Function at 0x10011120
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x680
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x678], eax
mov eax, dword [esp + 0x688]
mov ecx, dword [esp + 0x68c]
push ebx
push ebp
push esi
xor ebp, ebp
push 0x206
lea edx, [esp + 0x47e]
push ebp
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebp
mov word [esp + 0x484], bp
call fcn.1003d360
add esp, 0xc
push 0x206
lea eax, [esp + 0x276]
push ebp
push eax
mov word [esp + 0x27c], bp
call fcn.1003d360
mov edx, dword [esp + 0x69c]
lea eax, [esp + 0x484]
mov ecx, eax
add esp, 0xc
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x100111c6
movzx ecx, word [edx + eax]
test cx, cx
je 0x100111c6
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x100111a6
jmp 0x100111ca
test esi, esi
jne 0x100111cd
sub eax, 2
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [esp + 0x478]
push edx
mov word [eax], bp
call ebx
mov ecx, 0x104
lea eax, [esp + 0x478]
lea esp, [esp]
cmp word [eax], bp
je 0x100111ff
add eax, 2
sub ecx, 1
jne 0x100111f0
jmp 0x10011222
test ecx, ecx
je 0x10011222
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x478]
mov eax, 0x1005877c
call fcn.100067e0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x10011469
mov ebp, dword [esp + 0x69c]
lea esp, [esp]
mov ecx, 0x10058784
lea eax, [esp + 0x4c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10011286
test dx, dx
je 0x10011282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10011286
add eax, 4
add ecx, 4
test dx, dx
jne 0x10011260
xor eax, eax
jmp 0x1001128b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100113a4
mov ecx, 0x10058788
lea eax, [esp + 0x4c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100112c6
test dx, dx
je 0x100112c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100112c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100112a0
xor eax, eax
jmp 0x100112cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100113a4
mov esi, dword [esp + 0x690]
lea eax, [esp + 0x270]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ebx, [ebx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x10011310
movzx ecx, word [esi + eax]
test cx, cx
je 0x10011310
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100112f0
jmp 0x10011314
test edx, edx
jne 0x10011317
sub eax, 2
lea edx, [esp + 0x270]
push edx
mov word [eax], 0
call ebx
mov ecx, 0x104
lea eax, [esp + 0x270]
cmp word [eax], 0
je 0x10011342
add eax, 2
sub ecx, 1
jne 0x10011332
jmp 0x10011364
test ecx, ecx
je 0x10011364
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x270]
lea eax, [esp + 0x4c]
call fcn.100067e0
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.1003c8ff
add esp, 8
test eax, eax
je 0x100113e3
test byte [esp + 0x20], 0x10
je 0x100113a4
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esp + 0x278]
push esi
push edx
call fcn.10011120
add esp, 0x10
test eax, eax
mov dword [esp + 0x10], eax
jne 0x10011442
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10011250
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.1003c13d
add esp, 0x680
ret
test ebp, ebp
mov esi, 1
mov dword [esp + 0x10], esi
je 0x1001140a
cmp ebp, 0x7fffffff
ja 0x1001140a
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x270]
mov edx, ebp
call fcn.10002060
test byte [0x10065ac4], 1
jne 0x1001142b
or dword [0x10065ac4], esi
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
mov edx, dword [esp + 0x14]
push edx
push str.Found__s
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 8
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.1003c13d
add esp, 0x680
ret
mov ecx, dword [esp + 0x684]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0x680
ret