Function at 0xdff4c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x61
push 0
push 0
dec ecx
jne 0xdff55
xchg dword [ebp - 4], ecx
push ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xe06bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.000144c8
test eax, eax
jle 0xe0429
mov eax, dword [ebp - 8]
call fcn.000144c8
test eax, eax
jle 0xe0429
lea eax, [ebp - 0x290]
xor ecx, ecx
mov edx, 0x250
call fcn.00012b24
lea edx, [ebp - 0x294]
mov eax, dword [ebp - 4]
call fcn.000732d4
mov edx, dword [ebp - 0x294]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
call fcn.00014534
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebp
push 0xe0422
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 0x290]
push eax
push 1
mov eax, dword [ebp - 0x28]
call fcn.000144b8
push eax
call sub.kernel32.dll_FindFirstFileExW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0xe0404
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x264]
mov ecx, 0x104
call fcn.00014428
lea edx, [ebp - 0x298]
mov eax, dword [ebp - 0x30]
call fcn.00073620
mov edx, dword [ebp - 0x298]
lea eax, [ebp - 0x30]
call fcn.000142d0
mov eax, dword [ebp - 0x30]
call fcn.000144c8
cmp eax, 3
jl 0xe03da
lea edx, [ebp - 0x29c]
mov eax, dword [ebp - 4]
call fcn.000732d4
mov edx, dword [ebp - 0x29c]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
call fcn.00014534
mov eax, dword [ebp - 0x1c]
call fcn.00073374
test al, al
je 0xe03da
xor eax, eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.00077988
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0
jne 0xe009d
cmp dword [ebp - 0x40], 0x400
jae 0xe0118
jmp 0xe009f
jge 0xe0118
push 0xe06d4
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea eax, [ebp - 0x2a8]
call fcn.0007476c
push dword [ebp - 0x2a8]
push 0xe06ec
lea edx, [ebp - 0x2ac]
mov eax, dword [ebp - 0x20]
call fcn.000747a0
push dword [ebp - 0x2ac]
push 0xe06ec
lea eax, [ebp - 0x2a4]
mov edx, 5
call fcn.00013fa4
mov edx, dword [ebp - 0x2a4]
lea eax, [ebp - 0x2a0]
call fcn.00014444
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 0x1c]
call fcn.000144d4
mov eax, dword [ebp - 0x2a0]
call fcn.000dd25c
jmp 0xe03da
xor eax, eax
mov dword [ebp - 0x20], eax
call fcn.00079428
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0xe03d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 0x2d
mov byte [ebp - 0x32], 0x2d
mov byte [ebp - 0x31], 0x2d
mov ecx, dword [ebp - 0x24]
mov edx, 0xe06f8
mov eax, dword [ebp - 0x1c]
call fcn.00086460
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x33
je 0xe0195
cmp byte [ebp + 8], 0
je 0xe0195
lea edx, [ebp - 0x2b0]
mov eax, dword [ebp - 4]
call fcn.000733e0
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x24]
mov edx, 0xe070c
call fcn.00086460
mov byte [ebp - 0x32], al
mov ecx, dword [ebp - 0x24]
mov edx, 0xe0720
mov eax, dword [ebp - 0x1c]
call fcn.00086460
mov byte [ebp - 0x31], al
push 0xe0734
lea eax, [ebp - 0x2bc]
mov dl, byte [ebp - 0x15]
call fcn.00013e0c
push dword [ebp - 0x2bc]
lea eax, [ebp - 0x2c0]
mov dl, byte [ebp - 0x32]
call fcn.00013e0c
push dword [ebp - 0x2c0]
lea eax, [ebp - 0x2c4]
mov dl, byte [ebp - 0x31]
call fcn.00013e0c
push dword [ebp - 0x2c4]
push 0xe0748
lea eax, [ebp - 0x2b8]
mov edx, 5
call fcn.00013fa4
mov edx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x2b4]
call fcn.00014444
mov edx, dword [ebp - 0x2b4]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
call fcn.00014534
push 0x10000000
push 2
push 0
lea eax, [ebp - 0x20]
push eax
mov cl, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0xe0754
call fcn.0008522c
lea edx, [ebp - 0x2c]
call fcn.00075ba0
lea edx, [ebp - 0x2cc]
mov eax, 0xe0764
call fcn.00078120
push dword [ebp - 0x2cc]
push dword [ebp - 0x2c]
lea edx, [ebp - 0x2d0]
mov eax, 0xe0770
call fcn.00078120
push dword [ebp - 0x2d0]
lea edx, [ebp - 0x2d4]
mov eax, dword [ebp - 0x20]
call fcn.000747a0
push dword [ebp - 0x2d4]
lea eax, [ebp - 0x2c8]
mov edx, 4
call fcn.00013fa4
mov eax, dword [ebp - 0x2c8]
mov edx, dword [ebp - 0x24]
call fcn.000796bc
push 0x10000000
push 2
push 0
lea eax, [ebp - 0x20]
push eax
mov cl, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0xe077c
call fcn.0008522c
lea edx, [ebp - 0x2c]
call fcn.00075ba0
lea edx, [ebp - 0x2dc]
mov eax, 0xe0788
call fcn.00078120
push dword [ebp - 0x2dc]
push dword [ebp - 0x2c]
lea edx, [ebp - 0x2e0]
mov eax, 0xe0770
call fcn.00078120
push dword [ebp - 0x2e0]
lea edx, [ebp - 0x2e4]
mov eax, dword [ebp - 0x20]
call fcn.000747a0
push dword [ebp - 0x2e4]
lea eax, [ebp - 0x2d8]
mov edx, 4
call fcn.00013fa4
mov eax, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x24]
call fcn.000796bc
push 0xa0000000
push 2
push 0
lea eax, [ebp - 0x20]
push eax
mov cl, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0xe079c
call fcn.0008522c
lea edx, [ebp - 0x2c]
call fcn.00075ba0
lea edx, [ebp - 0x2ec]
mov eax, 0xe07ac
call fcn.00078120
push dword [ebp - 0x2ec]
push dword [ebp - 0x2c]
lea edx, [ebp - 0x2f0]
mov eax, 0xe0770
call fcn.00078120
push dword [ebp - 0x2f0]
lea edx, [ebp - 0x2f4]
mov eax, dword [ebp - 0x20]
call fcn.000747a0
push dword [ebp - 0x2f4]
lea eax, [ebp - 0x2e8]
mov edx, 4
call fcn.00013fa4
mov eax, dword [ebp - 0x2e8]
mov edx, dword [ebp - 0x24]
call fcn.000796bc
mov eax, dword [ebp - 0x14]
call fcn.000dd25c
lea edx, [ebp - 0x2f8]
mov eax, dword [ebp - 0x24]
call fcn.00078ca4
mov eax, dword [ebp - 0x2f8]
call fcn.000dd25c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe03da
lea eax, [ebp - 0x24]
call fcn.00079444
ret
lea eax, [ebp - 0x290]
xor ecx, ecx
mov edx, 0x250
call fcn.00012b24
lea eax, [ebp - 0x290]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0xe0007
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe0429
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
mov dword [ebp - 0x10], 0xffffffff
ret
lea eax, [ebp - 0x290]
xor ecx, ecx
mov edx, 0x250
call fcn.00012b24
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebp
push 0xe062e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
lea eax, [ebp - 0x290]
push eax
push 1
lea edx, [ebp - 0x2fc]
mov eax, dword [ebp - 4]
call fcn.000732d4
lea eax, [ebp - 0x2fc]
mov edx, 0xe07c4
call fcn.000144d4
mov eax, dword [ebp - 0x2fc]
call fcn.000144b8
push eax
call sub.kernel32.dll_FindFirstFileExW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0xe0610
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x264]
mov ecx, 0x104
call fcn.00014428
lea edx, [ebp - 0x300]
mov eax, dword [ebp - 0x30]
call fcn.00073620
mov edx, dword [ebp - 0x300]
lea eax, [ebp - 0x30]
call fcn.000142d0
mov eax, dword [ebp - 0x30]
mov edx, 0xe07cc
call fcn.000145e0
je 0xe05e6
mov eax, dword [ebp - 0x30]
mov edx, 0xe07d4
call fcn.000145e0
je 0xe05e6
mov eax, dword [ebp - 0x30]
call fcn.000144c8
test eax, eax
jle 0xe05e6
cmp byte [ebp + 0xc], 0
je 0xe053d
lea edx, [ebp - 0x304]
mov eax, dword [ebp - 0x30]
call fcn.00073df8
mov eax, dword [ebp - 0x304]
push eax
lea edx, [ebp - 0x308]
mov eax, 0xe07e0
call fcn.00073df8
mov edx, dword [ebp - 0x308]
pop eax
call fcn.000145e0
je 0xe05e6
mov eax, dword [ebp - 0x290]
and eax, 0x410
cmp eax, 0x10
jne 0xe05e6
mov eax, dword [0xeafb0]
cmp dword [eax + 0x14], 1
ja 0xe0585
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 0x10]
mov edx, dword [edx - 4]
call fcn.00075960
cmp eax, 0x1e
jb 0xe05ac
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 0x10]
mov dword [edx - 4], eax
push 0x46
call sub.kernel32.dll_Sleep
jmp 0xe05ac
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 0x10]
mov edx, dword [edx - 4]
call fcn.00075960
cmp eax, 0x50
jb 0xe05ac
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 0x10]
mov dword [edx - 4], eax
push 0x14
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x30c]
mov eax, dword [ebp - 4]
call fcn.000732d4
mov edx, dword [ebp - 0x30c]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
call fcn.00014534
mov eax, dword [ebp + 0x10]
push eax
mov al, byte [ebp + 0xc]
push eax
mov al, byte [ebp + 8]
push eax
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
call fcn.000dff4c
pop ecx
lea eax, [ebp - 0x290]
xor ecx, ecx
mov edx, 0x250
call fcn.00012b24
lea eax, [ebp - 0x290]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0xe049b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe0635
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
mov dword [ebp - 0x10], 0xffffffff
ret