Function at 0x10128030
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031de77
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x49c], ebx
push 0x140
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x4a8], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
add esp, 0xc
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
je 0x1012879e
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x31c]
push eax
push 0x104
push ebx
call edi
test eax, eax
je 0x1012883d
mov ecx, dword [ebp - 0x498]
lea edx, [ebp - 0x218]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x101280c8
cmp byte [0x104ace20], al
jne 0x101281f7
mov edi, dword [0x104ace28]
mov ebx, edi
mov esi, dword [0x104ace2c]
xor ebx, 0x1de26cd5
mov eax, ebx
mov byte [0x104ace20], 1
mov edx, esi
xor edx, 0xd28f2c5
mov ecx, edx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
xor ebx, eax
shr ecx, 7
xor edx, ecx
mov eax, ebx
shld edx, eax, 0x11
mov edx, esi
shl eax, 0x11
xor edx, 0xd28f2c5
xor al, bl
mov ecx, edx
xor byte [0x104ace21], al
mov ebx, edi
xor ebx, 0x1de26cd4
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
xor ebx, eax
shr ecx, 7
xor edx, ecx
mov eax, ebx
shld edx, eax, 0x11
mov edx, esi
xor esi, 0xd28f2c5
shl eax, 0x11
xor edx, 0xd28f2c5
xor al, bl
mov ecx, edx
xor byte [0x104ace22], al
mov ebx, edi
xor ebx, 0x1de26cd7
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
xor ebx, eax
shr ecx, 7
xor edx, ecx
mov eax, ebx
mov dword [ebp - 0x4a0], edx
mov ecx, esi
shld edx, eax, 0x11
mov edx, edi
shl eax, 0x11
xor edx, 0x1de26cd6
xor al, bl
xor byte [0x104ace23], al
mov eax, edx
shld ecx, eax, 0xd
shl eax, 0xd
xor esi, ecx
xor edx, eax
mov ecx, esi
mov eax, edx
shrd eax, ecx, 7
shr ecx, 7
xor edx, eax
xor esi, ecx
mov eax, edx
shld esi, eax, 0x11
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
shl eax, 0x11
xor al, dl
xor byte [0x104ace24], al
push ecx
push 0x104ace24
push 0x104ace21
lea ecx, [ebp - 0x334]
call fcn.1001a620
cmp dword [ebp - 0x320], 0x10
lea ecx, [ebp - 0x334]
mov edx, dword [ebp - 0x498]
mov ebx, 0xc0
cmovae ecx, dword [ebp - 0x334]
mov dword [ebp - 0x494], ebx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x10128232
lea ecx, [ebp - 0x334]
call fcn.10019dd0
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x48c], 0x10
push eax
lea eax, [ebp - 0x31c]
push eax
call esi
mov esi, eax
mov dword [ebp - 0x4a0], esi
cmp esi, 0xffffffff
je 0x10128785
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
nop dword [eax]
cmp byte [0x104af2e0], 0
jne 0x1012832a
mov esi, dword [0x104af2ec]
mov edx, esi
mov ebx, dword [0x104af2e8]
xor edx, 0xd28f2c5
mov ecx, edx
mov byte [0x104af2e0], 1
xor ebx, 0x1de26cd5
xor esi, 0xd28f2c5
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
xor ebx, eax
shr ecx, 7
xor edx, ecx
mov eax, ebx
mov dword [ebp - 0x4a8], edx
mov ecx, esi
shld edx, eax, 0x11
mov edx, dword [0x104af2e8]
shl eax, 0x11
xor edx, 0x1de26cd4
xor al, bl
mov ebx, dword [ebp - 0x494]
xor byte [0x104af2e1], al
mov eax, edx
shld ecx, eax, 0xd
shl eax, 0xd
xor esi, ecx
xor edx, eax
mov ecx, esi
mov eax, edx
shrd eax, ecx, 7
xor edx, eax
shr ecx, 7
xor esi, ecx
mov eax, edx
shld esi, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [0x104af2e2], al
push ecx
push 0x104af2e2
push 0x104af2e1
lea ecx, [ebp - 0x334]
call fcn.1001a620
or ebx, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x334]
or ebx, 1
cmp dword [ebp - 0x320], 0x10
push 1
cmovae eax, dword [ebp - 0x334]
push eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x494], ebx
push eax
mov dword [ebp - 0x4a8], ebx
call edi
add esp, 0xc
test eax, eax
je 0x101284c8
cmp byte [0x104afc60], 0
jne 0x1012847b
mov esi, dword [0x104afc6c]
mov edx, esi
mov ebx, dword [0x104afc68]
xor edx, 0xd28f2c5
mov ecx, edx
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
xor ebx, 0x1de26cd5
mov byte [0x104afc60], 1
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
xor ebx, eax
shr ecx, 7
xor edx, ecx
mov eax, ebx
shld edx, eax, 0x11
mov edx, esi
xor esi, 0xd28f2c5
shl eax, 0x11
xor edx, 0xd28f2c5
xor al, bl
mov ecx, edx
xor byte [0x104afc61], al
mov ebx, dword [0x104afc68]
xor ebx, 0x1de26cd4
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
xor ebx, eax
shr ecx, 7
xor edx, ecx
mov eax, ebx
shld edx, eax, 0x11
mov edx, dword [0x104afc68]
mov ecx, esi
shl eax, 0x11
xor edx, 0x1de26cd7
xor al, byte [0x104afc62]
xor al, bl
mov ebx, dword [ebp - 0x494]
mov byte [0x104afc62], al
mov eax, edx
shld ecx, eax, 0xd
shl eax, 0xd
xor esi, ecx
xor edx, eax
mov ecx, esi
mov eax, edx
shrd eax, ecx, 7
xor edx, eax
shr ecx, 7
xor esi, ecx
mov eax, edx
shld esi, eax, 0x11
shl eax, 0x11
xor al, byte [0x104afc63]
xor al, dl
mov byte [0x104afc63], al
push ecx
push 0x104afc63
push 0x104afc61
lea ecx, [ebp - 0x34c]
call fcn.1001a620
or ebx, 0x32
lea eax, [ebp - 0x34c]
cmp dword [ebp - 0x338], 0x10
push 2
cmovae eax, dword [ebp - 0x34c]
push eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x494], ebx
push eax
call edi
add esp, 0xc
mov byte [ebp - 0x48d], 0
test eax, eax
jne 0x101284cf
mov byte [ebp - 0x48d], 1
test bl, 2
je 0x10128532
mov ecx, dword [ebp - 0x338]
and ebx, 0xfffffffd
mov dword [ebp - 0x494], ebx
cmp ecx, 0x10
jb 0x10128517
mov edx, dword [ebp - 0x34c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012850d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128837
push ecx
push edx
call fcn.102bb95a
add esp, 8
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x34c], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x10128581
mov ecx, dword [ebp - 0x320]
and ebx, 0xfffffffe
mov dword [ebp - 0x494], ebx
cmp ecx, 0x10
jb 0x10128581
mov edx, dword [ebp - 0x334]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10128577
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128837
push ecx
push edx
call fcn.102bb95a
add esp, 8
cmp byte [ebp - 0x48d], 0
jne 0x10128769
test byte [ebp - 0x48c], 0x10
je 0x10128769
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x104
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x1012883d
mov edx, dword [ebp - 0x498]
lea ecx, [ebp - 0x460]
nop
mov al, byte [ecx]
lea edx, [edx + 1]
inc ecx
mov byte [edx - 1], al
test al, al
jne 0x101285d0
cmp byte [0x104adc80], al
jne 0x1012868a
mov ebx, dword [0x104adc88]
mov esi, ebx
mov edi, dword [0x104adc8c]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov byte [0x104adc80], 1
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
xor ebx, 0x1de26cd4
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
mov esi, dword [0x104adc8c]
xor ecx, edi
mov eax, edx
xor esi, 0xd28f2c5
shld ecx, eax, 0x11
mov ecx, esi
shl eax, 0x11
xor al, byte [0x104adc81]
xor al, dl
mov byte [0x104adc81], al
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor esi, ecx
xor ebx, eax
mov ecx, esi
mov edx, ebx
shrd edx, ecx, 7
shr ecx, 7
xor edx, ebx
mov ebx, dword [ebp - 0x494]
xor ecx, esi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, byte [0x104adc82]
xor al, dl
mov byte [0x104adc82], al
push ecx
push 0x104adc82
push 0x104adc81
lea ecx, [ebp - 0x334]
call fcn.1001a620
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0x334]
or ebx, 0x300
cmp dword [ebp - 0x320], 0x10
mov dword [ebp - 0x494], ebx
cmovae eax, edx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101286c4
lea edi, [ebp - 0x114]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x101286d4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x320]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x10
jb 0x10128720
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10128716
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128837
push ecx
push edx
call fcn.102bb95a
add esp, 8
lea edx, [ebp - 0x218]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x10128728
lea edi, [ebp - 0x114]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10128738
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, fcn.10128850
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [ebp - 0x114]
call fcn.10128030
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 4
mov esi, dword [ebp - 0x4a0]
lea eax, [ebp - 0x48c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10128280
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [ebp - 0x49c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0x48c]
push eax
push ebx
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x10128816
nop
test byte [ebp - 0x48c], 0x10
jne 0x101287fd
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x104
push ebx
call edi
test eax, eax
je 0x1012883d
mov edx, dword [ebp - 0x498]
lea ecx, [ebp - 0x460]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x101287e0
lea eax, [ebp - 0x460]
push eax
call fcn.10128850
add esp, 4
lea eax, [ebp - 0x48c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x101287b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor eax, eax
jmp 0x1012881b