Function at 0x11e58fb0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fbeb46
push eax
mov eax, dword [0x12133f80]
mov dword fs:[0], esp
sub esp, 0x668
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
je 0x11e58ff2
mov eax, dword [0x12126854]
push eax
push str.__s__CSDGlobalShare::CleanFileSandBox_r_n
push str.SDGlobalx
push 1
call fcn.11ca5810
add esp, 0x10
call fcn.11dc2dd0
push eax
lea ecx, [esp + 0xc]
call fcn.11e7eae0
mov edx, dword [esp + 8]
mov dword [esp + 0x678], ebx
mov esi, dword [edx - 8]
cmp esi, ebx
je 0x11e59274
cmp esi, 0x104
jae 0x11e59274
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], bx
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x470]
push edx
push eax
call fcn.11e674bf
lea eax, [esp + esi*2 + 0x478]
add esp, 0xc
cmp word [eax - 2], 0x5c
je 0x11e59063
mov word [eax], 0x5c
push 0x12119948
lea ecx, [esp + 0x14]
call fcn.11e7eae0
lea ecx, [esp + 0x46c]
push 0x12023d48
push ecx
lea edx, [esp + 0x18]
push str._s_s
push edx
mov byte [esp + 0x68c], 1
call fcn.11e82200
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x11e59233
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x268]
lea edx, [esp + 0x470]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x26c]
push edx
push eax
call fcn.11e674bf
lea ecx, [esp + 0x50]
lea edx, [esp + 0x274]
push ecx
push edx
call fcn.11e67470
mov eax, dword [0x12133f80]
add esp, 0x14
cmp eax, ebx
je 0x11e5914f
mov eax, dword [0x12126854]
lea ecx, [esp + 0x268]
push ecx
push eax
push str.__s__CSDGlobalShare::CleanFileSandBox_DirName__s__r_n
push str.SDGlobalx
push 1
call fcn.11ca5810
add esp, 0x14
test byte [esp + 0x18], 0x10
je 0x11e5921b
lea edx, [esp + 0x44]
push 0x1207c188
push edx
call fcn.11e67d22
add esp, 8
test eax, eax
je 0x11e5921b
lea eax, [esp + 0x44]
push 0x12098764
push eax
call fcn.11e67d22
add esp, 8
test eax, eax
je 0x11e5921b
push str.UnforceEncrypt
call fcn.11e67d05
push eax
lea ecx, [esp + 0x4c]
push str.UnforceEncrypt
push ecx
call fcn.11e68a1f
add esp, 0x10
test eax, eax
je 0x11e591d0
push str.ReadOnlySD
call fcn.11e67d05
push eax
lea edx, [esp + 0x4c]
push str.ReadOnlySD
push edx
call fcn.11e68a1f
add esp, 0x10
test eax, eax
jne 0x11e5921b
lea eax, [esp + 0x44]
push eax
call fcn.11e5a870
add esp, 4
test eax, eax
jne 0x11e5921b
cmp dword [0x12133f80], ebx
je 0x11e5920b
mov eax, dword [0x12126854]
lea ecx, [esp + 0x268]
push ecx
push eax
push str.__s__CSDGlobalShare::CleanFileSandBox_Delete_DirName__s__r_n
push str.SDGlobalx
push 1
call fcn.11ca5810
add esp, 0x14
lea edx, [esp + 0x268]
push edx
call fcn.11ea08a0
add esp, 4
lea eax, [esp + 0x18]
push eax
push esi
call ebp
test eax, eax
jne 0x11e590e5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x67c], bl
call fcn.11e7f280
lea ecx, [esp + 0xc]
mov dword [esp + 0x67c], 0xffffffff
call fcn.11e7f280
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x668]
mov dword fs:[0], ecx
add esp, 0x674
ret
lea ecx, [esp + 8]
mov dword [esp + 0x678], 0xffffffff
call fcn.11e7f280
mov ecx, dword [esp + 0x670]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x674
ret