Function at 0x100dcd90
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x258]
push eax
call fcn.10002490
push 1
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x258]
call fcn.1000a000
push esi
mov ecx, 0x10202944
push edi
mov eax, dword [eax]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100dcdf6
test dx, dx
je 0x100dcdf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100dcdf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100dcdd0
xor esi, esi
jmp 0x100dcdfb
sbb esi, esi
or esi, 1
mov edx, dword [ebp - 0x25c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100dce19
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x258]
push ebx
mov ebx, dword [edi - 0xc]
test esi, esi
jne 0x100dce95
mov esi, 0x10204524
mov dword [ebp - 0x25c], 0x10204524
push 3
sub esi, edi
mov dword [ebp - 0x260], ebx
push 0x10204524
sar esi, 1
call fcn.101e6fd0
mov ecx, dword [edi - 8]
add ebx, eax
mov edx, 1
mov dword [ebp - 0x264], eax
sub edx, dword [edi - 4]
sub ecx, ebx
add esp, 8
or edx, ecx
jge 0x100dce7a
push ebx
lea ecx, [ebp - 0x258]
call fcn.10003310
mov edi, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x260]
cmp esi, ecx
ja 0x100dce8d
lea eax, [edi + esi*2]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x264]
jmp 0x100dcf01
mov esi, str..
mov dword [ebp - 0x25c], str..
push 4
sub esi, edi
mov dword [ebp - 0x264], ebx
push str..
sar esi, 1
call fcn.101e6fd0
mov ecx, dword [edi - 8]
add ebx, eax
mov edx, 1
mov dword [ebp - 0x260], eax
sub edx, dword [edi - 4]
sub ecx, ebx
add esp, 8
or edx, ecx
jge 0x100dcee8
push ebx
lea ecx, [ebp - 0x258]
call fcn.10003310
mov edi, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x264]
cmp esi, ecx
ja 0x100dcefb
lea eax, [edi + esi*2]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x260]
add eax, eax
push eax
push dword [ebp - 0x25c]
push eax
lea eax, [edi + ecx*2]
push eax
call fcn.10004510
add esp, 0x10
mov dword [edi - 0xc], ebx
xor eax, eax
mov word [edi + ebx*2], ax
push 0x250
push eax
lea eax, [ebp - 0x254]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100dcf4b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x16
call fcn.10003680
add esp, 4
test eax, eax
je 0x100dcf6d
lea ecx, [ebp - 0x254]
push ecx
push edi
call eax
mov ebx, eax
mov dword [ebp - 0x258], ebx
jmp 0x100dcf83
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x258], eax
test esi, esi
je 0x100dcf8e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
jne 0x100dcfa0
xor esi, esi
jmp 0x100dd086
mov ecx, 0x10209640
lea eax, [ebp - 0x228]
jmp 0x100dcfb0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100dcfd6
test dx, dx
je 0x100dcfd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100dcfd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100dcfb0
xor eax, eax
jmp 0x100dcfdb
sbb eax, eax
or eax, 1
test eax, eax
je 0x100dd01f
mov ecx, 0x1020c868
lea eax, [ebp - 0x228]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100dd016
test dx, dx
je 0x100dd012
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100dd016
add eax, 4
add ecx, 4
test dx, dx
jne 0x100dcff0
xor eax, eax
jmp 0x100dd01b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100dd07e
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100dd035
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x18
call fcn.10003680
add esp, 4
test eax, eax
je 0x100dd04f
lea ecx, [ebp - 0x254]
push ecx
push ebx
call eax
jmp 0x100dd05d
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
test esi, esi
je 0x100dd06a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
mov esi, 1
mov ebx, dword [ebp - 0x258]
je 0x100dd080
jmp 0x100dcfa0
xor esi, esi
push ebx
call fcn.10034b40
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
pop ebx
test eax, eax
jg 0x100dd09f
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret