Function at 0x1000ce63
Capabilities:
Enumerate files on windows

Disassembly:
push 0x328
mov eax, 0x1003a00f
call fcn.10022cff
mov edi, ecx
mov dword [ebp - 0x31c], edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.1000701e
xor ebx, ebx
mov ecx, eax
push esi
mov dword [ebp - 4], ebx
call fcn.100070dc
add eax, 4
lea ecx, [ebp - 0x48]
push eax
call fcn.100128ab
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.1001340c
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x1000d249
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push 0x5c
cmovae eax, dword [ebp - 0x48]
pop edx
cmp word [eax + ecx*2], dx
je 0x1000ced2
push edx
lea ecx, [ebp - 0x48]
call fcn.100126f2
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x60]
call fcn.100128ab
push 0x2a
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.100126f2
inc dword [0x100509d8]
mov byte [ebp - 0x318], bl
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x310], ebx
mov dword [ebp - 0x30c], ebx
mov dword [ebp - 0x308], ebx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x304]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push ecx
cmovae eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.1000701e
cmp ebx, 0xffffffff
jne 0x1000cf99
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x2f], 0x1a12
call fcn.1001277c
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x30]
call fcn.10007064
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x318]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x334]
call fcn.10005aee
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.1001340c
jmp 0x1000d19c
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x2f], 0x512
call fcn.1001277c
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x30]
call fcn.10007064
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x318]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x334]
call fcn.10005aee
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.1001340c
lea eax, [ebp - 0x2d8]
push 0x100437a8
push eax
call fcn.1002a0c5
pop ecx
pop ecx
test eax, eax
je 0x1000d180
lea eax, [ebp - 0x2d8]
push 0x100437e0
push eax
call fcn.1002a0c5
pop ecx
pop ecx
test eax, eax
je 0x1000d180
mov edi, dword [ebp - 0x2e8]
xor esi, esi
add esi, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x30c]
adc edi, 0
test eax, eax
je 0x1000d053
cmp dword [ebp - 0x310], 0
je 0x1000d053
sub eax, dword [ebp - 0x310]
jmp 0x1000d055
xor eax, eax
cmp eax, 0x7cddf
jbe 0x1000d0e7
sub esp, 0x14
lea eax, [ebp - 0x318]
mov ecx, esp
push eax
call fcn.10005a66
mov ecx, dword [ebp - 0x31c]
call fcn.1000ca04
lea ecx, [ebp - 0x318]
call fcn.10005b11
lea ecx, [ebp - 0x30]
call fcn.1000701e
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x2f], 0x1b12
call fcn.1001277c
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x30]
call fcn.10007064
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x318]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x334]
call fcn.10005aee
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.1001340c
lea ecx, [ebp - 0xb4]
call fcn.1000713e
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0xac]
call fcn.10012757
mov eax, dword [ebp - 0x304]
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x334]
mov dword [ebp - 0x88], ecx
lea ecx, [ebp - 0xb4]
push eax
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], edi
call fcn.100071a2
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x318]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x334]
call fcn.10005aee
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 4
call fcn.1001340c
lea eax, [ebp - 0x304]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000cff1
mov edi, dword [ebp - 0x31c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x7c]
call fcn.1000701e
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x78]
mov word [ebp - 0x7b], 0x1912
call fcn.1001277c
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x7c]
call fcn.10007064
mov ecx, eax
call fcn.10005b56
push eax
push dword [ecx + 8]
lea ecx, [ebp - 0x318]
call fcn.10005b6a
dec dword [0x100509d8]
lea ecx, [ebp - 0x334]
call fcn.10005aee
sub esp, 0x14
lea eax, [ebp - 0x318]
mov ecx, esp
push eax
call fcn.10005a66
mov ecx, edi
call fcn.1000ca04
lea ecx, [ebp - 0x78]
call fcn.1001340c
dec dword [0x100509d8]
cmp dword [ebp - 0x314], 0
je 0x1000d241
cmp byte [ebp - 0x318], 0
jne 0x1000d241
push dword [ebp - 0x314]
dec dword [0x100509d4]
call fcn.10029cb0
pop ecx
lea ecx, [ebp - 0x60]
call fcn.1001340c
lea ecx, [ebp - 0x48]
call fcn.1001340c
call fcn.10022cbd
ret 4