Function at 0x1e7fc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe60
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00013e14
lea eax, [ebp - 0x188]
mov edx, dword [0x1cac0]
call fcn.000141d4
lea esi, [ebp - 2]
lea edi, [ebp - 0x158]
xor eax, eax
push ebp
push 0x1ebf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
test ebx, ebx
je 0x1eba3
mov eax, ebx
call fcn.00013c60
dec eax
jne 0x1e88b
mov al, byte [ebx]
add al, 0xd2
sub al, 2
jb 0x1eba3
sub al, 0x2c
je 0x1eba3
mov ax, word [0x1ec0c]
and ax, word [esi]
mov dx, word [0x1ec10]
cmp dx, ax
jne 0x1e8b6
mov ecx, 0x1ec1c
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a690
call fcn.00013420
test byte [esi], 0x20
je 0x1e8bf
or word [esi], 0x10
test byte [esi + 1], 2
je 0x1e8de
test byte [esi], 8
jne 0x1e8de
mov ecx, 0xe34
mov edx, 0x1ec70
mov eax, 0x1ec90
call fcn.0001396c
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0001fe44
mov eax, dword [0x3c9fc]
push eax
push 0
push 0
push edi
push 0
lea eax, [ebp - 0x18c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00013cac
mov eax, dword [ebp - 0x18c]
call fcn.00013e24
push eax
call sub.kernel32.dll_FindFirstFileExA
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x1eb9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.0001d710
xor al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x1e945
call fcn.000134c0
jmp 0x1eba3
cmp byte [edi + 0x2c], 0x2e
sete bl
test bl, bl
je 0x1e959
test byte [esi], 0x80
je 0x1eb67
test byte [edi], 0x10
setne al
mov byte [ebp - 0x15c], al
lea eax, [ebp - 0x188]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00013c34
cmp byte [ebp - 0x15c], 0
je 0x1e9b5
test byte [esi], 0x40
je 0x1e9b5
test bl, bl
jne 0x1e9b5
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x10]
call fcn.00013cac
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 8]
mov dx, word [esi]
call fcn.0001e7fc
cmp byte [ebp - 0x15c], 0
je 0x1e9c9
test byte [esi], 0x10
je 0x1eb67
jmp 0x1e9d2
test byte [esi], 0x20
jne 0x1eb67
test byte [esi], 8
je 0x1eaa5
test bl, bl
jne 0x1eaa5
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x10]
call fcn.00013cac
cmp byte [ebp - 0x15c], 0
je 0x1ea3e
mov eax, dword [ebp - 0x14]
call fcn.00018764
test al, al
jne 0x1eb67
test byte [esi + 1], 2
je 0x1eb67
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x198], eax
mov byte [ebp - 0x194], 0xb
lea edx, [ebp - 0x198]
xor ecx, ecx
mov eax, 0x1ecac
call fcn.0001d6f0
jmp 0x1eb67
test byte [esi + 1], 1
je 0x1ea55
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.0001e7d4
dec eax
jne 0x1eb67
test byte [esi + 1], 2
je 0x1ea81
lea eax, [ebp - 0x19c]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x10]
call fcn.00013cac
mov eax, dword [ebp - 0x19c]
xor edx, edx
call fcn.0001d720
jmp 0x1eb67
lea eax, [ebp - 0x1a0]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x10]
call fcn.00013cac
mov eax, dword [ebp - 0x1a0]
call fcn.00018634
jmp 0x1eb67
cmp word [ebp + 0xa], 0
je 0x1eb67
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x17c], eax
mov eax, dword [edi]
mov dword [ebp - 0x178], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x174], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x170], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x16c], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x168], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x164], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x160], eax
test byte [esi], 1
je 0x1eb07
lea eax, [ebp - 0x188]
call fcn.000202e0
test byte [esi], 2
je 0x1eb30
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x10]
call fcn.00013cac
test byte [esi], 1
je 0x1eb30
lea eax, [ebp - 0x180]
call fcn.000202e0
test byte [esi], 4
je 0x1eb5b
lea eax, [ebp - 0x184]
lea edx, [edi + 0x130]
mov ecx, 0xe
call fcn.00013c34
test byte [esi], 1
je 0x1eb5b
lea eax, [ebp - 0x184]
call fcn.000202e0
lea edx, [ebp - 0x188]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
push edi
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x1e945
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1eba3
mov eax, dword [ebp - 0x18]
call fcn.0001d710
test al, al
jne 0x1eb9b
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ebfe
lea eax, [ebp - 0x1a0]
mov edx, 2
call fcn.00013a28
lea eax, [ebp - 0x190]
mov edx, 2
call fcn.00013a28
lea eax, [ebp - 0x188]
mov edx, dword [0x1cac0]
call fcn.000142a0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00013a28
lea eax, [ebp - 8]
call fcn.00013a04
ret