Function at 0x100ab520
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017a18f
mov eax, dword fs:[0]
push eax
mov eax, 0x11e4
call fcn.10141130
mov eax, dword [0x101e8118]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1168], 0
cmp dword [ebp + 0xc], 0
je 0x100abd64
push 0xdc
call fcn.1013b73e
add esp, 4
mov dword [ebp - 0x1108], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1108], 0
je 0x100ab59b
push 0
mov ecx, dword [ebp - 0x1108]
call fcn.10090a40
mov dword [ebp - 0x116c], eax
jmp 0x100ab5a5
mov dword [ebp - 0x116c], 0
mov eax, dword [ebp - 0x116c]
mov dword [ebp - 0x1104], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x238], ecx
push 0x40
call fcn.1013b73e
add esp, 4
mov dword [ebp - 0x1110], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1110], 0
je 0x100ab60b
push 1
push 0
push 0
push 0
push 0x10194514
mov edx, dword [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x1110]
call fcn.10108be0
mov dword [ebp - 0x1170], eax
jmp 0x100ab615
mov dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x1170]
mov dword [ebp - 0x110c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x14], ecx
mov ecx, 0x101ea630
call fcn.10093f30
mov edx, dword [eax]
push edx
call fcn.100ae020
add esp, 4
push 0
push str.basis.xml
push 0
lea eax, [ebp - 0x1114]
push eax
call fcn.100addf0
add esp, 8
mov dword [ebp - 0x1174], eax
mov ecx, dword [ebp - 0x1174]
mov dword [ebp - 0x1178], ecx
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x1178]
push edx
lea eax, [ebp - 0x1118]
push eax
call fcn.10019630
mov dword [ebp - 0x117c], eax
mov ecx, dword [ebp - 0x117c]
mov dword [ebp - 0x1180], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1180]
call fcn.10005a00
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10108d30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1118]
call fcn.10006030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1114]
call fcn.10006030
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x230]
call fcn.100abe30
mov dword [ebp - 4], 4
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x230]
call fcn.100abdd0
mov dword [ebp - 0x1184], eax
lea eax, [ebp - 0x228]
push eax
push 0x101ab930
push 0x101ab920
mov ecx, dword [ebp - 0x1184]
push ecx
mov edx, dword [ebp - 0x1184]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
test eax, eax
jge 0x100ab756
mov dword [ebp - 0x111c], 0x80004005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.100abdb0
mov eax, dword [ebp - 0x111c]
jmp 0x100abd66
cmp dword [ebp - 0x228], 0
jne 0x100ab786
mov dword [ebp - 0x1120], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.100abdb0
mov eax, dword [ebp - 0x1120]
jmp 0x100abd66
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ecx + 0x94]
call eax
push 0x10194538
push ecx
mov ecx, esp
mov dword [ebp - 0x1128], esp
push 0x1019453c
call fcn.100057d0
mov dword [ebp - 0x1188], eax
mov ecx, dword [ebp - 0x1188]
mov dword [ebp - 0x118c], ecx
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x112c], esp
push 0x10194540
call fcn.100057d0
mov dword [ebp - 0x1190], eax
mov edx, dword [ebp - 0x1190]
mov dword [ebp - 0x1194], edx
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x1130], esp
push 0x10194544
call fcn.100057d0
mov dword [ebp - 0x1198], eax
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x119c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1134]
push ecx
mov byte [ebp - 4], 4
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x11a0], eax
mov edx, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a4], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1168]
or eax, 1
mov dword [ebp - 0x1168], eax
mov ecx, dword [ebp - 0x11a4]
push ecx
call fcn.10006460
movzx edx, al
test edx, edx
jne 0x100ab950
push 0x10194558
push ecx
mov ecx, esp
mov dword [ebp - 0x1138], esp
push 0x1019455c
call fcn.100057d0
mov dword [ebp - 0x11a8], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x113c], esp
push 0x10194560
call fcn.100057d0
mov dword [ebp - 0x11b0], eax
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11b4], ecx
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x1140], esp
push 0x10194564
call fcn.100057d0
mov dword [ebp - 0x11b8], eax
mov edx, dword [ebp - 0x11b8]
mov dword [ebp - 0x11bc], edx
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x1144]
push eax
mov byte [ebp - 4], 8
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x11c0], eax
mov ecx, dword [ebp - 0x11c0]
mov dword [ebp - 0x11c4], ecx
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x1168]
or edx, 2
mov dword [ebp - 0x1168], edx
mov eax, dword [ebp - 0x11c4]
push eax
call fcn.10006460
movzx ecx, al
test ecx, ecx
jne 0x100ab950
mov dword [ebp - 0x11c8], 0
jmp 0x100ab95a
mov dword [ebp - 0x11c8], 1
mov dl, byte [ebp - 0x11c8]
mov byte [ebp - 0x1121], dl
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x1168]
and eax, 2
je 0x100ab98a
and dword [ebp - 0x1168], 0xfffffffd
lea ecx, [ebp - 0x1144]
call fcn.10006030
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x1168]
and ecx, 1
je 0x100ab9ae
and dword [ebp - 0x1168], 0xfffffffe
lea ecx, [ebp - 0x1134]
call fcn.10006030
movzx edx, byte [ebp - 0x1121]
test edx, edx
je 0x100abacb
push 1
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x1148]
call fcn.10004780
mov dword [ebp - 0x11cc], eax
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0x11d0], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x11d0]
call fcn.10004840
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.100c5ae0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1148]
call fcn.10004820
push 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x114c]
call fcn.10004780
mov dword [ebp - 0x11d4], eax
mov edx, dword [ebp - 0x11d4]
mov dword [ebp - 0x11d8], edx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x11d8]
call fcn.10004840
push eax
mov eax, dword [ebp - 0x228]
push eax
call fcn.100c5ae0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x114c]
call fcn.10004820
push 1
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x1150]
call fcn.10004780
mov dword [ebp - 0x11dc], eax
mov ecx, dword [ebp - 0x11dc]
mov dword [ebp - 0x11e0], ecx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x11e0]
call fcn.10004840
push eax
mov edx, dword [ebp - 0x228]
push edx
call fcn.100c5ae0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1150]
call fcn.10004820
mov dword [ebp - 0x10], 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
push 0x10194574
lea eax, [ebp - 0xa9c]
push eax
call fcn.1013b37a
add esp, 0xc
lea ecx, [ebp - 0x1154]
push ecx
call fcn.100ada80
add esp, 4
mov dword [ebp - 0x11e4], eax
mov edx, dword [ebp - 0x11e4]
mov dword [ebp - 0x11e8], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x11e8]
mov ecx, dword [eax]
push ecx
push 0x1019457c
lea edx, [ebp - 0xa4e]
push edx
call fcn.1013b37a
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1154]
call fcn.10006030
mov dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x24c], eax
push 0x208
lea ecx, [ebp - 0xeac]
push ecx
mov ecx, 0x101ea630
call fcn.10086950
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0xeac]
push edx
call fcn.100abd90
add esp, 8
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x100abba2
mov eax, dword [ebp - 0x23c]
mov word [eax], 0
push 0x10194584
lea ecx, [ebp - 0xeac]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0xeac]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10194588
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x10fc]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1100], eax
cmp dword [ebp - 0x1100], 0xffffffff
je 0x100abcb2
lea ecx, [ebp - 0xeac]
push ecx
lea edx, [ebp - 0xca4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x10d0]
push eax
lea ecx, [ebp - 0xca4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0xca4]
push edx
call fcn.10090c40
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x234], 0
je 0x100abc89
push 0x10194594
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100abc7c
lea edx, [ebp - 0xa9c]
push edx
push str.BHOSetSite
call dword [ebp - 0x10]
jmp 0x100abc89
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x10fc]
push ecx
mov edx, dword [ebp - 0x1100]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100abc01
mov eax, dword [ebp - 0x1100]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x115c], ecx
mov edx, dword [ebp - 0x115c]
mov dword [ebp - 0x1158], edx
cmp dword [ebp - 0x1158], 0
je 0x100abcec
push 1
mov eax, dword [ebp - 0x1158]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1158]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x11ec], eax
jmp 0x100abcf6
mov dword [ebp - 0x11ec], 0
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x1164], ecx
mov edx, dword [ebp - 0x1164]
mov dword [ebp - 0x1160], edx
cmp dword [ebp - 0x1160], 0
je 0x100abd34
push 1
mov eax, dword [ebp - 0x1160]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1160]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11f0], eax
jmp 0x100abd3e
mov dword [ebp - 0x11f0], 0
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [edx + 8]
call ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.100abdb0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1013a297
mov esp, ebp
pop ebp
ret 8