Function at 0x104c544
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
push 1
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x10]
push 0x14be
push 0x10098c4
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2b8], ebx
call fcn.01055826
or dword [ebp - 0x258], 0xffffffff
xor esi, esi
mov eax, 0x1010420
push 0x24c
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x250]
push esi
push eax
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x254], esi
call sub.msvcrt.dll_memset
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x268], esi
mov edi, dword [eax + 4]
mov eax, dword [edi + 0x5cc]
add esp, 0xc
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x294], eax
cmp ebx, esi
je 0x104c620
mov dword [ebx], esi
mov ecx, dword [ebp - 0x2a0]
cmp ecx, esi
jne 0x104c645
mov eax, 0x14d0
mov dword [ebp - 0x28c], 0x80070057
mov word [ebp - 0x286], ax
jmp 0x104c9c1
mov edx, 0x14d0
mov word [ebp - 0x288], dx
cmp dword [ebp - 0x2a8], esi
jne 0x104c65e
lea eax, [edx + 1]
jmp 0x104c62f
cmp dword [ecx], 3
mov edx, 0x14d1
mov word [ebp - 0x288], dx
je 0x104c674
lea eax, [edx + 1]
jmp 0x104c62f
mov ecx, 0x14d2
xor ebx, ebx
mov dword [ebp - 0x28c], esi
mov word [ebp - 0x288], cx
cmp eax, esi
jbe 0x104c6d8
mov dword [ebp - 0x29c], esi
mov eax, dword [edi + 0x5c8]
mov ecx, dword [ebp - 0x29c]
push dword [eax + ecx + 8]
mov eax, dword [ebp - 0x2a0]
push dword [eax + 0x10]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x104c6c9
add dword [ebp - 0x29c], 0x20
inc ebx
cmp ebx, dword [ebp - 0x294]
jb 0x104c692
jmp 0x104c6d8
shl ebx, 5
add ebx, dword [edi + 0x5c8]
mov dword [ebp - 0x264], ebx
mov eax, dword [ebp - 0x264]
mov edx, dword [eax + 0x14]
cmp edx, esi
jne 0x104c72c
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x104c715
test dword [eax + 0x1c], 0x10000000
je 0x104c715
mov ecx, dword [ebp - 0x264]
push dword [ecx + 8]
push 0x1007ee0
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, 0x14e4
mov dword [ebp - 0x28c], esi
mov word [ebp - 0x288], ax
jmp 0x104c9c1
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x10098a8
lea ecx, [ebp - 0x2b4]
call fcn.01064650
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x14e7
jl 0x104c639
push esi
push esi
mov word [ebp - 0x288], ax
mov eax, dword [ebp - 0x2a4]
push 0x1108
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x294], eax
cmp eax, esi
jne 0x104c793
call fcn.0105d3b8
mov dword [ebp - 0x28c], eax
mov eax, 0x14ea
jmp 0x104c639
mov eax, 0x14ea
mov word [ebp - 0x288], ax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x2b4]
mov dword [ebp - 0x28c], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x258], eax
cmp eax, 0xffffffff
je 0x104c9b3
cmp eax, esi
je 0x104c9b3
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x264]
mov edx, dword [eax + 0x14]
lea ecx, [ebp - 0x2b4]
call fcn.01064650
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x14f2
jl 0x104c639
mov word [ebp - 0x288], ax
lea eax, [ebp - 0x25c]
push eax
push 0x1009428
push esi
push dword [ebp - 0x2b4]
call dword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x14f4
jl 0x104c639
lea edx, [ebp - 0x268]
push edx
mov word [ebp - 0x288], ax
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x14f6
jl 0x104c639
push 0x20
mov word [ebp - 0x288], ax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ebx, eax
mov dword [ebp - 0x290], ebx
mov eax, 0x14f9
cmp ebx, esi
je 0x104ca4b
mov word [ebp - 0x288], ax
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0x28c], esi
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.01055bde
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x14fd
jl 0x104c639
mov word [ebp - 0x288], ax
mov eax, dword [ebp - 0x2a0]
mov dword [ebx + 8], eax
mov dword [ebx], 4
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
push dword [ebp - 0x268]
lea eax, [ebp - 0x2c4]
push 0x13f1
push dword [0x1077408]
push eax
call fcn.01064856
add esp, 0x10
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x1503
jl 0x104c639
mov word [ebp - 0x288], ax
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x294]
push dword [ebp - 0x25c]
call fcn.010467e6
test eax, eax
jge 0x104c93f
mov dword [ebp - 0x260], 5
push esi
push ebx
push dword [ebp - 0x260]
push dword [ebp - 0x2c4]
push dword [ebp - 0x2a8]
push dword [ebp - 0x2a4]
call fcn.0104c343
mov dword [ebp - 0x28c], eax
cmp eax, esi
mov eax, 0x150b
jl 0x104c639
mov word [ebp - 0x288], ax
push esi
lea eax, [ebp - 0x25c]
push eax
call fcn.0101725a
or dword [ebp - 0x260], 0xffffffff
inc dword [ebp - 0x298]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
mov dword [ebp - 0x290], esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x104c7cf
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx], eax
push dword [ebp - 0x268]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x290]
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x268], esi
call fcn.01045ff1
mov eax, dword [ebp - 0x25c]
mov edi, dword [ebp - 0x28c]
cmp eax, esi
je 0x104c9fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x258], 0xffffffff
je 0x104ca17
cmp dword [ebp - 0x258], esi
je 0x104ca17
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x2c4]
call fcn.010635b3
lea ecx, [ebp - 0x2b4]
call fcn.010635b3
lea ecx, [ebp - 0x28c]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0x10
mov dword [ebp - 0x28c], 0x8007000e
jmp 0x104c639