Function at 0x10b1e83
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc90
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x34]
xor ebx, ebx
cmp dword [edi + 0x14f4], ebx
mov dword [ebp + 8], edi
jne 0x10b1eba
push 0x834
call fcn.01098a95
cmp eax, ebx
mov dword [edi + 0x14f4], eax
je 0x10b22d0
mov eax, dword [esi + 0x14]
and byte [ebp - 0xa], 0
test byte [eax + 0x9f], 2
mov dword [ebp - 0x14], 0xf750e6c3
mov word [ebp - 0x10], 0x38ee
mov word [ebp - 0xe], 0x11d1
mov byte [ebp - 0xc], 0x85
mov byte [ebp - 0xb], 0xe5
mov byte [ebp - 9], 0xc0
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0xc2
mov byte [ebp - 6], 0x95
mov byte [ebp - 5], 0xee
mov dword [ebp - 4], ebx
jne 0x10b1f0c
mov eax, dword [esi + 4]
cmp byte [eax + 0x30], 6
jne 0x10b1f0c
mov dword [ebp - 4], 1
mov esi, dword [sym.imp.msvcrt.dll__wcsupr]
xor eax, eax
cmp word [ebp - 4], bx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, 0x83
lea edi, [ebp - 0x880]
rep stosd dword es:[edi], eax
jne 0x10b1fa4
lea eax, [ebp - 0x880]
push eax
xor edi, edi
push edi
call sub.sfc_os.dll_SfcGetNextProtectedFile
test eax, eax
je 0x10b1fa4
push 0x208
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0x880]
push eax
call ebx
cmp eax, 0x410
ja 0x10b1f2d
cmp dword [ebp + 0xc], edi
je 0x10b1f82
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc90]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x10b1f2d
lea eax, [ebp - 0xc90]
push eax
call esi
pop ecx
push edi
lea eax, [ebp - 0xc90]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x14f4]
call fcn.01098cd3
jmp 0x10b1f2d
xor eax, eax
mov ecx, 0x104
lea edi, [ebp - 0x424]
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x424]
push eax
push 0x1012710
call ebx
cmp dword [ebp + 0xc], 0
je 0x10b2005
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x10b2005
mov eax, dword [ebp + 8]
push 1
push dword [eax + 0x14f4]
call fcn.01098bda
xor ax, ax
jmp 0x10b22d4
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
lea edi, [ebp + eax*2 - 0x424]
lea eax, [ebp - 0x424]
mov dword [esp], 0x10126f8
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x424]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x10b209d
lea eax, [ebp - 0x648]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
push edi
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x14f4]
call fcn.01098cd3
lea eax, [ebp - 0x674]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10b2055
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10126cc
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x424]
push eax
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x14f4]
call fcn.01098cd3
xor eax, eax
mov ecx, 0x104
lea edi, [ebp - 0x424]
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x424]
push eax
push 0x1012678
call ebx
lea eax, [ebp - 0x424]
push eax
call esi
pop ecx
push 0
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x14f4]
call fcn.01098cd3
xor eax, eax
mov ecx, 0x104
lea edi, [ebp - 0x424]
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x424]
push eax
push 0x10125b0
call ebx
lea eax, [ebp - 0x424]
push eax
call esi
pop ecx
push 0
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x14f4]
call fcn.01098cd3
xor eax, eax
cmp word [ebp - 4], ax
mov ecx, 0x104
lea edi, [ebp - 0x424]
rep stosd dword es:[edi], eax
jne 0x10b1fed
push 0x208
lea eax, [ebp - 0x424]
push eax
push 0x1012570
call ebx
lea eax, [ebp - 0x424]
push eax
lea edi, [ebp - 0x11]
call dword [sym.imp.msvcrt.dll_wcslen]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + eax*2 - 0x424]
pop ecx
mov dword [ebp + 0xc], eax
xor ebx, ebx
cmp ebx, 4
je 0x10b21b3
cmp ebx, 6
je 0x10b21b3
cmp ebx, 8
je 0x10b21b3
cmp ebx, 0xa
jne 0x10b21ed
mov eax, dword [ebp + 0xc]
add dword [ebp + 0xc], 2
cmp ebx, 4
mov word [eax], 0x2d
jne 0x10b21c7
lea edi, [ebp - 0xf]
cmp ebx, 6
jne 0x10b21cf
lea edi, [ebp - 0xd]
cmp ebx, 8
jne 0x10b21de
mov dword [ebp - 4], 1
lea edi, [ebp - 0xc]
cmp ebx, 0xa
jne 0x10b21ed
mov dword [ebp - 4], 1
lea edi, [ebp - 0xa]
movzx eax, byte [edi]
push eax
push 0x1012564
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_swprintf]
add edi, dword [ebp - 4]
add dword [ebp + 0xc], 4
add esp, 0xc
inc ebx
cmp ebx, 0x10
jl 0x10b219f
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x424]
push 0x1012560
push eax
call edi
lea eax, [ebp - 0x424]
push 0x1004284
push eax
call edi
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
lea ebx, [ebp + eax*2 - 0x424]
lea eax, [ebp - 0x424]
push eax
call esi
lea eax, [ebp - 0x424]
push 0x1005528
push eax
call edi
add esp, 0x20
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10b1fed
lea eax, [ebp - 0x648]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
push ebx
call esi
add esp, 0xc
test byte [ebp - 0x674], 0x10
jne 0x10b22b2
push 1
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x14f4]
call fcn.01098cd3
lea eax, [ebp - 0x674]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10b227e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10b1fed
mov ax, 0xfe07
pop edi
pop esi
pop ebx
leave
ret 8