Function at 0x10173890
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x101f0a7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe80
mov al, byte [esp + 0xf]
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov byte [esp + 0x20], al
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
push ebp
push ebp
lea ecx, [esp + 0x28]
mov dword [esp + 0xea0], ebp
call fcn.10173da0
mov ebx, dword [esp + 0xea8]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x280]
mov esi, dword [ebx + 4]
cmp esi, ebp
rep stosd dword es:[edi], eax
je 0x1017390d
mov ecx, dword [ebx + 8]
mov eax, 0xfe03f81
sub ecx, esi
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
jne 0x1017391f
mov edx, dword [esp + 0xea4]
lea eax, [esp + 0xa80]
push edx
push eax
jmp 0x1017392e
add esi, 0x400
lea ecx, [esp + 0xa80]
push esi
push ecx
call fcn.10033da9
add esp, 8
lea edx, [esp + 0x680]
push 0x1028bc44
push edx
call fcn.10033da9
mov ecx, dword [esp + 0x30]
add esp, 8
lea eax, [esp + 0x680]
push eax
push 1
push ecx
lea ecx, [esp + 0x2c]
call fcn.10173e40
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
sub eax, ecx
mov dword [esp + 0x14], ecx
mov ecx, eax
mov eax, 0xfe03f81
mov ebp, dword [ebx + 4]
imul ecx
sar edx, 7
mov ecx, dword [ebx + 8]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0xfe03f81
mov esi, edx
mov edx, dword [ebx + 0xc]
sub edx, ecx
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, esi
jae 0x10173a76
test ebp, ebp
je 0x101739d4
sub ecx, ebp
mov eax, 0xfe03f81
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp esi, edx
jae 0x101739d4
mov ecx, ebx
call fcn.10173d70
mov edi, eax
jmp 0x101739d6
mov edi, esi
mov ecx, ebx
call fcn.10173d70
add eax, edi
mov dword [esp + 0x18], eax
jns 0x101739e7
xor eax, eax
mov edx, eax
shl edx, 7
add edx, eax
shl edx, 4
push edx
call fcn.101d175d
add esp, 4
mov edi, eax
mov eax, dword [ebx + 4]
mov ecx, ebx
push edi
push ebp
push eax
call fcn.10173e00
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.10173e00
push eax
mov eax, dword [ebx + 8]
push eax
push ebp
mov ecx, ebx
call fcn.10173e00
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
push ecx
push edx
mov ecx, ebx
call fcn.10173df0
mov eax, dword [ebx + 4]
push eax
call fcn.101d1786
mov eax, dword [esp + 0x1c]
add esp, 4
mov ecx, eax
shl ecx, 7
add ecx, eax
shl ecx, 4
add ecx, edi
mov dword [ebx + 0xc], ecx
mov ecx, ebx
call fcn.10173d70
add eax, esi
mov dword [ebx + 4], edi
mov edx, eax
shl edx, 7
add edx, eax
shl edx, 4
add edx, edi
mov dword [ebx + 8], edx
jmp 0x10173b65
mov edx, ecx
mov eax, 0xfe03f81
sub edx, ebp
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, esi
jae 0x10173b03
mov edi, esi
shl edi, 7
add edi, esi
shl edi, 4
lea edx, [edi + ebp]
push edx
push ecx
push ebp
mov ecx, ebx
call fcn.10173e00
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 0x10]
push eax
sub eax, ebp
push ecx
mov ecx, eax
mov eax, 0xfe03f81
mov esi, dword [esp + 0x1c]
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
shl ecx, 7
add ecx, edx
shl ecx, 4
add ecx, esi
push ecx
mov ecx, ebx
call fcn.10173e00
mov ecx, dword [ebx + 8]
mov eax, 0xfe03f81
sub ecx, ebp
push ebp
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
shl ecx, 7
add ecx, edx
shl ecx, 4
add ecx, esi
push ecx
push esi
jmp 0x10173b55
test esi, esi
jbe 0x10173b65
mov edi, esi
push ecx
shl edi, 7
add edi, esi
push ecx
shl edi, 4
sub ecx, edi
mov dword [esp + 0x20], edi
push ecx
mov ecx, ebx
call fcn.10173e00
mov edx, dword [ebx + 8]
mov eax, edx
sub eax, edi
cmp ebp, eax
je 0x10173b4a
sub eax, 0x810
sub edx, 0x810
mov ecx, 0x204
mov esi, eax
mov edi, edx
cmp eax, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x10173b2c
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ebp
push edx
push eax
call fcn.10174190
mov eax, dword [ebx + 8]
add esp, 0xc
add eax, edi
mov dword [ebx + 8], eax
xor edi, edi
mov dword [esp + 0x10], edi
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, ebp
je 0x10173d01
mov ecx, dword [ebx + 8]
mov eax, 0xfe03f81
sub ecx, esi
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edi, edx
jae 0x10173d01
cmp edi, ebp
mov dword [esp + 0x14], ebp
jne 0x10173ba3
mov ebp, 3
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x280]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov edi, eax
shl edi, 7
add edi, eax
lea eax, [esp + 0x280]
shl edi, 4
lea edx, [edi + esi + 0x400]
push edx
push eax
call fcn.10033da9
lea ecx, [esp + 0x288]
push 0x1028bc08
push ecx
call fcn.10033d7f
mov ecx, dword [ebx + 4]
mov edx, edi
add edx, ecx
lea eax, [esp + 0x290]
push edx
push eax
call fcn.10033d7f
mov eax, dword [ebx + 4]
push 0x1028bc44
lea ecx, [edi + eax]
push ecx
call fcn.100340ae
add esp, 0x20
test eax, eax
je 0x10173c2a
lea edx, [esp + 0x280]
push 0x1028bc0c
push edx
call fcn.10033d7f
add esp, 8
lea eax, [esp + 0x30]
lea ecx, [esp + 0x280]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x10173cd9
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10173cd9
lea eax, [esp + 0x5c]
push 0x1026e6f4
push eax
call fcn.100340ae
add esp, 8
test eax, eax
je 0x10173c4c
lea ecx, [esp + 0x5c]
push 0x1026e6f8
push ecx
call fcn.100340ae
add esp, 8
test eax, eax
je 0x10173c4c
mov edx, dword [esp + 0x30]
and edx, 0x10
cmp dl, 0x10
je 0x10173c98
inc dword [esp + 0x14]
lea eax, [esp + 0x5c]
add ebp, 2
push eax
call fcn.10033dce
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
add esp, 4
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov esi, edx
mov ecx, 0xf
cdq
idiv ecx
test edx, edx
je 0x10173cce
inc esi
add ebp, esi
mov esi, dword [esp + 0x18]
jmp 0x10173c4c
mov edx, dword [ebx + 4]
mov ecx, dword [esp + 0x14]
mov dword [edi + edx + 0x800], ebp
mov eax, dword [ebx + 4]
mov dword [edi + eax + 0x804], ecx
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov edi, eax
jmp 0x10173b6b
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x24]
push eax
call fcn.101d1786
mov ecx, dword [esp + 0xe94]
add esp, 4
mov eax, 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe8c
ret