Function at 0x1000e730
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size
Read file on windows

Disassembly:
sub esp, 0x474
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov edi, dword [esp + 0x488]
push edi
mov dword [esp + 0x1c], ecx
call ebp
lea eax, [eax + eax + 0x208]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x1000e779
xor al, al
jmp 0x1000e9eb
push 0x10129668
push edi
push 0x10129678
push edi
mov byte [esp + 0x23], 0
call ebp
lea eax, [eax + eax + 0x208]
mov ebx, esi
call fcn.1000ede0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000e90d
xor eax, eax
push 0xff
push eax
lea ecx, [esp + 0x381]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x384], al
call fcn.100d4cc0
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x20], 0x100
mov dword [esp + 0x1c], 0
jne 0x1000e8fb
cmp dword [esp + 0x24], 0
jne 0x1000e8fb
push 0
lea eax, [esp + 0x20]
push eax
push 0x100
lea ecx, [esp + 0x384]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000e8fb
cmp dword [esp + 0x1c], 0x100
jne 0x1000e8fb
push 0xffffffffffffffff
push str._____BEGIN_PRIVATE_KEY______nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDThEl_fSuUgIAGJCfcLzmhk4_KmxhKqBCkVqAECRWii5DfGDI2Skkp7TrWMljBUwd4dnKjBlle0UFaOBAmq1GZLZmvfaEQfhm1qyMNkPkYT6RuanZ5Y509I2Usxpy_ZKiwqX6Us5mCSMvPhHIf7dNk1pOtvS61Ds22frZ_esf6_jiLNo1MhlDBSEmRytr6hpoWgIEkEg12e4wmhlNVlruRZydrvVCa7dbSDfEo315wLbNniTJTB_aUifBn0JsTg56iem_bsZ7otuaC99Yd9Alnbs8T0C46jRoOJ7mRhnVA5Jto1OQu7M4tMKp3VX1hVKggOh5P4vTJ1mRcAJp4_AgMBAAECggEAd16_A_4mLCbhGZYqEK9uPOvESLmC2g9DZRumLuDZnuRZHC7Rl6YQ6GKDxAKh6GjtXGSsiai5ozNBSKM_KjOhV2tOwqWJ0n74D3jHzY41poxzbVZ0rw5IeWTSykrR8Hd2_AyL7Wv2hHqE21aJc8EcHJQ4cpUo8X4_rdAU219kr1R6BLhrwhW6kxc9lPrJ_CWAdclxJXcvapuRXx0ipPm9Jut5xETCq8GnrMjdysSFXPMA5aJP52hm9RvjzCIPGKR_nm2jJVMsbD2x0CV6HJByT6MfzTluSEf309vCKM2stEOoC_wrXBfBtc7TUfZ4ntS1vhwyJTkZUcFz4ZKhhsQKBgQDym3lNydsxj5TTKsFRuurgDXKLcYZcIiLlmpefxSB7HTqXJsVfpLjp0NGiUmY1PVVVCGLZRC09KMSLN6qB1VBuEBnebsiIKSuGadAy4uiIzd4cORmDyjDyCW5k4pnJ28tnYPYkvJoPjkZNkEf3n9HWFjxOMkOuZnfa1oCchewKBgQDfMXD7p7YlEZhxGkNlK_GsnQhfdVATDbGOcy9euCYr0BeBJwhxXfsrrYi6ehqREnQ4e2zXGYrPxKmTPCWhtJiMOu3Y1mMUuAEJNm1Yjv3ewVAb1YxUK0XqF7Z7JRyL4bFztwIhMSu_R8Lx2FWykoRng2GgmhzR7TzlQer2DQKBgA7PoRM3rJMVAe_2X0D_GVGYGzU7G_5gYnk_TuzCHYAfiyXEBfjQ5xOisfvqnYtCDM7Y0641K_KX3mf4vuVJRFsJBmMRqFXXCePJMUdVF8CuWULVt9Tu8HdmQh9JtNxF1iEeBoXGmNIpactbTXM1fk8D0I_4H38Ts1xbC7AoGAbXkhsr27MIll3SzUbc3dPbdwELFYtNXtENr0hCAM0PabYMTVdk2jkfPnGZgkii5ffm4imhQbJOEl8_JNeemcmeAX1_UI8RcCuCJ2YvxrDtOuEDXWxuWeZzv3NsFRDJ5K6JzHkaOUV5pd7PgZfWlxVRzSA4TZWJn2XnddsOM0CgYEA2lv2ITPwzfh9_WZdz0Cfi9ir_yAcOf81tqLY1Qfub6scU1tALA_fjQijuRgqBHkH2OXoxrYl4BREW4wUObBi6Hro2JlAhR1TmO3clRRsZ8DneKBAWnX044mtKzm3kMKSy5tZYqNNBYPejh_px3kaMjCLMk4B0A9SWg8HObrAg_n_____END_PRIVATE_KEY______n
call fcn.1006bbc0
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000e8fb
push 0
push 0
push 0
push eax
call fcn.10072370
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1000e8e8
push 0xff
lea edx, [esp + 0x27d]
push 0
push edx
mov byte [esp + 0x284], 0
call fcn.100d4cc0
mov edx, dword [esp + 0x28]
add esp, 0xc
push 1
push ebp
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0x384]
push ecx
push edx
call fcn.1006d950
add esp, 0x14
cmp eax, 0x20
jne 0x1000e8df
mov ecx, dword [esp + 0x18]
push eax
lea eax, [esp + 0x27c]
push eax
add ecx, 2
push ecx
call fcn.100d0e10
mov edx, dword [esp + 0x24]
add esp, 0xc
mov byte [edx], 1
mov byte [esp + 0x13], 1
push ebp
call fcn.1006d7b0
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call fcn.1006aa20
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
jne 0x1000e9e0
push edi
push str._ws.
push edi
call ebp
lea eax, [eax + eax + 0x208]
mov ebx, esi
call fcn.1000ede0
push 0x24c
lea ecx, [esp + 0x38]
push 0
push ecx
mov dword [esp + 0x3c], 0
call fcn.100d4cc0
add esp, 0x14
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000e9e0
test byte [esp + 0x28], 0x10
je 0x1000e9c1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x10129d28
lea eax, [esp + 0x58]
push eax
call ebx
test eax, eax
je 0x1000e9c1
push 0x10129d2c
lea ecx, [esp + 0x58]
push ecx
call ebx
test eax, eax
je 0x1000e9c1
lea edx, [esp + 0x54]
push edx
push edi
push 0x10129678
push edi
call ebp
lea eax, [eax + eax + 0x208]
mov ebx, esi
call fcn.1000ede0
mov eax, dword [esp + 0x498]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1000ea06
or eax, eax
mov ecx, dword [esp + 0x18]
push eax
push esi
call fcn.1000e730
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
jne 0x1000e9e0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000e958
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x474
ret 8
add eax, 0xffffffff
jne 0x1000e9b2
mov byte [esp + 0x13], al
jmp 0x1000e9c8