Function at 0x1000a8e3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x100d12c0]
xor eax, esp
mov dword [esp + 0x278], eax
cmp dword [ebp + 0x24], 0x32
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x20]
push esi
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
jbe 0x1000a925
mov al, 1
jmp 0x1000ac28
mov edi, ecx
mov eax, ebx
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x18], edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1000a93a
sub eax, edx
sar eax, 1
lea eax, [ebx + eax*2]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
cmp word [ecx], si
je 0x1000aa72
movzx eax, word [edi]
push 0x3f
pop ecx
cmp cx, ax
je 0x1000aa48
push 0x2a
pop ecx
cmp cx, ax
je 0x1000aa48
push 0x25
pop ecx
cmp cx, ax
jne 0x1000aa2f
push 2
pop ecx
add edi, ecx
mov ebx, edi
jmp 0x1000a997
test ax, ax
je 0x1000aaec
add edi, ecx
movzx eax, word [edi]
push 0x25
pop edx
cmp dx, ax
jne 0x1000a98c
cmp word [edi], 0
je 0x1000aaec
add edi, ecx
mov esi, edi
xor eax, eax
sub esi, ebx
mov dword [esp + 0x20], eax
sar esi, 1
mov eax, esi
mul ecx
mov ecx, dword [esp + 0x20]
seto cl
mov dword [esp + 0x18], edi
neg ecx
or ecx, eax
push ecx
call fcn.10071ca9
mov edi, eax
pop ecx
test edi, edi
je 0x1000aaec
lea eax, [esi - 1]
push eax
push ebx
push esi
push edi
call 0x10072715
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x10
push 0
push 0
push edi
call ebx
mov esi, eax
cmp dword [ebp + 0x10], esi
jb 0x1000aae5
push dword [ebp + 0x10]
push dword [esp + 0x18]
push edi
call ebx
mov eax, dword [esp + 0x14]
sub dword [ebp + 0x10], esi
lea eax, [eax + esi*2 - 2]
push edi
mov dword [esp + 0x18], eax
call fcn.10071e2a
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
pop ecx
jmp 0x1000aa68
push 0x5c
pop ecx
cmp cx, ax
jne 0x1000aa4d
cmp byte [esp + 0x13], 0
jne 0x1000aa72
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
jmp 0x1000aa4d
mov byte [esp + 0x13], 1
dec dword [ebp + 0x10]
je 0x1000aaec
mov ecx, dword [esp + 0x14]
add dword [esp + 0x14], 2
inc edi
inc edi
mov word [ecx], ax
mov dword [esp + 0x18], edi
cmp word [edi], 0
jne 0x1000a95c
mov ecx, dword [esp + 0x14]
xor eax, eax
mov word [ecx], ax
cmp word [ebx], ax
je 0x1000aaec
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1000aa85
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebx + eax*2]
je 0x1000aaec
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x1000ac1a
push 4
pop ebx
mov ecx, 0x100b848c
lea eax, [esp + 0x5c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000aaf3
test dx, dx
je 0x1000aae1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000aaf3
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x1000aac1
xor eax, eax
jmp 0x1000aaf8
push edi
call fcn.10071e2a
pop ecx
xor al, al
jmp 0x1000ac28
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000ac03
mov ecx, 0x100b8490
lea eax, [esp + 0x5c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000ab2d
test dx, dx
je 0x1000ab29
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000ab2d
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x1000ab09
xor eax, eax
jmp 0x1000ab32
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000ac03
mov esi, dword [esp + 0x14]
sub esi, dword [esp + 0x1c]
sar esi, 1
add esi, dword [ebp + 0x10]
je 0x1000ac03
lea eax, [esp + 0x5c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1000ab54
sub eax, edx
sar eax, 1
dec esi
mov edi, eax
je 0x1000ac1a
mov ecx, dword [esp + 0x1c]
push 0x5c
pop eax
mov word [ecx], ax
cmp esi, edi
jbe 0x1000ac03
lea eax, [esp + 0x5c]
push eax
mov eax, ecx
add eax, 2
push esi
push eax
call fcn.100721c9
mov eax, dword [esp + 0x24]
add esp, 0xc
sub esi, edi
cmp word [eax], 0
jne 0x1000abd0
cmp byte [ebp + 0x14], 0
je 0x1000abaa
test byte [esp + 0x30], 0x10
jne 0x1000abba
cmp byte [ebp + 0x18], 0
je 0x1000ac03
test dword [esp + 0x30], 0x10
jne 0x1000ac03
push dword [esp + 0x2c]
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x2c]
call dword [esp + 0x34]
add esp, 0xc
jmp 0x1000abfb
test byte [esp + 0x30], 0x10
je 0x1000ac03
mov eax, dword [ebp + 0x24]
inc eax
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call fcn.1000a8e3
add esp, 0x20
mov byte [esp + 0x12], al
test al, al
jne 0x1000ac1a
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000aab8
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0x12]
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10071d9b
mov esp, ebp
pop ebp
ret