Function at 0x1010de4
Capabilities:
Enumerate files on windows

Disassembly:
push 0x680
mov eax, 0x1032134
call fcn.01011faf
xor esi, esi
push 0x24c
lea eax, [ebp - 0x66c]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x670], esi
call sub.msvcrt.dll_memset
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x674], esi
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x688], 0x1f
mov dword [ebp - 0x684], esi
mov dword [ebp - 4], esi
cmp dword [ebx + 0x19c], esi
jne 0x1010ea6
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101118c
test byte [eax + 0x1c], 1
je 0x101118c
push 0x1002b5c
push 0xdb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x101118c
push esi
push esi
lea eax, [ebp - 0x420]
push eax
push 0x10022ac
call fcn.01014d1d
mov edi, eax
cmp edi, esi
jge 0x1010ef4
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101118c
test byte [eax + 0x1c], 4
je 0x101118c
push edi
push 0x1002b5c
push 0xdc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x101118c
push 0x10022a0
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x1010f38
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101118c
test byte [eax + 0x1c], 1
je 0x101118c
push edi
push 0x1002b5c
push 0xdd
jmp 0x1010ee4
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x67c], eax
cmp eax, 0xffffffff
jne 0x1010f92
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101118c
test byte [eax + 0x1c], 4
je 0x101118c
lea ecx, [ebp - 0x218]
push ecx
push 0x1002b5c
push 0xde
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
jmp 0x101118c
cmp dword [ebp - 0x670], 0x10
je 0x101102b
lea eax, [ebp - 0x644]
push 0x5f
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x101102b
inc eax
inc eax
je 0x101102b
lea ecx, [ebp - 0x674]
push ecx
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExW]
test eax, eax
je 0x101102b
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x68c]
call fcn.01009ed5
cmp eax, esi
jl 0x1010ff2
mov eax, dword [ebp - 0x678]
inc dword [eax]
jmp 0x101102b
push 4
call fcn.01011b9e
mov edi, eax
pop ecx
mov dword [ebp - 0x678], edi
cmp edi, esi
je 0x10110d4
push edi
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x68c]
mov dword [edi], 1
call fcn.0100a583
cmp eax, esi
jl 0x1011102
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x67c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1010f92
mov eax, dword [ebp - 0x684]
neg eax
sbb eax, eax
mov dword [ebp - 0x680], eax
cmp eax, esi
je 0x1011180
mov edi, 0x798
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0x68c]
call fcn.0100ca79
cmp eax, esi
jl 0x1011180
mov ecx, dword [ebx + 0x19c]
push esi
push dword [ebp - 0x674]
push 2
push edi
call fcn.0101c4de
cmp eax, esi
jl 0x1011135
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebx + 0x19c]
push esi
push dword [eax]
push 2
push edi
call fcn.0101c4de
cmp eax, esi
jl 0x1011156
cmp dword [ebp - 0x680], esi
jne 0x1011063
jmp 0x1011180
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1011180
test byte [eax + 0x1c], 1
je 0x1011180
push 4
push 0x1002b5c
push 0xdf
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x101117b
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x101112c
test byte [ecx + 0x1c], 1
je 0x101112c
push eax
push 0x1002b5c
push 0xe0
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
push edi
call fcn.01011bdc
pop ecx
jmp 0x1011180
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x1011180
test byte [ecx + 0x1c], 1
je 0x1011180
push eax
push 0x1002b5c
push 0xe1
jmp 0x1011175
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x1011180
test byte [ecx + 0x1c], 1
je 0x1011180
push eax
push 0x1002b5c
push 0xe2
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
push dword [ebp - 0x67c]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68c]
call fcn.01018abd
call fcn.01012003
ret