Function at 0x8f7c7ff
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
cmp edx, dword [ecx + 4]
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x67c], eax
jge 0x8f7c834
mov eax, 0x100
jmp 0x8f7c836
xor eax, eax
mov ebx, dword [ecx + edx*4 + 8]
or eax, edx
cmp word [ebx], 0
mov dword [ebp - 0x668], eax
je 0x8f7cb62
push esi
push ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.08f765c2
test eax, eax
jge 0x8f7c897
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7cb61
test byte [ecx + 0x1c], 8
je 0x8f7cb61
cmp byte [ecx + 0x19], 2
jb 0x8f7cb61
push eax
push 0x8f71868
push 0xb
jmp 0x8f7c9c1
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov dword [ebp - 0x678], eax
pop ecx
mov eax, ebx
pop ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x8f7c8b3
sub eax, edx
sar eax, 1
cmp eax, 0xff
mov dword [ebp - 0x670], eax
jl 0x8f7c90a
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f7cb61
test byte [eax + 0x1c], 8
je 0x8f7cb61
cmp byte [eax + 0x19], 2
jb 0x8f7cb61
push ebx
push 0x8f71868
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f738bd
jmp 0x8f7cb61
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.08f765c2
test eax, eax
jge 0x8f7c94c
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7cb61
test byte [ecx + 0x1c], 8
je 0x8f7cb61
cmp byte [ecx + 0x19], 2
jb 0x8f7cb61
push eax
push 0x8f71868
push 0xd
jmp 0x8f7c9c1
test edi, edi
je 0x8f7c976
push dword [ebp - 0x670]
push edi
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x8f7c976
mov eax, dword [ebp - 0x670]
lea eax, [edi + eax*2]
mov dword [ebp - 0x66c], eax
jmp 0x8f7c97d
and dword [ebp - 0x66c], 0
push 0x8f71884
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.08f845d6
test eax, eax
jge 0x8f7c9d1
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7cb61
test byte [ecx + 0x1c], 8
je 0x8f7cb61
cmp byte [ecx + 0x19], 2
jb 0x8f7cb61
push eax
push 0x8f71868
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
jmp 0x8f7cb61
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x674], eax
cmp eax, 0xffffffff
je 0x8f7cb61
test byte [ebp - 0x664], 0x12
jne 0x8f7cb0b
lea eax, [ebp - 0x638]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x8f7ca0a
sub eax, edx
sar eax, 1
cmp eax, 4
jle 0x8f7cb0b
mov edi, dword [ebp - 0x670]
add eax, edi
cmp eax, esi
jb 0x8f7ca70
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f7cb0b
test byte [eax + 0x1c], 8
je 0x8f7cb0b
cmp byte [eax + 0x19], 2
jb 0x8f7cb0b
lea ecx, [ebp - 0x638]
push ecx
push ebx
push 0x8f71868
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f7399d
jmp 0x8f7cb0b
cmp dword [ebp - 0x66c], 0
je 0x8f7caa4
lea eax, [ebp - 0x638]
push eax
push dword [ebp - 0x66c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x8f7caa4
and dword [ebp - 0x66c], eax
or dword [ebp - 0x668], 0x400
jmp 0x8f7caae
and dword [ebp - 0x668], 0xfffffbff
lea eax, [ebp - 0x638]
push eax
mov eax, esi
sub eax, edi
push eax
push dword [ebp - 0x678]
call fcn.08f765c2
test eax, eax
jl 0x8f7cb28
lea eax, [ebp - 0x20c]
push eax
call fcn.08f85242
test eax, eax
je 0x8f7cb0b
lea eax, [ebp - 0x638]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x8f7caf3
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x668]
lea eax, [ebp - 0x638]
push eax
push dword [ebp - 0x67c]
call fcn.08f7c6fa
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x8f7c9f4
jmp 0x8f7cb55
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7cb55
test byte [ecx + 0x1c], 8
je 0x8f7cb55
cmp byte [ecx + 0x19], 2
jb 0x8f7cb55
push eax
push 0x8f71868
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret 0x10