Function at 0x100037a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0x1c], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, 0x2800
push esi
push 0x40
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x254]
push str._s.
push ecx
mov dword [ebp - 4], edi
call dword [0x10018cc0]
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x254]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x100038b7
lea ecx, [ebp + 0xb]
push 1
push ecx
mov ecx, ebx
mov byte [ebp + 0xb], 0x68
call fcn.10006b80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 0x68
mov ebx, 1
jmp 0x100038c7
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
lea edx, [esi - 0x208]
cmp ebx, edx
jbe 0x100038e7
add esi, 0x208
push 0x42
push esi
push edi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 4], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0x1001720c
lea esi, [ebp - 0x124]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x1000396a
test al, al
je 0x10003966
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x1000396a
add esi, 2
add edi, 2
test al, al
jne 0x10003942
xor eax, eax
jmp 0x1000396f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10003af3
mov edi, 0x10017208
lea esi, [ebp - 0x124]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x100039aa
test al, al
je 0x100039a6
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x100039aa
add esi, 2
add edi, 2
test al, al
jne 0x10003982
xor eax, eax
jmp 0x100039af
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10003af3
mov al, byte [ebp - 0x150]
mov ecx, dword [ebp - 4]
and al, 0x10
lea edi, [ebp - 0x124]
mov byte [ebx + ecx], al
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x124]
not ecx
dec ecx
lea edi, [ebx + eax]
mov dword [ebp - 0xc], ecx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
add ebx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx + eax], 0
mov ecx, dword [ebp - 0x134]
inc ebx
mov dword [ebx + eax], ecx
mov edx, dword [ebp - 0x130]
mov dword [ebx + eax + 4], edx
add ebx, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x13c]
mov dword [ebx + eax], ecx
mov edx, dword [ebp - 0x138]
mov dword [ebx + eax + 4], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ebx, 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x150]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100038c1
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
push ebx
push edi
call fcn.10006b80
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4