Function at 0x1009e5f
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x101a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x27c], eax
xor eax, eax
push ebx
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp + 8]
push esi
mov ebx, ecx
mov dword [ebx + 0x14], eax
push edi
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.01009c31
mov esi, eax
mov edi, 0x10017fc
test esi, esi
jge 0x1009f02
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x33
jmp 0x100a2e2
push dword [ebp - 0x264]
call fcn.0100999d
mov esi, eax
test esi, esi
jge 0x1009f36
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x34
jmp 0x100a2e2
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0100989a
mov esi, eax
test esi, esi
jge 0x1009f72
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x35
jmp 0x100a2e2
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x260]
push dword [ebp - 0x258]
call fcn.010055d0
mov esi, eax
test esi, esi
jge 0x1009fb3
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x36
jmp 0x100a2e2
mov eax, dword [ebp - 0x270]
add eax, 0x10a
mov dword [ebp - 0x260], eax
add eax, eax
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.01005b00
mov esi, eax
test esi, esi
jge 0x1009ffc
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x37
jmp 0x100a2e2
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x100a15c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100a032
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070012
jne 0x100a043
xor esi, esi
jmp 0x100a327
test esi, esi
jge 0x100a15c
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x38
jmp 0x100a2e2
push dword [ebp - 0x278]
push dword [ebp - 0x264]
push dword [ebp - 0x258]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x100a11b
push 0x20
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x100a0ac
mov ecx, eax
call fcn.01007a2d
mov dword [ebp - 0x25c], eax
jmp 0x100a0b3
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0
je 0x100a1bb
mov ecx, dword [ebp - 0x25c]
push ebx
push 0x1009203
push dword [ebp - 0x260]
push dword [ebp - 0x258]
call fcn.01007be5
mov esi, eax
test esi, esi
jge 0x100a0fc
mov ecx, dword [ebp - 0x25c]
call fcn.01007a77
test al, al
je 0x100a0f4
xor esi, esi
test esi, esi
jl 0x100a1f3
push dword [ebp - 0x25c]
lea ecx, [ebx + 4]
call fcn.01008193
mov esi, eax
test esi, esi
jl 0x100a216
and dword [ebp - 0x25c], 0
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100a15c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100a146
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070012
je 0x100a239
test esi, esi
jl 0x100a2cc
mov edx, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x258]
xor eax, eax
mov word [ecx + edx*2], ax
push 1
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
push dword [ebp - 0x260]
push dword [ebp - 0x258]
call fcn.010075b4
mov esi, eax
test esi, esi
jge 0x100a06e
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x39
jmp 0x100a2e2
mov esi, 0x8007000e
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a312
test byte [eax + 0x1c], 1
je 0x100a2f6
push esi
push edi
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
mov eax, dword [section..data]
jmp 0x100a2f6
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x3b
jmp 0x100a2e2
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x3c
jmp 0x100a2e2
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x268]
push eax
mov ecx, ebx
call fcn.010090e9
mov esi, eax
test esi, esi
jge 0x100a274
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x3e
jmp 0x100a2e2
cmp dword [ebp - 0x274], 0
jne 0x100a284
xor esi, esi
jmp 0x100a312
push 0
push dword [ebp - 0x27c]
push dword [ebp - 0x274]
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_ProcessTrace]
test eax, eax
je 0x100a27d
jle 0x100a2ae
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x100a27d
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x3f
jmp 0x100a2e2
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a2f2
test byte [eax + 0x1c], 1
je 0x100a2f2
push esi
push edi
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
mov eax, dword [section..data]
test esi, esi
jge 0x100a312
cmp eax, section..data
je 0x100a312
test byte [eax + 0x1c], 1
je 0x100a312
push esi
push edi
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
cmp dword [ebp - 0x26c], 0xffffffff
je 0x100a327
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
cmp dword [ebp - 0x258], ebx
je 0x100a352
push dword [ebp - 0x258]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
mov dword [ebp - 0x258], ebx
cmp dword [ebp - 0x264], ebx
je 0x100a36f
push dword [ebp - 0x264]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x268], ebx
je 0x100a38c
push dword [ebp - 0x268]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
mov ecx, dword [ebp - 0x25c]
cmp ecx, ebx
je 0x100a39c
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010f65
leave
ret 8