Function at 0x1001bc10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x1005c300]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x2b4], ecx
test eax, eax
mov dword [ebp - 0x2a0], ebx
mov ecx, ebx
cmovns esi, eax
mov dword [ebp - 0x2a8], esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001bc50
sub ecx, edx
lea eax, [esi + 1]
sar ecx, 1
add eax, ecx
mov dword [ebp - 0x2ac], eax
add eax, eax
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
mov dword [ebp - 0x2a4], ecx
setne byte [ebp - 0x299]
test ecx, ecx
je 0x1001be1b
lea edx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1001bc92
push edi
push dword [ebp - 0x2a0]
sub ebx, edx
or edi, 0xffffffff
push dword [ebp - 0x2ac]
sar ebx, 1
push ecx
mov dword [ebp - 0x2b0], ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test esi, esi
jle 0x1001bce1
mov edx, dword [ebp - 0x2a4]
mov ecx, esi
shr ecx, 1
mov eax, 0x3f003f
lea edi, [edx + ebx*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
or edi, 0xffffffff
mov ecx, dword [ebp - 0x2a4]
lea eax, [esi + ebx]
xor edx, edx
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x298]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2a0], eax
cmp eax, 0xffffffff
je 0x1001bd71
mov ebx, eax
nop dword [eax + eax]
lea ecx, [ebp - 0x26c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001bd20
sub ecx, edx
sar ecx, 1
cmp esi, ecx
jg 0x1001bd4d
sub ecx, esi
lea eax, [ebp - 0x26c]
lea eax, [eax + ecx*2]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
add esp, 4
cmp edi, eax
cmovl edi, eax
lea eax, [ebp - 0x298]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001bd10
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [ebp - 0x2b0]
push 0xa
push 0x21
lea eax, [ebp - 0x48]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
add esp, 0x10
test esi, esi
jle 0x1001be03
mov edx, dword [ebp - 0x2a4]
mov ecx, esi
shr ecx, 1
lea esi, [ebp - 0x48]
mov eax, 0x300030
lea edi, [edx + ebx*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001bdb0
mov edi, dword [ebp - 0x2a8]
sub esi, ecx
sar esi, 1
xor edx, edx
lea eax, [ebp + esi*2 - 0x4a]
mov dword [ebp - 0x2a0], eax
cmp edx, esi
jge 0x1001be03
mov ax, word [eax]
mov ecx, edi
mov edi, dword [ebp - 0x2a4]
sub ecx, edx
add ecx, ebx
inc edx
mov word [edi + ecx*2 - 2], ax
mov eax, dword [ebp - 0x2a0]
mov edi, dword [ebp - 0x2a8]
sub eax, 2
mov dword [ebp - 0x2a0], eax
cmp edx, edi
jl 0x1001bdd1
push dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x2b4]
call fcn.1001be40
mov ecx, dword [ebp - 0x2a4]
pop edi
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [ebp - 4]
add esp, 4
mov al, byte [ebp - 0x299]
xor ecx, ebp
pop esi
pop ebx
call fcn.10043872
mov esp, ebp
pop ebp
ret