Function at 0x1000d1d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100507f6
mov eax, dword fs:[0]
push eax
sub esp, 0xed0
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0xec8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10063790]
xor eax, esp
push eax
lea eax, [esp + 0xee4]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0xef4]
xor ebp, ebp
push 0x206
lea ecx, [esp + 0x6c2]
push ebp
push ecx
mov dword [esp + 0x28], eax
mov word [esp + 0x6c8], bp
call fcn.1003d360
add esp, 0xc
push 0x206
lea edx, [esp + 0x2b2]
push ebp
push edx
mov word [esp + 0x2b8], bp
call fcn.1003d360
add esp, 0xc
push 0x206
lea eax, [esp + 0xad2]
push ebp
push eax
mov word [esp + 0xad8], bp
call fcn.1003d360
add esp, 0xc
push 0x206
lea ecx, [esp + 0x4ba]
push ebp
push ecx
mov word [esp + 0x4c0], bp
call fcn.1003d360
add esp, 0xc
push 0x206
lea edx, [esp + 0x8ca]
push ebp
push edx
mov word [esp + 0x8d0], bp
call fcn.1003d360
add esp, 0xc
push 0x206
lea eax, [esp + 0xcda]
push ebp
push eax
mov word [esp + 0xce0], bp
call fcn.1003d360
lea eax, [esp + 0x6c8]
mov edx, edi
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x18], ebp
mov esi, 0x104
sub edx, ecx
lea ebx, [ebp + 1]
jmp 0x1000d2f0
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x1000d30f
movzx ecx, word [edx + eax]
cmp cx, bp
je 0x1000d30f
mov word [eax], cx
add eax, 2
sub esi, ebx
jne 0x1000d2f0
jmp 0x1000d313
cmp esi, ebp
jne 0x1000d316
sub eax, 2
lea edx, [esp + 0x6bc]
push edx
mov word [eax], bp
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, 0x104
lea eax, [esp + 0x6bc]
cmp word [eax], bp
je 0x1000d341
add eax, 2
sub ecx, ebx
jne 0x1000d333
jmp 0x1000d364
cmp ecx, ebp
je 0x1000d364
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x6bc]
mov eax, 0x1005877c
call fcn.100067e0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x6c0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x1000d8ae
lea edx, [esp + 0x2ac]
sub edi, edx
lea ecx, [ecx]
mov edx, 0x104
lea eax, [esp + 0x2ac]
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1000d3bf
movzx ecx, word [edi + eax]
cmp cx, bp
je 0x1000d3bf
mov word [eax], cx
add eax, 2
sub edx, ebx
jne 0x1000d3a0
jmp 0x1000d3c3
cmp edx, ebp
jne 0x1000d3c6
sub eax, 2
lea edx, [esp + 0x2ac]
push edx
mov word [eax], bp
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, 0x104
lea eax, [esp + 0x2ac]
cmp word [eax], bp
je 0x1000d3f1
add eax, 2
sub ecx, ebx
jne 0x1000d3e3
jmp 0x1000d416
cmp ecx, ebp
je 0x1000d416
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x2ac]
lea eax, [esp + 0x88]
call fcn.100067e0
lea eax, [esp + 0x88]
push 0x10058784
push eax
call fcn.1003c8ff
add esp, 8
test eax, eax
je 0x1000d883
lea ecx, [esp + 0x88]
push 0x10058788
push ecx
call fcn.1003c8ff
add esp, 8
test eax, eax
je 0x1000d883
test byte [esp + 0x5c], 0x10
je 0x1000d883
lea eax, [esp + 0xacc]
lea esi, [esp + 0x2ac]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1000d491
movzx ecx, word [esi + eax]
cmp cx, bp
je 0x1000d491
mov word [eax], cx
add eax, 2
sub edx, ebx
jne 0x1000d472
jmp 0x1000d495
cmp edx, ebp
jne 0x1000d498
sub eax, 2
mov word [eax], bp
mov ecx, 0x104
lea eax, [esp + 0xacc]
cmp word [eax], bp
je 0x1000d4b5
add eax, 2
sub ecx, ebx
jne 0x1000d4a7
jmp 0x1000d4d8
cmp ecx, ebp
je 0x1000d4d8
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0xacc]
mov eax, str.EXPLORER.EXE
call fcn.100067e0
lea eax, [esp + 0xcd4]
lea esi, [esp + 0x2ac]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1000d50f
movzx ecx, word [esi + eax]
cmp cx, bp
je 0x1000d50f
mov word [eax], cx
add eax, 2
sub edx, ebx
jne 0x1000d4f0
jmp 0x1000d513
cmp edx, ebp
jne 0x1000d516
sub eax, 2
mov word [eax], bp
mov ecx, 0x104
lea eax, [esp + 0xcd4]
cmp word [eax], bp
je 0x1000d533
add eax, 2
sub ecx, ebx
jne 0x1000d525
jmp 0x1000d556
cmp ecx, ebp
je 0x1000d556
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0xcd4]
mov eax, str.WIN.INI
call fcn.100067e0
lea eax, [esp + 0x4b4]
lea esi, [esp + 0x2ac]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1000d58f
movzx ecx, word [esi + eax]
cmp cx, bp
je 0x1000d58f
mov word [eax], cx
add eax, 2
sub edx, ebx
jne 0x1000d570
jmp 0x1000d593
cmp edx, ebp
jne 0x1000d596
sub eax, 2
mov word [eax], bp
mov ecx, 0x104
lea eax, [esp + 0x4b4]
cmp word [eax], bp
je 0x1000d5b3
add eax, 2
sub ecx, ebx
jne 0x1000d5a5
jmp 0x1000d5d6
cmp ecx, ebp
je 0x1000d5d6
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x4b4]
mov eax, str.SYSTEM32CONFIG
call fcn.100067e0
lea eax, [esp + 0x8c4]
lea esi, [esp + 0x2ac]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1000d60f
movzx ecx, word [esi + eax]
cmp cx, bp
je 0x1000d60f
mov word [eax], cx
add eax, 2
sub edx, ebx
jne 0x1000d5f0
jmp 0x1000d613
cmp edx, ebp
jne 0x1000d616
sub eax, 2
mov word [eax], bp
mov ecx, 0x104
lea eax, [esp + 0x8c4]
cmp word [eax], bp
je 0x1000d633
add eax, 2
sub ecx, ebx
jne 0x1000d625
jmp 0x1000d656
cmp ecx, ebp
je 0x1000d656
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x8c4]
mov eax, str.SYSTEM32WINPESHL.EXE
call fcn.100067e0
lea edx, [esp + 0xacc]
push edx
call fcn.1000b750
add esp, 4
test eax, eax
je 0x1000d7bb
mov dword [esp + 0x24], vtable.COS_Identify.0
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x4b8]
mov dword [esp + 0xef0], ebp
call fcn.10001110
cmp dword [esp + 0x58], ebp
jne 0x1000d776
test byte [0x10065ac4], bl
jne 0x1000d6ec
or dword [0x10065ac4], ebx
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea ecx, [esp + 0x4b4]
push ecx
push str.In__s_there_is_no_Windows_PE__Registry_
mov eax, 0x10065ac8
call fcn.1001e660
lea edx, [esp + 0x8cc]
push edx
call fcn.1000b750
add esp, 0xc
test eax, eax
jne 0x1000d7b0
test byte [0x10065ac4], bl
mov esi, ebx
jne 0x1000d73d
or dword [0x10065ac4], ebx
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
push str.No_winpeshl.exe
mov eax, 0x10065ac8
call fcn.1001e660
mov ecx, dword [esp + 0x20]
add esp, 4
lea eax, [esp + 0x2ac]
mov edx, 0x104
call fcn.10002060
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x1000d8b0
test byte [0x10065ac4], bl
jne 0x1000d796
or dword [0x10065ac4], ebx
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea eax, [esp + 0x4b4]
push eax
push str.In__s_there_is_Windows_PE__Registry_
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 8
mov dword [esp + 0xeec], 0xffffffff
lea ecx, [esp + 0xcd4]
push ecx
call fcn.1000b750
add esp, 4
test eax, eax
je 0x1000d883
mov dword [esp + 0x24], vtable.COS_Identify.0
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x4b8]
mov dword [esp + 0xef0], ebx
call fcn.10001110
cmp dword [esp + 0x58], ebp
jne 0x1000d85e
lea eax, [esp + 0x4b4]
push eax
push str.In__s_there_is_no_Windows_PE__Registry_
call fcn.100020c0
call fcn.1001e660
lea ecx, [esp + 0x8cc]
push ecx
call fcn.1000b750
add esp, 0xc
test eax, eax
je 0x1000d71b
jmp 0x1000d878
lea edx, [esp + 0x4b4]
push edx
push str.In__s_there_is_Windows_PE__Registry_
call fcn.100020c0
call fcn.1001e660
add esp, 8
mov dword [esp + 0xeec], 0xffffffff
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000d390
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x1000d8b0
mov eax, ebp
mov ecx, dword [esp + 0xee4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xec8]
xor ecx, esp
call fcn.1003c13d
add esp, 0xedc
ret