Function at 0x1005e0b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100d5788]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x100d6340], 0
jne 0x1005e1cc
mov al, byte [0x100d30dd]
xor al, 0xe9
mov byte [0x100d30e7], al
mov al, byte [0x100d30de]
xor al, 0xbb
mov byte [0x100d30e8], al
mov al, byte [0x100d30df]
xor al, 0x35
mov byte [0x100d30ea], al
mov al, byte [0x100d30e0]
xor al, 0xaa
mov byte [0x100d30eb], al
mov al, byte [0x100d30e1]
xor al, 0x98
mov byte [0x100d30ec], al
mov al, byte [0x100d30e2]
xor al, 0xc
mov byte [str.tUl_a], al
mov al, byte [0x100d30e3]
xor al, 0x4f
mov byte [0x100d30ee], al
mov al, byte [0x100d30e4]
xor al, 0xb7
mov byte [0x100d30ef], al
mov al, byte [0x100d30e5]
xor al, 0x83
mov byte [0x100d30f0], al
mov al, byte [0x100d30e6]
xor al, 0xf2
mov byte [0x100d30f1], al
mov al, byte [0x100d30f2]
xor al, 0xd7
mov byte [0x100d30fc], al
mov al, byte [0x100d30f3]
xor al, 0xe5
mov byte [0x100d30fd], al
mov al, byte [0x100d30f4]
xor al, 1
mov byte [0x100d30fe], al
mov al, byte [0x100d30f5]
xor al, 0xde
mov byte [0x100d30ff], al
mov al, byte [0x100d30f6]
xor al, 0x9b
mov byte [0x100d3100], al
mov al, byte [0x100d30f7]
xor al, 0xd5
mov byte [0x100d3101], al
mov al, byte [0x100d30f8]
xor al, 0xed
mov byte [0x100d3102], al
mov al, byte [0x100d30f9]
xor al, 0x63
mov byte [0x100d3103], al
mov al, byte [0x100d30fa]
xor al, 0x1b
mov byte [0x100d3104], al
mov al, byte [0x100d30fb]
xor al, 0xde
mov byte [0x100d3105], al
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov dword [0x100d6340], 1
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov ecx, esp
mov dword [ebp - 0x38], ecx
push eax
mov edx, esp
mov dword [ebp - 0x34], edx
sub esp, 0x140
mov eax, esp
mov dword [ebp - 0x30], eax
push eax
mov ebx, esp
mov dword [ebp - 0x1c], ebx
sub esp, 0xc8
mov ebx, esp
mov dword [ebp - 0x20], ebx
sub esp, 0x1f4
mov ebx, esp
mov dword [ebp - 0x2c], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x28], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x24], ebx
mov dword [ecx], edi
mov dword [edx], esi
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x20]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
lea eax, str.Program_Files
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc8
call fcn.1007f180
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov eax, dword [eax]
mov ecx, 0xffffffff
cmp eax, ecx
je 0x1005e568
jmp 0x1005e27c
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0x10
cmp eax, 0
je 0x1005e4e6
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100c848c
call fcn.1009d0c0
add esp, 8
cmp eax, 0
je 0x1005e4e1
mov ecx, dword [ebp - 0x30]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100c848e
call fcn.1009d0c0
add esp, 8
cmp eax, 0
je 0x1005e4e1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [0x100c8491]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005be80
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov edx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1009cfc0
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov eax, dword [ebp - 0x30]
add eax, 0x2c
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1009cfd0
mov ecx, dword [ebp - 0x2c]
add esp, 8
lea eax, [0x100c8493]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1009cfd0
add esp, 8
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call fcn.1005d750
add esp, 4
test al, 1
jne 0x1005e362
jmp 0x1005e367
jmp 0x1005e524
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e590
add esp, 8
cmp eax, 0
jne 0x1005e3da
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x96
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e590
add esp, 8
cmp eax, 0
jne 0x1005e3da
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, 0x32
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e590
add esp, 8
cmp eax, 0
jne 0x1005e3da
jmp 0x1005e524
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, dword [0x100d30e7]
mov dword [esi], edi
mov edi, dword [0x100d30eb]
mov dword [esi + 4], edi
mov di, word [0x100d30ef]
mov word [esi + 8], di
mov bl, byte [0x100d30f1]
mov byte [esi + 0xa], bl
mov esi, dword [0x100d30fc]
mov dword [edx], esi
mov esi, dword [0x100d3100]
mov dword [edx + 4], esi
mov si, word [0x100d3104]
mov word [edx + 8], si
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e590
add esp, 8
cmp eax, 0
je 0x1005e491
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e590
add esp, 8
cmp eax, 0
jne 0x1005e48c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e590
add esp, 8
cmp eax, 0
jne 0x1005e48c
jmp 0x1005e524
jmp 0x1005e491
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1005e0b0
add esp, 8
cmp eax, 0
je 0x1005e4dc
sub esp, 8
mov dword [esp], 5
mov dword [esp + 4], 8
call fcn.1000d8c0
add esp, 8
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
jmp 0x1005e571
jmp 0x1005e4e1
jmp 0x1005e51f
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1009d0c0
add esp, 8
cmp eax, 0
jne 0x1005e51a
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
jmp 0x1005e571
jmp 0x1005e51f
jmp 0x1005e524
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 0
jne 0x1005e27c
sub esp, 4
mov dword [esp], 5
call fcn.100215e0
mov eax, dword [ebp - 0x1c]
add esp, 4
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007c2bf
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret