Function at 0x1004c020
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100c21f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x100c2d88], 0
jne 0x1004c130
mov al, byte [0x100c00dc]
xor al, 0x31
mov byte [0x100c00e6], al
mov al, byte [0x100c00dd]
xor al, 0xe2
mov byte [0x100c00e8], al
mov al, byte [0x100c00de]
xor al, 0xda
mov byte [0x100c00e9], al
mov al, byte [0x100c00df]
xor al, 0x37
mov byte [0x100c00ea], al
mov al, byte [0x100c00e0]
xor al, 0xe9
mov byte [0x100c00eb], al
mov al, byte [0x100c00e1]
xor al, 0xf9
mov byte [0x100c00ec], al
mov al, byte [0x100c00e2]
xor al, 0x39
mov byte [0x100c00ed], al
mov al, byte [0x100c00e3]
xor al, 0xb0
mov byte [0x100c00ee], al
mov al, byte [0x100c00e4]
xor al, 0x53
mov byte [0x100c00ef], al
mov al, byte [0x100c00e5]
xor al, 0xcd
mov byte [0x100c00f0], al
mov al, byte [0x100c00f1]
xor al, 0xc9
mov byte [0x100c00fa], al
mov al, byte [0x100c00f2]
xor al, 0xf2
mov byte [0x100c00fb], al
mov al, byte [0x100c00f3]
xor al, 0xd0
mov byte [0x100c00fc], al
mov al, byte [0x100c00f4]
xor al, 0x32
mov byte [0x100c00fd], al
mov al, byte [0x100c00f5]
xor al, 0xef
mov byte [0x100c00fe], al
mov al, byte [0x100c00f6]
xor al, 0x9c
mov byte [0x100c00ff], al
mov al, byte [0x100c00f7]
xor al, 0xf0
mov byte [0x100c0100], al
mov al, byte [0x100c00f8]
xor al, 0x93
mov byte [0x100c0101], al
mov al, byte [0x100c00f9]
xor al, 0x1e
mov byte [0x100c0102], al
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov dword [0x100c2d88], 1
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov ecx, esp
mov dword [ebp - 0x38], ecx
push eax
mov edx, esp
mov dword [ebp - 0x34], edx
sub esp, 0x140
mov eax, esp
mov dword [ebp - 0x30], eax
push eax
mov ebx, esp
mov dword [ebp - 0x1c], ebx
sub esp, 0xc8
mov ebx, esp
mov dword [ebp - 0x20], ebx
sub esp, 0x1f4
mov ebx, esp
mov dword [ebp - 0x2c], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x28], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x24], ebx
mov dword [ecx], edi
mov dword [edx], esi
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x20]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
lea eax, str.Program_Files
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc8
call fcn.1006c650
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov eax, dword [eax]
mov ecx, 0xffffffff
cmp eax, ecx
je 0x1004c4cc
jmp 0x1004c1e0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0x10
cmp eax, 0
je 0x1004c44a
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100b548c
call fcn.1008a590
add esp, 8
cmp eax, 0
je 0x1004c445
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100b548e
call fcn.1008a590
add esp, 8
cmp eax, 0
je 0x1004c445
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [0x100b5491]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10049c30
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov edx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1008a490
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov eax, dword [ebp - 0x30]
add eax, 0x2c
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1008a4a0
mov ecx, dword [ebp - 0x2c]
add esp, 8
lea eax, [0x100b5493]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1008a4a0
add esp, 8
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call fcn.1004b210
add esp, 4
test al, 1
jne 0x1004c2c6
jmp 0x1004c2cb
jmp 0x1004c488
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c500
add esp, 8
cmp eax, 0
jne 0x1004c33e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x96
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c500
add esp, 8
cmp eax, 0
jne 0x1004c33e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x32
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c500
add esp, 8
cmp eax, 0
jne 0x1004c33e
jmp 0x1004c488
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, dword [0x100c00e6]
mov dword [esi], edi
mov edi, dword [0x100c00ea]
mov dword [esi + 4], edi
mov di, word [0x100c00ee]
mov word [esi + 8], di
mov bl, byte [0x100c00f0]
mov byte [esi + 0xa], bl
mov esi, dword [0x100c00fa]
mov dword [edx], esi
mov esi, dword [0x100c00fe]
mov dword [edx + 4], esi
mov si, word [0x100c0102]
mov word [edx + 8], si
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c500
add esp, 8
cmp eax, 0
je 0x1004c3f5
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c500
add esp, 8
cmp eax, 0
jne 0x1004c3f0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c500
add esp, 8
cmp eax, 0
jne 0x1004c3f0
jmp 0x1004c488
jmp 0x1004c3f5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004c020
add esp, 8
cmp eax, 0
je 0x1004c440
sub esp, 8
mov dword [esp], 5
mov dword [esp + 4], 8
call fcn.1000d660
add esp, 8
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
jmp 0x1004c4d5
jmp 0x1004c445
jmp 0x1004c483
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1008a590
add esp, 8
cmp eax, 0
jne 0x1004c47e
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
jmp 0x1004c4d5
jmp 0x1004c483
jmp 0x1004c488
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 0
jne 0x1004c1e0
sub esp, 4
mov dword [esp], 5
call fcn.10022910
mov eax, dword [ebp - 0x1c]
add esp, 4
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006978f
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret