Function at 0x101fb1c0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, ecx
mov eax, dword [0x103c2010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea esi, [esp + 0x20]
push 0x8c
push str....._base_files_file_enumerator_win.cc
push str.Next
push esi
call fcn.10221d60
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push esi
call fcn.10209420
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
lea eax, [edi + 0x284]
mov dword [esp + 0x18], eax
lea eax, [edi + 0x258]
mov dword [esp + 8], eax
lea eax, [edi + 0x26c]
mov dword [esp + 0x14], eax
lea ebx, [edi + 0x30]
mov dword [esp + 0xc], ebx
jmp 0x101fb266
mov ecx, esi
call fcn.102233c0
lea esi, [esp + 0x20]
mov ebx, dword [esp + 0xc]
mov ecx, esi
call fcn.102233c0
cmp byte [edi], 0
je 0x101fb2a0
push dword [esp + 0x10]
push dword [edi + 0x254]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101fb3e4
push dword [edi + 0x254]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi + 0x254], 0xffffffff
jmp 0x101fb3e4
mov eax, dword [edi + 0x290]
cmp dword [edi + 0x28c], eax
je 0x101fb5b4
test eax, eax
mov ecx, dword [edi + 0x288]
cmove eax, ecx
dec eax
cmp ecx, eax
jb 0x101fb5de
lea eax, [eax + eax*2]
shl eax, 2
add eax, dword [edi + 0x284]
mov ecx, dword [esp + 8]
push eax
call fcn.102233e0
mov ecx, dword [edi + 0x288]
mov edx, dword [edi + 0x290]
test edx, edx
je 0x101fb306
lea eax, [edx - 1]
mov dword [edi + 0x290], eax
cmp ecx, edx
jb 0x101fb5e7
cmp ecx, eax
jae 0x101fb319
jmp 0x101fb5e1
lea eax, [ecx - 1]
mov dword [edi + 0x290], eax
mov edx, ecx
cmp ecx, eax
jb 0x101fb5e1
cmp edx, 0x80000000
je 0x101fb5e4
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
call fcn.102233c0
mov ecx, ebx
call fcn.101fba70
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [edi + 0x278]
cmp eax, 1
je 0x101fb391
test eax, eax
mov ebx, dword [esp + 0xc]
jne 0x101fb3a8
movzx eax, byte [edi + 0x277]
mov edx, dword [esp + 0x14]
test al, al
jns 0x101fb383
mov edx, dword [edi + 0x26c]
mov eax, dword [edi + 0x270]
mov ecx, dword [esp + 8]
push eax
push edx
push esi
call fcn.102242d0
jmp 0x101fb3b4
mov ecx, dword [esp + 8]
push 1
push 0x10359904
push esi
call fcn.102242d0
mov ebx, dword [esp + 0xc]
jmp 0x101fb3b4
call sym.EmbeddedBrowserWebView.dll_public_virtual:_void___thiscall_telemetry_client::IDataFieldVisitor::destructor_void_
mov ecx, esi
call fcn.102232b0
cmp byte [esp + 0x2b], 0
mov eax, esi
jns 0x101fb3c1
mov eax, dword [esp + 0x20]
push 2
push 0
push 0
push dword [esp + 0x1c]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [edi + 0x254], eax
mov byte [edi], 1
mov ecx, esi
call fcn.102233c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [edi + 0x254], 0xffffffff
je 0x101fb420
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
test ebx, ebx
je 0x101fb440
push ebx
call fcn.1030fc76
add esp, 4
jmp 0x101fb442
mov byte [edi], 0
cmp dword [edi + 0x278], 0
je 0x101fb505
cmp eax, 0x12
je 0x101fb266
jmp 0x101fb53a
xor eax, eax
mov ecx, esi
push eax
push ebx
call fcn.10223310
mov ecx, edi
push esi
call fcn.1026ed30
test al, al
jne 0x101fb25f
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x10]
mov ebx, dword [ecx]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov dword [eax + 8], 0xffffffff
mov ecx, dword [esp + 8]
push esi
mov esi, eax
push eax
call fcn.10224d00
test bl, 0x10
je 0x101fb570
cmp byte [edi + 0x264], 0
je 0x101fb570
mov eax, esi
cmp byte [esi + 0xb], 0
jns 0x101fb4a5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
jne 0x101fb570
mov ecx, dword [esp + 0x18]
push 1
call fcn.101fb7b0
mov eax, dword [edi + 0x290]
cmp dword [edi + 0x288], eax
jb 0x101fb5ed
lea ecx, [eax + eax*2]
shl ecx, 2
add ecx, dword [edi + 0x284]
push esi
call fcn.102232d0
mov edx, dword [edi + 0x288]
mov ecx, dword [edi + 0x290]
lea eax, [edx - 1]
cmp ecx, eax
jne 0x101fb549
mov dword [edi + 0x290], 0
jmp 0x101fb55c
cmp byte [edi + 0x277], 0
js 0x101fb51b
mov byte [edi + 0x277], 1
mov ecx, dword [esp + 0x14]
jmp 0x101fb52b
mov dword [edi + 0x270], 1
mov ecx, dword [edi + 0x26c]
mov dword [ecx], 0x2a
cmp eax, 0x12
je 0x101fb266
cmp dword [edi + 0x27c], 0
je 0x101fb266
jmp 0x101fb5a5
mov dword [esp + 0x1c], edx
mov edx, ecx
inc edx
mov dword [edi + 0x290], edx
mov edx, dword [esp + 0x1c]
jne 0x101fb55e
mov ecx, eax
cmp edx, ecx
jb 0x101fb5ea
nop word cs:[eax + eax]
and ebx, 0x10
shr ebx, 4
mov ecx, edi
push ebx
call fcn.1026eec0
test al, al
je 0x101fb250
mov ecx, edi
lea eax, [esp + 0x20]
push eax
call fcn.101fb5f0
test al, al
je 0x101fb250
lea ecx, [esp + 0x20]
call fcn.102233c0
jmp 0x101fb5be
push eax
call fcn.101f98a0
add esp, 4
mov dword [edi + 0x280], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.102232b0
lea ecx, [esp + 0x30]
call fcn.102094a0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.102f4c53
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3
int3
int3
int3
int3