Function at 0x100101da
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x18
and dword [esp + 0xc], 0
push ebx
push ebp
mov ebp, 0x104
push 0x250
mov dword [esp + 0xc], ebp
call fcn.100012ea
mov ebx, eax
mov dword [esp + 0xc], ebx
test ebx, ebx
je 0x100104c3
push dword [esp + 0x24]
call fcn.1000ff29
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1001021a
mov dword [esp + 0x24], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push dword [esp + 0x2c]
call esi
push dword [esp + 0x30]
mov edi, eax
mov dword [esp + 0x24], edi
call esi
cmp dword [esp + 0x3c], 0
jne 0x1001023f
mov dword [esp + 0x3c], edi
lea eax, [eax + edi + 2]
cmp eax, ebp
jbe 0x1001025c
add eax, 0xfffffefb
xor edx, edx
div ebp
inc eax
inc eax
imul eax, eax, 0x104
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add eax, eax
push eax
call fcn.100012ea
mov ebp, eax
test ebp, ebp
je 0x100104ab
push 0x140
push 0
push ebx
call sub.ntdll.dll_memset
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
call edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x100103c8
cmp dword [ebx + 0x1c], 0
jne 0x10010396
cmp dword [ebx + 0x20], 0x10000000
ja 0x10010396
lea eax, [ebx + 0x2c]
cmp word [eax], 0x2e
je 0x10010396
push eax
call esi
push dword [esp + 0x30]
mov ebx, eax
call esi
add ebx, dword [esp + 0x20]
add eax, ebx
lea eax, [eax + eax + 0x20]
lea ebx, [eax + 0x1c]
push ebx
call fcn.100012ea
mov esi, eax
test esi, esi
je 0x1001038c
push ebx
push 0
push esi
call sub.ntdll.dll_memset
push dword [esp + 0x38]
lea ebx, [esi + 0x1c]
push ebx
mov dword [esi + 4], esi
mov dword [esi], esi
call sub.ntdll.dll_wcscpy
add esp, 0x14
push 0x5c
push 0
push dword [esp + 0x38]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x1001033f
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
jmp 0x10010343
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
add eax, 0x2c
push eax
push ecx
push ebx
call edi
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0xc], eax
test ebx, ebx
je 0x1001036c
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [ecx + 4], esi
test ebx, ebx
je 0x10010388
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100103be
push 0
push dword [0x1002d23c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100102a8
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10027724
push dword [esp + 0x30]
push ebp
call edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x100104a1
lea eax, [ebx + 0x2c]
cmp word [eax], 0x2e
je 0x10010469
test byte [ebx], 0x10
je 0x10010469
push eax
call esi
mov ebx, eax
mov eax, dword [esp + 0x20]
lea eax, [ebx + eax + 2]
cmp eax, dword [esp + 0x10]
jbe 0x10010438
push ebp
call fcn.100012ff
mov eax, dword [esp + 0x20]
lea eax, [ebx + eax + 2]
add dword [esp + 0x10], 0x104
cmp dword [esp + 0x10], eax
jb 0x10010418
mov eax, dword [esp + 0x10]
add eax, eax
push eax
call fcn.100012ea
mov ebp, eax
test ebp, ebp
je 0x10010493
mov eax, dword [esp + 0x14]
add eax, 0x2c
push eax
push dword [esp + 0x30]
push ebp
call edi
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push ebp
call fcn.100101da
add dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x14]
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10010497
push 0
push dword [0x1002d23c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100103e9
jmp 0x10010497
mov ebx, dword [esp + 0x14]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebp, ebp
je 0x100104ab
push ebp
call fcn.100012ff
cmp dword [esp + 0x24], 0
pop edi
pop esi
je 0x100104bd
push dword [esp + 0x1c]
call fcn.100012ff
push ebx
call fcn.100012ff
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
add esp, 0x18
ret 0x18