Function at 0x10001880
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
mov eax, dword [0x1002f080]
xor eax, ebp
mov dword [ebp - 4], eax
push str.autoscroll.cs
lea ecx, [ebp - 0x94]
call fcn.10003ad0
push str.mod.cs
lea ecx, [ebp - 0x7c]
call fcn.10003ad0
push str.aimbot.cs
lea ecx, [ebp - 0x64]
call fcn.10003ad0
push str.aim.cs
lea ecx, [ebp - 0x4c]
call fcn.10003ad0
push str.silentbot.cs
lea ecx, [ebp - 0x34]
call fcn.10003ad0
push str.scroll.cs
lea ecx, [ebp - 0x1c]
call fcn.10003ad0
nop
lea eax, [ebp - 0x24c]
push eax
push 0x1002544c
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc4]
push edx
call fcn.10002530
add esp, 0xc
mov ecx, eax
call fcn.10006800
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x258], eax
lea ecx, [ebp - 0xc4]
call fcn.10004760
nop
cmp dword [ebp - 0x258], 0xffffffff
jne 0x10001973
push 0x10003250
mov eax, dword [ebp + 8]
push eax
push str.CLEO_folder_does_not_exist:
push 0x10030168
call fcn.10002220
add esp, 8
push eax
call fcn.100021f0
add esp, 8
mov ecx, eax
call fcn.10004af0
push fcn.10004760
push 6
push 0x18
lea ecx, [ebp - 0x94]
push ecx
call fcn.10005290
nop
jmp 0x10001b65
mov byte [ebp - 0x24d], 0
lea edx, [ebp - 0x94]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x25c]
add ecx, 0x90
mov dword [ebp - 0x260], ecx
jmp 0x100019b5
mov edx, dword [ebp - 0x254]
add edx, 0x18
mov dword [ebp - 0x254], edx
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x260]
je 0x10001afb
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x264], ecx
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0xac]
call fcn.10003ad0
mov eax, dword [ebp - 0x264]
push eax
lea ecx, [ebp - 0xac]
push ecx
lea edx, [ebp - 0xdc]
push edx
call fcn.10001140
add esp, 8
push eax
call fcn.100024f0
add esp, 8
mov byte [ebp - 0x24e], al
lea ecx, [ebp - 0xdc]
call fcn.10004760
lea ecx, [ebp - 0xac]
call fcn.10004760
movzx eax, byte [ebp - 0x24e]
test eax, eax
je 0x10001af6
mov byte [ebp - 0x24d], 1
push 0x10003250
lea ecx, [ebp - 0x220]
push ecx
push 0x10025470
push 0x10030168
call fcn.10002220
add esp, 8
push eax
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
push 1
lea ecx, [ebp - 0x2fc]
call fcn.10003840
lea edx, [ebp - 0x220]
push edx
push str.Script_found_in_CLEO_folder:
lea eax, [ebp - 0x2fc]
push eax
call fcn.10002220
add esp, 8
push eax
call fcn.10002220
add esp, 8
lea ecx, [ebp - 0xf4]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.10008660
push eax
call fcn.100012f0
add esp, 4
lea ecx, [ebp - 0xf4]
call fcn.10004760
nop
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x2fc]
call fcn.10008660
push eax
call fcn.10001220
add esp, 4
lea ecx, [ebp - 0x10c]
call fcn.10004760
nop
lea ecx, [ebp - 0x2fc]
call fcn.10004e00
nop
jmp 0x100019a6
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000197a
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
movzx eax, byte [ebp - 0x24d]
test eax, eax
jne 0x10001b4f
push 0x10003250
push str.No_monitored_scripts_found_in_CLEO_folder.
push 0x10030168
call fcn.10002220
add esp, 8
mov ecx, eax
call fcn.10004af0
nop
push fcn.10004760
push 6
push 0x18
lea ecx, [ebp - 0x94]
push ecx
call fcn.10005290
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f17
mov esp, ebp
pop ebp
ret