Function at 0x100ee063
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x29c], eax
mov esi, ecx
xor eax, eax
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x27c], eax
mov ebx, eax
call fcn.100ae82a
xor ecx, ecx
lea eax, [ebp - 0x27c]
push esi
mov edi, ecx
mov dword [ebp - 0x288], ecx
push eax
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x280], ecx
call fcn.100a7590
mov esi, eax
test esi, esi
jns 0x100ee0ee
push 0x1003173c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100ee540
lea ecx, [ebp - 0x27c]
call fcn.100b15f5
mov esi, eax
test esi, esi
jns 0x100ee106
push 0x10031634
jmp 0x100ee0d9
push 0x100081c0
lea ecx, [ebp - 0x24]
call fcn.100edf16
mov esi, eax
test esi, esi
jns 0x100ee120
push 0x1003255c
jmp 0x100ee0d9
cmp dword [ebp - 0x18], 0
je 0x100ee4dc
test edi, edi
je 0x100ee13f
lea eax, [edi - 4]
push eax
call fcn.100b84f9
and dword [ebp - 0x284], 0
pop ecx
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x24]
call fcn.100edea2
mov esi, eax
test esi, esi
js 0x100ee4d5
mov edi, dword [ebp - 0x284]
mov eax, 0x1003169c
mov ecx, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100ee18b
test dx, dx
je 0x100ee187
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100ee18b
add eax, 4
add ecx, 4
test dx, dx
jne 0x100ee165
xor eax, eax
jmp 0x100ee190
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100ee1f2
cmp dword [ebp - 0x18], eax
je 0x100ee4dc
test ebx, ebx
je 0x100ee4dc
mov edi, dword [ebp - 0x27c]
dec dword [ebp - 0x280]
push 0x5c
push edi
mov word [edi + ebx*2 - 2], ax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x100ee463
xor ecx, ecx
mov ebx, edi
mov word [eax + 2], cx
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x100ee1d6
mov edi, dword [ebp - 0x284]
sub ebx, ecx
sar ebx, 1
mov esi, edx
jmp 0x100ee120
inc dword [ebp - 0x280]
lea ecx, [ebp - 0x24]
push 0x1003169c
call fcn.100edf16
mov esi, eax
test esi, esi
js 0x100ee4ce
cmp word [edi], 0x2e
jne 0x100ee21d
xor edx, edx
cmp word [edi + 2], dx
je 0x100ee23b
push 0x10008980
mov edx, edi
lea ecx, [ebp - 0x27c]
call fcn.100a9500
mov esi, eax
test esi, esi
js 0x100ee4c7
xor edx, edx
mov ebx, dword [ebp - 0x27c]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x100ee244
sub ebx, ecx
mov edx, 0x10031664
lea ecx, [ebp - 0x27c]
sar ebx, 1
call fcn.100a8220
mov esi, eax
test esi, esi
js 0x100ee4c0
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov dword [ebp - 0x298], eax
cmp eax, 0xffffffff
je 0x100ee3c5
mov edx, 0x100081c0
lea ecx, [ebp - 0x24c]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x100ee2c0
test ax, ax
je 0x100ee2bc
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x100ee2c0
add ecx, 4
add edx, 4
test ax, ax
jne 0x100ee29a
xor eax, eax
jmp 0x100ee2c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100ee3a8
mov ecx, 0x1003169c
lea eax, [ebp - 0x24c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100ee2fe
test dx, dx
je 0x100ee2fa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100ee2fe
add eax, 4
add ecx, 4
test dx, dx
jne 0x100ee2d8
xor eax, eax
jmp 0x100ee303
sbb eax, eax
or eax, 1
test eax, eax
je 0x100ee3a8
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x24c]
xor ecx, ecx
mov word [eax + ebx*2], cx
lea ecx, [ebp - 0x27c]
call fcn.100a8220
mov esi, eax
test esi, esi
js 0x100ee479
test byte [ebp - 0x278], 0x10
je 0x100ee386
test dword [ebp - 0x278], 0x400
jne 0x100ee3a8
cmp dword [ebp - 0x280], 1
jne 0x100ee360
add dword [ebp - 0x288], 1
push 0
pop eax
adc dword [ebp - 0x28c], eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x24]
call fcn.100edf16
mov esi, eax
test esi, esi
jns 0x100ee3a8
lea eax, [ebp - 0x24c]
push eax
push 0x10032634
jmp 0x100ee485
push dword [ebp - 0x29c]
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
call fcn.10157090
mov esi, eax
test esi, esi
js 0x100ee472
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x298]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x100ee28f
jmp 0x100ee3e1
push dword [ebp - 0x27c]
xor eax, eax
push 0x10032674
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
mov eax, dword [ebp - 0x27c]
xor ecx, ecx
cmp dword [ebp - 0x280], 2
mov word [eax + ebx*2], cx
jne 0x100ee452
add dword [ebp - 0x294], 1
mov edx, dword [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x288]
pop eax
adc dword [ebp - 0x290], eax
mov eax, ecx
or eax, edx
je 0x100ee452
mov eax, dword [ebp - 0x29c]
push edx
push ecx
mov eax, dword [eax]
mov edi, dword [eax + 0x8c]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
mov eax, dword [ebp - 0x290]
push eax
mov eax, dword [ebp - 0x294]
push eax
call dword [0x101e07c0]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
js 0x100ee497
mov edi, dword [ebp - 0x284]
push dword [ebp - 0x298]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0x100ee120
mov esi, 0x80070057
push 0x100325b4
jmp 0x100ee51c
push 0x1003265c
jmp 0x100ee49c
lea eax, [ebp - 0x24c]
push eax
push 0x10032610
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ee4ac
push 0x10032698
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov eax, dword [ebp - 0x298]
cmp eax, 0xffffffff
je 0x100ee52c
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0x100ee52c
push 0x1003166c
jmp 0x100ee51c
push 0x100325f4
jmp 0x100ee51c
push 0x100325d4
jmp 0x100ee51c
push 0x10032588
jmp 0x100ee51c
mov ecx, dword [ebp - 0x288]
mov eax, ecx
mov edx, dword [ebp - 0x28c]
or eax, edx
je 0x100ee52c
mov eax, dword [ebp - 0x29c]
push edx
push ecx
push edx
mov eax, dword [eax]
push ecx
mov edi, dword [eax + 0x8c]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x101e07c0]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
jns 0x100ee52c
push 0x10032698
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x100ee540
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
mov edi, dword [ebp - 0x27c]
test edi, edi
je 0x100ee554
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
lea ecx, [ebp - 0x24]
call fcn.100a58a2
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0x10