Function at 0x10001bc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10014f38
push 0x10004770
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x10016050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x27c], esi
push 0x208
call fcn.10003331
mov ebx, eax
mov dword [ebp - 0x284], ebx
push 0x208
call fcn.10003331
mov dword [ebp - 0x270], eax
push 0x208
call fcn.10003331
mov edi, eax
mov dword [ebp - 0x280], edi
push 0x208
call fcn.10003331
add esp, 0x10
mov dword [ebp - 0x278], eax
mov dword [ebp - 4], esi
push 0x208
push esi
push ebx
call fcn.10008130
push 0x208
push esi
push dword [ebp - 0x270]
call fcn.10008130
push 0x208
push esi
push edi
call fcn.10008130
push 0x208
push esi
push dword [ebp - 0x278]
call fcn.10008130
add esp, 0x30
push ebx
call fcn.10002ba0
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push ecx
push ebx
push ecx
mov ecx, dword [ebp - 0x270]
call fcn.10001080
push 0x100145fc
mov ecx, dword [ebp - 0x270]
call fcn.100019b0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x10001e13
mov esi, eax
jmp 0x10001ce0
mov ecx, 0x10014604
lea eax, [ebp - 0x240]
jmp 0x10001cf0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001d16
test dx, dx
je 0x10001d12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001d16
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001cf0
xor eax, eax
jmp 0x10001d1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10001deb
mov ecx, 0x10014608
lea eax, [ebp - 0x240]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001d56
test dx, dx
je 0x10001d52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001d56
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001d30
xor eax, eax
jmp 0x10001d5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10001deb
test byte [ebp - 0x26c], 0x10
jne 0x10001deb
push ecx
push ebx
push ecx
mov ecx, edi
call fcn.10001080
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x240]
push eax
mov ecx, edi
call fcn.100019b0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ecx
push eax
push ecx
mov esi, dword [ebp - 0x278]
mov ecx, esi
call fcn.10001080
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
mov ecx, str..DLL
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001dd6
test dx, dx
je 0x10001dd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001dd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001db0
xor eax, eax
jmp 0x10001ddb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10001de5
push edi
call fcn.100020b0
mov esi, dword [ebp - 0x274]
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10001ce0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
mov dword [ebp - 0x27c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.10001e4f
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100031c5
mov esp, ebp
pop ebp
ret