10007140
nop
push 0x10072004
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.1000b7e0
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.100062a0
mov dword [ebp - 0x3cc], eax
lea edx, [ebp - 0x374]
push edx
mov eax, dword [ebp - 0x3cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0xffffffff
jne 0x1000ec4b
lea ecx, [ebp - 0x34]
call fcn.10006840
nop
lea ecx, [ebp + 8]
call fcn.10006840
nop
jmp 0x1000f0e5
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0xd0]
push eax
call fcn.1000b7e0
add esp, 0xc
mov dword [ebp - 0x3c8], eax
mov ecx, dword [ebp - 0x3c8]
call fcn.100062a0
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x3c4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x3dc], eax
lea ecx, [ebp - 0xd0]
call fcn.10006840
nop
mov edx, dword [ebp - 0x3dc]
and edx, 0x10
jne 0x1000ecab
jmp 0x1000f0aa
mov dword [ebp - 0x37c], 0x1007200c
lea eax, [ebp - 0x348]
mov dword [ebp - 0x378], eax
mov ecx, dword [ebp - 0x378]
mov dx, word [ecx]
mov word [ebp - 0x396], dx
mov eax, dword [ebp - 0x37c]
cmp dx, word [eax]
jne 0x1000ed27
cmp word [ebp - 0x396], 0
je 0x1000ed1b
mov ecx, dword [ebp - 0x378]
mov dx, word [ecx + 2]
mov word [ebp - 0x398], dx
mov eax, dword [ebp - 0x37c]
cmp dx, word [eax + 2]
jne 0x1000ed27
add dword [ebp - 0x378], 4
add dword [ebp - 0x37c], 4
cmp word [ebp - 0x398], 0
jne 0x1000ecc1
mov dword [ebp - 0x3a8], 0
jmp 0x1000ed32
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x3a8], ecx
mov edx, dword [ebp - 0x3a8]
mov dword [ebp - 0x3d0], edx
cmp dword [ebp - 0x3d0], 0
je 0x1000ee87
mov dword [ebp - 0x384], 0x10072010
lea eax, [ebp - 0x348]
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
mov dx, word [ecx]
mov word [ebp - 0x39a], dx
mov eax, dword [ebp - 0x384]
cmp dx, word [eax]
jne 0x1000edc7
cmp word [ebp - 0x39a], 0
je 0x1000edbb
mov ecx, dword [ebp - 0x380]
mov dx, word [ecx + 2]
mov word [ebp - 0x39c], dx
mov eax, dword [ebp - 0x384]
cmp dx, word [eax + 2]
jne 0x1000edc7
add dword [ebp - 0x380], 4
add dword [ebp - 0x384], 4
cmp word [ebp - 0x39c], 0
jne 0x1000ed61
mov dword [ebp - 0x3a4], 0
jmp 0x1000edd2
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x3a4], ecx
mov edx, dword [ebp - 0x3a4]
mov dword [ebp - 0x3d4], edx
cmp dword [ebp - 0x3d4], 0
je 0x1000ee87
mov dword [ebp - 0x38c], str.SavedVariables
lea eax, [ebp - 0x348]
mov dword [ebp - 0x388], eax
mov ecx, dword [ebp - 0x388]
mov dx, word [ecx]
mov word [ebp - 0x38e], dx
mov eax, dword [ebp - 0x38c]
cmp dx, word [eax]
jne 0x1000ee67
cmp word [ebp - 0x38e], 0
je 0x1000ee5b
mov ecx, dword [ebp - 0x388]
mov dx, word [ecx + 2]
mov word [ebp - 0x390], dx
mov eax, dword [ebp - 0x38c]
cmp dx, word [eax + 2]
jne 0x1000ee67
add dword [ebp - 0x388], 4
add dword [ebp - 0x38c], 4
cmp word [ebp - 0x390], 0
jne 0x1000ee01
mov dword [ebp - 0x3a0], 0
jmp 0x1000ee72
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x3a0], ecx
mov edx, dword [ebp - 0x3a0]
mov dword [ebp - 0x3d8], edx
cmp dword [ebp - 0x3d8], 0
jne 0x1000ee8c
jmp 0x1000f0aa
push 1
lea ecx, [ebp - 0xa0]
call fcn.1003fdd0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x3ac], eax
mov ecx, dword [ebp - 0x3ac]
call fcn.10007bd0
nop
lea ecx, [ebp - 0x1c]
call fcn.100061b0
nop
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.1000b7e0
add esp, 0xc
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3b0]
call fcn.100062a0
mov dword [ebp - 0x3b4], eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x3b4]
push edx
call fcn.10017c50
add esp, 0xc
mov dword [ebp - 0x3c0], eax
lea ecx, [ebp - 0xb8]
call fcn.10006840
nop
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1c]
push eax
call fcn.10004160
sub esp, 0x18
mov ecx, esp
push str.creation_time
call fcn.100041e0
lea ecx, [ebp - 0xa0]
push ecx
call fcn.100178c0
add esp, 0x34
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xe8]
push ecx
call fcn.1000b7e0
add esp, 0xc
mov dword [ebp - 0x3b8], eax
mov ecx, dword [ebp - 0x3b8]
call fcn.100062a0
mov dword [ebp - 0x3bc], eax
push 2
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x3bc]
push eax
call fcn.10017c50
add esp, 0xc
mov dword [ebp - 0x3c0], eax
lea ecx, [ebp - 0xe8]
call fcn.10006840
nop
sub esp, 0x18
mov ecx, esp
lea edx, [ebp - 0x1c]
push edx
call fcn.10004160
sub esp, 0x18
mov ecx, esp
push str.lastwrite_time
call fcn.100041e0
lea eax, [ebp - 0xa0]
push eax
call fcn.100178c0
add esp, 0x34
cmp dword [ebp + 0x24], 0
jle 0x1000f03a
push 1
lea ecx, [ebp - 0x124]
call fcn.1003fdd0
nop
mov ecx, dword [ebp + 0x24]
sub ecx, 1
push ecx
lea edx, [ebp - 0x124]
push edx
sub esp, 0x18
mov eax, esp
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp + 8]
push edx
push eax
call fcn.1000b7e0
add esp, 0xc
call fcn.1000ebd0
add esp, 0x20
sub esp, 0x3c
mov ecx, esp
lea eax, [ebp - 0x124]
push eax
call fcn.10004640
sub esp, 0x18
mov ecx, esp
push str.folders
call fcn.100041e0
lea ecx, [ebp - 0xa0]
call fcn.100411d0
nop
lea ecx, [ebp - 0x124]
call fcn.10004820
nop
lea ecx, [ebp - 0x348]
push ecx
lea ecx, [ebp - 0x64]
call fcn.10004360
push 0
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.1003db90
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.10006840
nop
sub esp, 0x3c
mov ecx, esp
lea edx, [ebp - 0xa0]
push edx
call fcn.10004640
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x4c]
push eax
call fcn.10004160
mov ecx, dword [ebp + 0x20]
call fcn.100411d0
nop
lea ecx, [ebp - 0x4c]
call fcn.10006780
nop
lea ecx, [ebp - 0x1c]
call fcn.10006780
nop
lea ecx, [ebp - 0xa0]
call fcn.10004820
nop
lea ecx, [ebp - 0x374]
push ecx
mov edx, dword [ebp - 0x394]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000ec4b
mov eax, dword [ebp - 0x394]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x34]
call fcn.10006840
nop
lea ecx, [ebp + 8]
call fcn.10006840
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a6b5
mov esp, ebp
pop ebp
ret