Function at 0x101ded8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
call fcn.0101ce9b
push 0x1003460
push esi
mov ebx, 0x100202c
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0101d4ed
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x101e0e1
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
cmp eax, reloc.NETAPI32.dll_NetApiBufferFree
jne 0x101df5e
call fcn.0101ce79
mov esi, eax
test esi, esi
jl 0x101e0e1
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push dword [ebp - 0x274]
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0101d4ed
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x101e0d5
test byte [ebp - 0x25c], 0x10
je 0x101e029
mov ecx, 0x1002028
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101dfc0
test dx, dx
je 0x101dfbc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101dfc0
add eax, 4
add ecx, 4
test dx, dx
jne 0x101df9a
xor eax, eax
jmp 0x101dfc5
sbb eax, eax
sbb eax, reloc.NETAPI32.dll_NetApiBufferFree
test eax, eax
je 0x101e0b6
mov ecx, 0x1002020
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101dffe
test dx, dx
je 0x101dffa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101dffe
add eax, 4
add ecx, 4
test dx, dx
jne 0x101dfd8
xor eax, eax
jmp 0x101e003
sbb eax, eax
sbb eax, reloc.NETAPI32.dll_NetApiBufferFree
test eax, eax
je 0x101e0b6
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x270]
push dword [ebp - 0x26c]
call fcn.0101ded8
mov esi, eax
jmp 0x101e0b6
and dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
and dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push dword [ebp - 8]
call fcn.0101ead8
mov esi, eax
test esi, esi
jl 0x101e09e
mov ecx, dword [ebp + 0x10]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov eax, dword [ebp - 8]
lea eax, [eax + ecx*2]
push eax
call fcn.0101ead8
mov esi, eax
test esi, esi
jl 0x101e09e
push 1
push 0x101dde1
push fcn.0101ddd0
push 0x101ddd8
push 0
push dword [ebp - 0x260]
push dword [ebp - 0x264]
push dword [ebp - 0x26c]
call fcn.0101f0b7
add esp, 0x20
test eax, eax
jne 0x101e09e
mov esi, 0x80004005
push dword [ebp - 0x264]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x260]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
test esi, esi
jl 0x101e0d5
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101df5e
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0xc]
call fcn.0101cff5
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007c80
leave
ret 0x10