Function at 0x1085639
Capabilities:
Create thread
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x10b3818]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x484], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
push 0x206
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov edi, ecx
mov word [ebp - 0x20c], bx
call fcn.0107aa60
mov eax, dword [ebp - 0x464]
add esp, 0xc
mov dword [eax], ebx
cmp dword [edi], ebx
mov dword [ebp - 0x46c], ebx
jne 0x10856ab
mov eax, 0x80004005
jmp 0x1085a09
call fcn.0108647e
test eax, eax
jne 0x10856e2
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10856d8
test byte [eax + 0x1c], 4
je 0x10856d8
push 0x1007c60
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov eax, 0x1000010c
jmp 0x1085a09
lea eax, [ebp - 0x46c]
push eax
push 0x1007e74
push 0x1007b50
push 0x80000002
call fcn.01085de4
test eax, eax
jne 0x108570c
cmp dword [ebp - 0x46c], ebx
je 0x108570c
inc eax
jmp 0x108570e
xor eax, eax
push esi
mov dword [edi + 8], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0104391f
cmp eax, ebx
mov dword [ebp - 0x460], eax
jge 0x1085761
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085757
test byte [eax + 0x1c], 1
je 0x1085757
push dword [ebp - 0x460]
push 0x1007c60
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov eax, 0x80070057
jmp 0x1085a09
lea eax, [edi + 0x30]
push eax
mov dword [ebp - 0x478], eax
call dword [fcn.010011c4]
lea eax, [ebp - 0x20c]
push eax
call dword [0x10013e0]
mov dword [ebp - 0x468], eax
mov ecx, eax
lea eax, [ebp - 0x20c]
sub ecx, eax
sar ecx, 1
mov eax, 0x103
sub eax, ecx
cmp dword [ebp - 0x468], ebx
mov dword [ebp - 0x474], eax
jne 0x10857d8
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10857c9
test byte [eax + 0x1c], 1
je 0x10857c9
push 0x1007c60
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov dword [ebp - 0x460], 0x80070057
jmp 0x10859f7
lea eax, [ebp - 0x45c]
push eax
push esi
call dword [0x1001298]
cmp eax, 0xffffffff
mov dword [ebp - 0x470], eax
jne 0x1085825
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085816
test byte [eax + 0x1c], 1
je 0x1085816
push esi
push 0x1007c60
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c2b
mov dword [ebp - 0x460], 0x90080108
jmp 0x10859f7
cmp dword [ebp - 0x45c], 0x10
je 0x1085915
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x474]
push dword [ebp - 0x468]
call fcn.0104391f
cmp eax, ebx
mov dword [ebp - 0x460], eax
jge 0x108588b
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085915
test byte [eax + 0x1c], 1
je 0x1085915
push dword [ebp - 0x460]
push 0x1007c60
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
jmp 0x1085915
push 0x14
call fcn.0107a468
cmp eax, ebx
pop ecx
je 0x10858a3
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov esi, eax
jmp 0x10858a5
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0x480], esi
je 0x1085938
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.01045188
push dword [ebp - 0x47c]
lea ecx, [esi + 4]
call fcn.01045188
push dword [ebp - 0x484]
lea ecx, [esi + 8]
call fcn.01045188
mov eax, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x480]
push eax
lea ecx, [edi + 0x14]
call fcn.0108481e
test eax, eax
je 0x108590c
mov eax, dword [ebp - 0x464]
inc dword [eax]
mov dword [ebp - 0x460], ebx
jmp 0x1085915
push 1
mov ecx, esi
call fcn.01084209
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x470]
call dword [0x100129c]
test eax, eax
je 0x1085968
test byte [ebp + 0x14], 2
jne 0x1085825
jmp 0x1085968
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x108595e
test byte [eax + 0x1c], 1
je 0x108595e
push 0x14
push 0x1007c60
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov dword [ebp - 0x460], 0x8007000e
push dword [ebp - 0x470]
call dword [0x10012a0]
mov eax, dword [ebp - 0x464]
cmp dword [eax], ebx
jbe 0x10859f7
cmp dword [edi + 4], ebx
jne 0x10859f7
push dword [edi + 0x48]
call dword [0x10012d0]
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x108599a
push eax
call dword [fcn.010011f8]
lea eax, [edi + 0x54]
push eax
push ebx
push edi
push 0x10855a4
push ebx
push ebx
call dword [0x1001188]
cmp eax, ebx
mov dword [edi + 0x50], eax
jne 0x10859f0
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10859e4
test byte [eax + 0x1c], 1
je 0x10859e4
call dword [fcn.010011dc]
push eax
mov eax, dword [0x10b30cc]
push 0x1007c60
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov dword [ebp - 0x460], 0x80004005
jmp 0x10859f7
mov dword [edi + 4], 1
push dword [ebp - 0x478]
call dword [fcn.010011c0]
mov eax, dword [ebp - 0x460]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0107a6bf
leave
ret 0x18