Function at 0x10069b40
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100644
mov eax, dword fs:[0]
push eax
sub esp, 0x5c8
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5d4], ecx
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x370], 0x103
push 0x104
push 0
lea eax, [ebp - 0x36c]
push eax
call fcn.100cac20
add esp, 0xc
push 0x104
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x14
push ecx
lea edx, [ebp - 0x36c]
push edx
call fcn.10003f80
add esp, 0xc
push 0xffffffffffffffff
push 0x10132554
push 0x104
lea eax, [ebp - 0x36c]
push eax
call fcn.10003fc0
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [0x101316dc]
push ecx
push 0x104
lea edx, [ebp - 0x36c]
push edx
call fcn.10003fc0
add esp, 0x10
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0xffffffff
jne 0x10069c3c
mov edx, dword [0x101307f8]
push edx
push 0x80043a99
mov ecx, dword [ebp - 0x5d4]
call fcn.10069820
xor al, al
jmp 0x10069f3a
lea ecx, [ebp - 0x4ac]
call fcn.1006a900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5cc]
call fcn.1006a840
mov byte [ebp - 4], 1
push 0x104
push 0
lea eax, [ebp - 0x36c]
push eax
call fcn.100cac20
add esp, 0xc
push 0x103
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x14
push ecx
lea edx, [ebp - 0x36c]
push edx
call fcn.10003f80
add esp, 0xc
push 0xffffffffffffffff
push 0x10132558
push 0x104
lea eax, [ebp - 0x36c]
push eax
call fcn.10003fc0
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x128]
push ecx
push 0x104
lea edx, [ebp - 0x36c]
push edx
call fcn.10003fc0
add esp, 0x10
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x36c]
push ecx
mov ecx, dword [ebp - 0x5d4]
call fcn.10069f60
movzx edx, al
test edx, edx
jne 0x10069d29
mov eax, dword [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x5cd], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5cc]
call fcn.1006a5f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.1006a960
mov al, byte [ebp - 0x5cd]
jmp 0x10069f3a
lea ecx, [ebp - 0x5cc]
push ecx
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x118
call fcn.1006ae70
push 0x104
push 0
lea edx, [ebp - 0x264]
push edx
call fcn.100cac20
add esp, 0xc
lea ecx, [ebp - 0x5cc]
call fcn.1006a790
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0
jne 0x10069d88
push pe_nt_image_headers32
push 0x1013255c
push str.NULL___lpfnGetProfileVersion
call fcn.100cb557
add esp, 0xc
cmp dword [ebp - 0x374], 0
jne 0x10069ddb
mov ecx, dword [0x101307cc]
push ecx
push 0x80043a98
mov ecx, dword [ebp - 0x5d4]
call fcn.10069820
mov byte [ebp - 0x5ce], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5cc]
call fcn.1006a5f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.1006a960
mov al, byte [ebp - 0x5ce]
jmp 0x10069f3a
mov edx, dword [ebp - 0x370]
push edx
lea eax, [ebp - 0x264]
push eax
call dword [ebp - 0x374]
add esp, 8
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x4ac]
call fcn.1006a980
push 0x104
push 0
lea edx, [ebp - 0x264]
push edx
call fcn.100cac20
add esp, 0xc
lea ecx, [ebp - 0x5cc]
call fcn.1006a7b0
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x10069e4b
push 0xf5
push 0x101325c4
push str.NULL___lpfnGetFileExtension
call fcn.100cb557
add esp, 0xc
cmp dword [ebp - 0x158], 0
jne 0x10069e9e
mov ecx, dword [0x101307cc]
push ecx
push 0x80043a98
mov ecx, dword [ebp - 0x5d4]
call fcn.10069820
mov byte [ebp - 0x5cf], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5cc]
call fcn.1006a5f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.1006a960
mov al, byte [ebp - 0x5cf]
jmp 0x10069f3a
mov edx, dword [ebp - 0x370]
push edx
lea eax, [ebp - 0x264]
push eax
call dword [ebp - 0x158]
add esp, 8
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x4ac]
call fcn.1006a9c0
lea edx, [ebp - 0x36c]
push edx
lea ecx, [ebp - 0x4ac]
call fcn.1006aa00
lea eax, [ebp - 0x4ac]
push eax
mov ecx, dword [ebp - 0x5d4]
add ecx, 4
call fcn.1006ad30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5cc]
call fcn.1006a5f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.1006a960
lea ecx, [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x378]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10069c3c
mov eax, dword [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret