Function at 0x1008925
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 4]
call ebx
push dword [edi]
mov esi, eax
call ebx
add esi, eax
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x114]
test eax, eax
je 0x1008959
push eax
call ebx
add esi, eax
add esi, 5
mov dword [ebp + 8], esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x42
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x42
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
push dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp + 8], eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp - 4]
add eax, ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
mov eax, dword [edi]
jne 0x10089b0
inc eax
inc eax
jmp 0x10089b1
inc eax
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
call ebx
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0x1001454
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x1008a44
test byte [ebp - 0x148], 0x10
je 0x1008a27
lea eax, [ebp - 0x11c]
push 0x10016b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1008a27
lea eax, [ebp - 0x11c]
push 0x1001704
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1008a27
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.01008ba4
cmp dword [0x1014afc], 0
jne 0x1008a44
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10089e5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 4]
push dword [ebp + 8]
call esi
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x114]
test eax, eax
jne 0x1008a67
mov eax, 0x1001454
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LocalHandle]
mov dword [ebp - 8], eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_LocalUnlock]
push eax
call ebx
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 8]
call esi
push eax
call ebx
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], 0xffffffff
je 0x1008aff
cmp dword [0x1014afc], 0
jne 0x1008aff
test byte [ebp - 0x148], 0x10
jne 0x1008aeb
push dword [ebp - 0x130]
lea eax, [ebp - 0x11c]
push dword [ebp - 0x134]
push dword [ebp - 0x128]
push eax
push edi
call fcn.01008b44
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1008aba
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0
push 1
pop esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x18], esi
je 0x1008b3d
push dword [edi + 0x14]
call sub.GUtils.dll_List_First
mov edi, eax
test edi, edi
je 0x1008b3d
cmp dword [0x1014afc], 0
jne 0x1008b3d
push esi
push edi
call fcn.01008925
push edi
call sub.GUtils.dll_List_Next
jmp 0x1008b1f
pop edi
pop esi
pop ebx
leave
ret 8