Function at 0x100037a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0x1c], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, 0x2800
push esi
push 0x40
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 4], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x254]
push eax
push str._s.
push ecx
call dword [0x10018cd0]
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x254]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x10003875
lea ecx, [ebp + 0xb]
push 1
push ecx
mov ecx, ebx
mov byte [ebp + 0xb], 0x68
call fcn.10006a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 0x68
mov ebx, 1
jmp 0x10003885
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
lea edx, [esi - 0x208]
cmp ebx, edx
jbe 0x100038a5
add esi, 0x208
push 0x42
push esi
push edi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 4], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0x1001720c
lea esi, [ebp - 0x124]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x1000390f
test al, al
je 0x1000390b
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x1000390f
add esi, 2
add edi, 2
test al, al
jne 0x100038e7
xor eax, eax
jmp 0x10003914
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10003a0b
mov edi, 0x10017208
lea esi, [ebp - 0x124]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x1000394f
test al, al
je 0x1000394b
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x1000394f
add esi, 2
add edi, 2
test al, al
jne 0x10003927
xor eax, eax
jmp 0x10003954
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10003a0b
mov al, byte [ebp - 0x150]
mov ecx, dword [ebp - 4]
and al, 0x10
lea edi, [ebp - 0x124]
mov byte [ebx + ecx], al
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x124]
not ecx
dec ecx
lea edi, [ebx + eax]
mov dword [ebp - 0xc], ecx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
add ebx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx + eax], 0
mov ecx, dword [ebp - 0x134]
inc ebx
mov dword [ebx + eax], ecx
mov edx, dword [ebp - 0x130]
mov dword [ebx + eax + 4], edx
add ebx, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x13c]
mov dword [ebx + eax], ecx
mov edx, dword [ebp - 0x138]
mov dword [ebx + eax + 4], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ebx, 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x150]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000387f
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
push ebx
push edi
call fcn.10006a90
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4