Function at 0x1003eceb
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push edi
mov dword [ebp - 0x35c], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x354], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x353]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x250], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x24c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp - 0x108]
push edx
push 0
push 0x1f0fff
mov ecx, dword [ebp - 0x35c]
call fcn.1003ea17
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x360]
call dword [edx + 4]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x1003edc5
xor eax, eax
jmp 0x1003ef73
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
mov ecx, dword [ebp - 0x110]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x1003ee25
push 0x104
lea edx, [ebp - 0x104]
push edx
push 0
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x35c]
call fcn.1003ea17
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x364]
call dword [edx + 8]
test eax, eax
jne 0x1003ee25
xor eax, eax
jmp 0x1003ef73
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
jne 0x1003ee3d
xor eax, eax
jmp 0x1003ef73
push str..
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.10012fc0
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x358], eax
push 0x104
push 0
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp - 0x358], 0xffffffff
jne 0x1003ee93
xor eax, eax
jmp 0x1003ef73
lea edx, [ebp - 0x224]
push edx
call fcn.100030c0
add esp, 4
push 2
push 0x104
lea eax, [ebp - 0x354]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x35c]
add ecx, 0x4c
call fcn.10046288
push 2
lea eax, [ebp - 0x354]
push eax
mov ecx, dword [ebp - 0x35c]
add ecx, 0x4c
call fcn.100461e4
test eax, eax
je 0x1003eefc
mov dword [ebp - 0x10c], 1
jmp 0x1003ef41
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp - 0x35c]
call fcn.1003f45b
test eax, eax
je 0x1003ef1e
mov dword [ebp - 0x10c], 1
jmp 0x1003ef41
push 0
call fcn.1005a207
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1003ee93
cmp dword [ebp - 0x110], 0
je 0x1003ef57
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x358], 0xffffffff
je 0x1003ef6d
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret 4