Function at 0x1050b5a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp + 0x10]
push 1
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x14]
push 0x141c
push 0x1009dfc
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x26c], eax
call fcn.01055826
or dword [ebp - 0x260], 0xffffffff
xor esi, esi
mov eax, 0x1010420
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2c8], eax
xor eax, eax
lea edi, [ebp - 0x29c]
push 0x24c
mov dword [ebp - 0x2a0], esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x250]
push esi
push eax
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x264], esi
xor ebx, ebx
mov dword [ebp - 0x254], esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x26c]
add esp, 0xc
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x258], esi
cmp eax, esi
je 0x1050c41
mov dword [eax], esi
mov edi, dword [ebp - 0x2a4]
mov eax, 0x142e
cmp edi, esi
jne 0x1050c66
mov dword [ebp - 0x290], 0x80070057
mov word [ebp - 0x28a], ax
jmp 0x105101f
mov word [ebp - 0x28c], ax
mov eax, 0x142f
cmp dword [ebp - 0x298], esi
je 0x1050c50
mov word [ebp - 0x28c], ax
mov eax, dword [edi]
cmp eax, 9
je 0x1050c94
cmp eax, 8
je 0x1050c94
mov eax, 0x1430
jmp 0x1050c50
mov edx, dword [edi + 0x10]
mov eax, 0x1430
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x290], esi
mov word [ebp - 0x28c], ax
call fcn.0106470b
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1433
jge 0x1050d10
jmp 0x1050c5a
push 0x5c
pop edx
lea ecx, [ebp - 0x2b0]
call fcn.010646cf
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1438
jl 0x1050c5a
mov word [ebp - 0x28c], ax
push dword [edi + 0x10]
xor edx, edx
lea ecx, [ebp - 0x2b0]
call fcn.01063ae1
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1439
jl 0x1050c5a
mov word [ebp - 0x28c], ax
mov edi, dword [edi + 8]
cmp edi, esi
jne 0x1050cc5
mov edx, dword [ebp - 0x2b0]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x100466c
lea ecx, [ebp - 0x2c8]
call fcn.01064650
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x143e
jl 0x1050c5a
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x264]
push eax
call fcn.0104f017
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1444
jl 0x1050c5a
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
je 0x1050f10
cmp eax, esi
je 0x1050f10
mov edi, 0x145b
test byte [ebp - 0x254], 0x10
je 0x1050ef5
lea ecx, [ebp - 0x254]
call fcn.0105d41b
test eax, eax
jne 0x1050ef5
test dword [ebp - 0x254], 0x400
jne 0x1050ef5
mov edx, dword [ebp - 0x2b0]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x2bc]
call fcn.01064650
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1450
jl 0x1050c5a
push 0x5c
pop edx
lea ecx, [ebp - 0x2bc]
mov word [ebp - 0x28c], ax
call fcn.0106469a
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1451
jl 0x1050c5a
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x294]
mov dword [ebp - 0x258], esi
call fcn.0104c493
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1454
jl 0x1050c5a
mov word [ebp - 0x28c], ax
cmp dword [ebp - 0x258], esi
jne 0x1050ef5
lea eax, [ebp - 0x2a0]
push eax
call fcn.01045bc0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.01055bde
cmp eax, esi
mov dword [ebp - 0x290], eax
jl 0x10510d3
mov eax, edi
mov word [ebp - 0x28c], ax
mov eax, dword [ebp - 0x254]
and eax, 6
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x264]
call fcn.0104a501
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x145e
jl 0x1050c5a
inc dword [ebp - 0x25c]
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1050dab
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x264]
call fcn.010465ed
mov dword [ebp - 0x258], esi
cmp dword [ebp - 0x25c], esi
jbe 0x1051011
push 0x20
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ebx, eax
mov eax, 0x146c
cmp ebx, esi
je 0x10510df
mov word [ebp - 0x28c], ax
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0x290], esi
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x258]
push dword [eax + ecx*8]
lea edi, [ebx + 0x10]
push edi
call fcn.01055bde
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x146f
jl 0x1050c5a
mov ecx, dword [ebp - 0x258]
mov word [ebp - 0x28c], ax
mov eax, dword [ebp - 0x2a4]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x268]
mov dword [ebx], 9
mov dword [ebx + 4], 3
mov dword [ebx + 0x18], 0x1000
push dword [eax + ecx*8 + 4]
push ebx
push 1
push dword [edi]
push dword [ebp - 0x298]
push dword [ebp - 0x294]
call fcn.0104c343
mov dword [ebp - 0x290], eax
cmp eax, esi
mov eax, 0x1476
jl 0x1050c5a
xor ebx, ebx
inc dword [ebp - 0x258]
mov word [ebp - 0x28c], ax
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x25c]
jb 0x1050f3b
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x25c]
cmp eax, esi
jbe 0x1051046
mov edi, dword [ebp - 0x268]
mov dword [ebp - 0x26c], eax
push edi
call fcn.01045bc0
add edi, 8
dec dword [ebp - 0x26c]
jne 0x1051035
push dword [ebp - 0x268]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x294]
push ebx
call fcn.01045ff1
mov edi, dword [ebp - 0x290]
cmp dword [ebp - 0x264], esi
je 0x1051077
push dword [ebp - 0x264]
call fcn.0104e7d2
cmp dword [ebp - 0x260], 0xffffffff
je 0x1051094
cmp dword [ebp - 0x260], esi
je 0x1051094
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x2c8]
call fcn.010635b3
lea ecx, [ebp - 0x2bc]
call fcn.010635b3
lea ecx, [ebp - 0x2b0]
call fcn.010635b3
lea ecx, [ebp - 0x290]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0x10
mov word [ebp - 0x28a], di
jmp 0x105101f
mov dword [ebp - 0x290], 0x8007000e
jmp 0x1050c5a