Function at 0x10006510
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012aa9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x28], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + edi - 1], 0x5c
je 0x1000657e
mov ebx, 0x100014f8
mov dword [ebp - 0x10], ebx
jmp 0x10006588
mov dword [ebp - 0x10], 0x10013600
mov ebx, dword [ebp - 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
push edi
lea eax, [ebp - 0x12c]
push 0x100014f0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x26c]
lea edx, [ebp - 0x12c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0xffffffff
jne 0x100065ee
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 0x240], 0x2e
je 0x1000676f
test byte [ebp - 0x26c], 0x10
je 0x10006653
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x240]
lea ecx, [ebp - 0x474]
push eax
push ebx
push edi
push 0x100014e8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x474]
mov ecx, esi
push edx
call fcn.10006510
jmp 0x1000676f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x240]
lea ecx, [ebp - 0x370]
push eax
push ebx
push edi
push 0x100014e8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
lea edi, [ebp - 0x370]
or ecx, 0xffffffff
mov dl, byte [ebp + 0xb]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebx, ecx
lea ecx, [ebp - 0x20]
push ebx
mov byte [ebp - 0x20], dl
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x100066e6
mov edi, dword [ebp - 0x1c]
mov ecx, ebx
mov eax, ecx
lea esi, [ebp - 0x370]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ecx + ebx], 0
mov edi, dword [esi + 0x14]
push 0x18
mov dword [ebp - 4], 0
mov ebx, dword [edi + 4]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ecx, edi
test edi, edi
jne 0x10006705
mov ecx, eax
mov dword [eax], ecx
mov ecx, ebx
test ebx, ebx
jne 0x1000670f
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x20]
push edx
mov dword [ecx], eax
add eax, 8
push eax
call fcn.10006d90
mov edx, dword [esi + 0x18]
mov eax, dword [ebp - 0x1c]
add esp, 8
inc edx
mov dword [esi + 0x18], edx
xor edx, edx
cmp eax, edx
mov dword [ebp - 4], 0xffffffff
je 0x10006760
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x10006755
cmp al, 0xff
je 0x10006755
dec al
mov byte [ecx], al
jmp 0x10006760
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x26c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100065ee
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4