Function at 0x1001daf0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047ad1
mov eax, dword fs:[0]
push eax
sub esp, 0x8f4
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8b4], 0
lea ecx, [ebp - 0x8d0]
call fcn.1001f1f0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c0], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x8ac], ecx
mov edx, dword [ebp - 0x8ac]
mov dword [ebp - 0x900], edx
mov eax, dword [ebp - 0x8c0]
mov cx, word [eax]
mov word [ebp - 0x89e], cx
mov edx, dword [ebp - 0x8ac]
mov ax, word [ebp - 0x89e]
mov word [edx], ax
mov ecx, dword [ebp - 0x8c0]
add ecx, 2
mov dword [ebp - 0x8c0], ecx
mov edx, dword [ebp - 0x8ac]
add edx, 2
mov dword [ebp - 0x8ac], edx
cmp word [ebp - 0x89e], 0
jne 0x1001db5a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x8a4], eax
mov ecx, dword [ebp - 0x8a4]
add ecx, 2
mov dword [ebp - 0x8e0], ecx
mov edx, dword [ebp - 0x8a4]
mov ax, word [edx]
mov word [ebp - 0x8b6], ax
add dword [ebp - 0x8a4], 2
cmp word [ebp - 0x8b6], 0
jne 0x1001dbbd
mov ecx, dword [ebp - 0x8a4]
sub ecx, dword [ebp - 0x8e0]
sar ecx, 1
mov dword [ebp - 0x8e4], ecx
mov edx, dword [ebp - 0x8e4]
movzx eax, word [ebp + edx*2 - 0x21e]
cmp eax, 0x5c
jne 0x1001dc11
mov dword [ebp - 0x8d4], 0x10056068
jmp 0x1001dc1b
mov dword [ebp - 0x8d4], 0x1005606c
mov ecx, dword [ebp - 0x8d4]
mov dword [ebp - 0x8a8], ecx
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8d8], edx
mov eax, dword [ebp - 0x8a8]
mov cx, word [eax]
mov word [ebp - 0x8b8], cx
add dword [ebp - 0x8a8], 2
cmp word [ebp - 0x8b8], 0
jne 0x1001dc33
mov edx, dword [ebp - 0x8a8]
sub edx, dword [ebp - 0x8d8]
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x8e8], eax
mov dword [ebp - 0x8ec], edx
lea ecx, [ebp - 0x21c]
add ecx, 0xfffffffe
mov dword [ebp - 0x8b0], ecx
mov edx, dword [ebp - 0x8b0]
mov ax, word [edx + 2]
mov word [ebp - 0x8ba], ax
add dword [ebp - 0x8b0], 2
cmp word [ebp - 0x8ba], 0
jne 0x1001dc81
mov edi, dword [ebp - 0x8b0]
mov esi, dword [ebp - 0x8e8]
mov edx, dword [ebp - 0x8ec]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x89c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 0xffffffff
jne 0x1001dd23
lea edx, [ebp - 0x8d0]
push edx
mov ecx, dword [ebp + 8]
call fcn.1001f170
mov eax, dword [ebp - 0x8b4]
or eax, 1
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d0]
call fcn.1001f0e0
mov eax, dword [ebp + 8]
jmp 0x1001df2c
push 0x10056074
lea ecx, [ebp - 0x870]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1001dd4f
push 0x10056078
lea edx, [ebp - 0x870]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1001dd54
jmp 0x1001ded0
mov eax, dword [ebp - 0x89c]
and eax, 0x10
je 0x1001de5a
xor ecx, ecx
mov word [ebp - 0x428], cx
push 0x208
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.1002bb10
add esp, 0xc
lea eax, [ebp - 0x870]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x10056080
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x8fc]
push ecx
call fcn.1001daf0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8fc]
call fcn.1001efe0
movzx edx, al
test edx, edx
jne 0x1001de49
lea eax, [ebp - 0x8fc]
mov dword [ebp - 0x8dc], eax
lea ecx, [ebp - 0x8c4]
push ecx
mov ecx, dword [ebp - 0x8dc]
call fcn.1001f070
lea edx, [ebp - 0x8f0]
push edx
mov ecx, dword [ebp - 0x8dc]
call fcn.1001f010
jmp 0x1001de0b
lea ecx, [ebp - 0x8c4]
call fcn.1001ef70
lea eax, [ebp - 0x8f0]
push eax
lea ecx, [ebp - 0x8c4]
call fcn.100104d0
movzx ecx, al
test ecx, ecx
je 0x1001de49
lea ecx, [ebp - 0x8c4]
call fcn.1001ef90
mov dword [ebp - 0x8f4], eax
mov edx, dword [ebp - 0x8f4]
push edx
lea ecx, [ebp - 0x8d0]
call fcn.1001efb0
jmp 0x1001de00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8fc]
call fcn.1001f0e0
jmp 0x1001ded0
xor eax, eax
mov word [ebp - 0x634], ax
push 0x208
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.1002bb10
add esp, 0xc
lea edx, [ebp - 0x870]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str._s_s
lea ecx, [ebp - 0x634]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x634]
push edx
lea ecx, [ebp - 0x64c]
call fcn.10004990
mov byte [ebp - 4], 2
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x8d0]
call fcn.1001f130
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64c]
call fcn.10004940
lea ecx, [ebp - 0x89c]
push ecx
mov edx, dword [ebp - 0x8c8]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001dd23
mov eax, dword [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x8d0]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1001f170
mov edx, dword [ebp - 0x8b4]
or edx, 1
mov dword [ebp - 0x8b4], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d0]
call fcn.1001f0e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret