Function at 0x1006649
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
push edi
push 0x1003200
push eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], edi
call fcn.01005ce4
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push eax
mov dword [ebp - 0x264], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x10066c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x25c], eax
jmp 0x1006762
test byte [ebp - 0x254], 0x10
je 0x10067a5
push 0x10031fc
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1006798
push 0x10031f4
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1006798
push edi
lea eax, [ebp - 0x228]
push eax
push 0x10031f0
push dword [ebp - 0x268]
call fcn.01005ce4
add esp, 0x10
mov dword [ebp - 0x258], eax
cmp eax, edi
je 0x10068f6
push esi
push dword [ebp - 0x260]
push ebx
push eax
call fcn.01006649
push edi
push dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
call fcn.01005b7d
cmp dword [ebp - 0x25c], edi
je 0x10068d6
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x264], edi
je 0x1006776
push edi
push dword [ebp - 0x264]
call fcn.01005b7d
cmp dword [ebp - 0x25c], edi
je 0x1006945
mov ecx, dword [ebx]
cmp ecx, edi
je 0x1006945
mov eax, dword [esi]
lea ecx, [ecx + eax*4]
cmp eax, edi
jmp 0x1006933
test byte [ebp - 0x254], 0x10
jne 0x10068d6
lea eax, [ebp - 0x258]
push eax
push 0x7fffffff
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x258], edi
call fcn.010053df
test eax, eax
jl 0x10068d6
mov eax, dword [ebp - 0x258]
cmp eax, 5
jb 0x10068d6
lea eax, [ebp + eax*2 - 0x230]
push 0x10031e4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10068d6
push 0xffffffffffffffff
push 0x10031cc
push 0xffffffffffffffff
lea eax, [ebp - 0x228]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10068d6
push edi
lea eax, [ebp - 0x228]
push eax
push 0x10031f0
push dword [ebp - 0x268]
call fcn.01005ce4
add esp, 0x10
mov dword [ebp - 0x270], eax
cmp eax, edi
je 0x10068f6
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
cmp dword [esi], eax
jne 0x10068c7
add eax, 0xa
mov dword [ecx], eax
lea ecx, [ebp - 0x258]
push ecx
push 4
pop ecx
mul ecx
push edx
push eax
mov dword [ebp - 0x258], edi
call fcn.01005d6c
test eax, eax
jl 0x1006905
mov eax, dword [ebx]
push edi
cmp eax, edi
je 0x100689c
push dword [ebp - 0x258]
push eax
call fcn.010059fb
mov edx, eax
mov dword [ebx], edx
mov edi, dword [esi]
push 0xa
xor eax, eax
lea edi, [edx + edi*4]
pop ecx
rep stosd dword es:[edi], eax
xor edi, edi
jmp 0x10068c3
push 0x738
push 0x1003164
push dword [ebp - 0x258]
call fcn.010058aa
push dword [ebp - 0x258]
mov dword [ebx], eax
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebx], edi
je 0x100690c
mov eax, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x270]
mov dword [ecx + eax*4], edx
inc dword [esi]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10066c0
jmp 0x1006756
mov dword [ebp - 0x25c], 8
jmp 0x1006756
mov eax, 0x216
jmp 0x100694b
push 8
pop eax
jmp 0x100694b
mov eax, dword [ecx]
cmp eax, edi
je 0x1006926
push edi
push eax
call fcn.01005b7d
mov eax, dword [ebp - 0x258]
mov dword [eax], edi
mov ecx, dword [ebp - 0x258]
sub ecx, 4
dec dword [esi]
cmp dword [esi], edi
mov dword [ebp - 0x258], ecx
jne 0x1006911
push edi
push dword [ebx]
call fcn.01005b7d
mov dword [ebx], edi
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008d3f
leave
ret 0x10