Function at 0x1015bf60
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0xa74
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0xa70], eax
mov eax, dword [esp + 0xa84]
mov ecx, dword [esp + 0xa88]
push ebx
mov ebx, dword [esp + 0xa7c]
push esi
mov esi, dword [esp + 0xa84]
mov dword [eax], 0
mov dword [esp + 0x20], ecx
mov dword [ecx], 0
mov ecx, esi
push edi
mov dword [esp + 0x20], eax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1015bfb0
sub ecx, edx
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
lea edi, [ecx + 1]
lea eax, [edi + edi]
push eax
push ebx
call fcn.100dc800
add esp, 0xc
test eax, eax
jne 0x1015c268
push edi
push dword [esp + 0x18]
push 0xffffffffffffffff
push esi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1015c00c
call fcn.100f3810
push eax
call fcn.100f3830
add esp, 4
test eax, eax
jne 0x1015c268
push 0x5c
push dword [esp + 0x18]
lea eax, [esp + 0x280]
push str._s_hc
push 0x400
push eax
call fcn.100fb290
add esp, 0x14
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, eax
mov dword [esp + 0x1c], ecx
cmp ecx, 0xffffffff
jne 0x1015c095
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1015c06f
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xa70]
xor ecx, esp
call fcn.1021eb98
add esp, 0xa74
ret
call fcn.100f3810
push eax
call fcn.100f3830
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa70]
xor ecx, esp
call fcn.1021eb98
add esp, 0xa74
ret
xor edi, edi
mov dword [esp + 0x10], 0
xor esi, esi
xor ecx, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], ecx
nop
cmp dword [esp + 0xa90], 0
jne 0x1015c0c5
test byte [esp + 0x2c], 0x10
jne 0x1015c1bd
cmp word [esp + 0x58], 0x2e
jne 0x1015c0ed
mov ax, word [esp + 0x5a]
test ax, ax
je 0x1015c1bd
cmp ax, 0x2e
jne 0x1015c0ed
cmp word [esp + 0x5c], 0
je 0x1015c1bd
cmp esi, ecx
jl 0x1015c118
add ecx, 0x64
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20], ecx
lea eax, [ecx*4]
push eax
push ebx
call fcn.100dc870
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1015c1f3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x6c]
push eax
push 0
push 0xfde9
call ebp
mov ebp, eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call fcn.100dc800
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1015c1f3
push eax
push eax
push ebp
push dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x68]
push 0xffffffffffffffff
push eax
push edi
push 0xfde9
call ebp
test eax, eax
jne 0x1015c187
call fcn.100f3810
push eax
call fcn.100f3830
mov edi, eax
add esp, 4
test edi, edi
jne 0x1015c1f3
mov eax, dword [esp + 0x14]
lea eax, [eax + esi*4]
push eax
push dword [esp + 0x14]
push ebx
call fcn.100dc8f0
mov edi, eax
add esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1015c1b8
push eax
push ebx
call fcn.100dc7e0
add esp, 8
mov dword [esp + 0x10], 0
test edi, edi
jne 0x1015c1f3
inc esi
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x1015c0b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1015c1f3
call fcn.100f3810
push eax
call fcn.100f3830
add esp, 4
mov edi, eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x1015c215
test edi, edi
jne 0x1015c22b
call fcn.100f3810
push eax
call fcn.100f3830
add esp, 4
mov edi, eax
test edi, edi
jne 0x1015c22b
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [esp + 0x28]
mov dword [eax], esi
jmp 0x1015c253
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x1015c253
test esi, esi
jle 0x1015c249
push dword [ebp + esi*4 - 4]
dec esi
push ebx
call fcn.100dc7e0
add esp, 8
test esi, esi
jg 0x1015c237
push ebp
push ebx
call fcn.100dc7e0
add esp, 8
mov eax, dword [esp + 0x18]
pop ebp
test eax, eax
je 0x1015c266
push eax
push ebx
call fcn.100dc7e0
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0xa7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0xa74
ret