Function at 0x1010cac0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x101d3b48]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x51984c4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [0x101d46d4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
sub eax, 0x8ce76048
je 0x1010d1ef
jmp 0x1010cb10
mov eax, dword [ebp - 0x2c]
sub eax, 0x8cf66cb7
je 0x1010cd46
jmp 0x1010cb23
mov eax, dword [ebp - 0x2c]
sub eax, 0x9c6906ef
je 0x1010cef1
jmp 0x1010cb36
mov eax, dword [ebp - 0x2c]
sub eax, 0x9e612b49
je 0x1010d0b7
jmp 0x1010cb49
mov eax, dword [ebp - 0x2c]
sub eax, 0x9fc481b2
je 0x1010cf21
jmp 0x1010cb5c
mov eax, dword [ebp - 0x2c]
sub eax, 0xa446388a
je 0x1010d070
jmp 0x1010cb6f
mov eax, dword [ebp - 0x2c]
sub eax, 0xa5b17425
je 0x1010d25b
jmp 0x1010cb82
mov eax, dword [ebp - 0x2c]
sub eax, 0xcc7c3a3b
je 0x1010d30a
jmp 0x1010cb95
mov eax, dword [ebp - 0x2c]
sub eax, 0xce12f26d
je 0x1010d280
jmp 0x1010cba8
mov eax, dword [ebp - 0x2c]
sub eax, 0xcecd28e5
je 0x1010d272
jmp 0x1010cbbb
mov eax, dword [ebp - 0x2c]
sub eax, 0xf09eff70
je 0x1010d169
jmp 0x1010cbce
mov eax, dword [ebp - 0x2c]
sub eax, 0xfe598de8
je 0x1010d1b9
jmp 0x1010cbe1
mov eax, dword [ebp - 0x2c]
sub eax, 0x51984c4
je 0x1010cd29
jmp 0x1010cbf4
mov eax, dword [ebp - 0x2c]
sub eax, 0x75a7dd0
je 0x1010d28e
jmp 0x1010cc07
mov eax, dword [ebp - 0x2c]
sub eax, 0x1f26100a
je 0x1010d039
jmp 0x1010cc1a
mov eax, dword [ebp - 0x2c]
sub eax, 0x23942de0
je 0x1010d02b
jmp 0x1010cc2d
mov eax, dword [ebp - 0x2c]
sub eax, 0x35726db0
je 0x1010d0a9
jmp 0x1010cc40
mov eax, dword [ebp - 0x2c]
sub eax, 0x370ecf95
je 0x1010cf91
jmp 0x1010cc53
mov eax, dword [ebp - 0x2c]
sub eax, 0x3b13c382
je 0x1010d222
jmp 0x1010cc66
mov eax, dword [ebp - 0x2c]
sub eax, 0x3f51aa73
je 0x1010d135
jmp 0x1010cc79
mov eax, dword [ebp - 0x2c]
sub eax, 0x433046f8
je 0x1010d1ab
jmp 0x1010cc8c
mov eax, dword [ebp - 0x2c]
sub eax, 0x46f574a8
je 0x1010cf59
jmp 0x1010cc9f
mov eax, dword [ebp - 0x2c]
sub eax, 0x47492633
je 0x1010d206
jmp 0x1010ccb2
mov eax, dword [ebp - 0x2c]
sub eax, 0x511d7e51
je 0x1010d214
jmp 0x1010ccc5
mov eax, dword [ebp - 0x2c]
sub eax, 0x52140352
je 0x1010d2c2
jmp 0x1010ccd8
mov eax, dword [ebp - 0x2c]
sub eax, 0x579a953b
je 0x1010d19d
jmp 0x1010cceb
mov eax, dword [ebp - 0x2c]
sub eax, 0x645b3982
je 0x1010ceff
jmp 0x1010ccfe
mov eax, dword [ebp - 0x2c]
sub eax, 0x77260608
je 0x1010ce35
jmp 0x1010cd11
mov eax, dword [ebp - 0x2c]
sub eax, 0x7b1c0f1c
je 0x1010d2f3
jmp 0x1010cd24
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov ecx, 0x77260608
mov edx, 0x8cf66cb7
cmp esi, 0
cmove ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov cl, byte [0x101d10a4]
xor cl, 0xc7
mov byte [0x101d10ab], cl
mov cl, byte [0x101d10a5]
xor cl, 0x3d
mov byte [0x101d10ac], cl
mov cl, byte [0x101d10a6]
xor cl, 0xed
mov byte [0x101d10ae], cl
mov cl, byte [0x101d10a7]
xor cl, 0xd4
mov byte [0x101d10b0], cl
mov cl, byte [str.yXWB6d]
xor cl, 0x25
mov byte [0x101d10b1], cl
mov cl, byte [0x101d10a9]
xor cl, 0x58
mov byte [0x101d10b3], cl
mov cl, byte [0x101d10b4]
xor cl, 0x30
mov byte [0x101d10bd], cl
mov cl, byte [0x101d10b5]
xor cl, 0x3f
mov byte [0x101d10be], cl
mov cl, byte [0x101d10b6]
xor cl, 0x14
mov byte [0x101d10bf], cl
mov cl, byte [0x101d10b7]
xor cl, 0x98
mov byte [0x101d10c0], cl
mov cl, byte [0x101d10b8]
xor cl, 0x8c
mov byte [0x101d10c1], cl
mov cl, byte [0x101d10b9]
xor cl, 0x4d
mov byte [0x101d10c2], cl
mov cl, byte [0x101d10ba]
xor cl, 0xea
mov byte [0x101d10c4], cl
mov cl, byte [0x101d10bb]
xor cl, 0xcf
mov byte [0x101d10c5], cl
mov cl, byte [0x101d10bc]
xor cl, 0x93
mov byte [0x101d10c6], cl
mov dword [eax], 0x77260608
jmp 0x1010d327
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
mov dword [0x101d46d4], 1
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov ecx, esp
mov dword [ebp - 0x4c], ecx
push eax
mov edx, esp
mov dword [ebp - 0x48], edx
sub esp, 0x140
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov ebx, esp
mov dword [ebp - 0x30], ebx
sub esp, 0xc8
mov ebx, esp
mov dword [ebp - 0x34], ebx
sub esp, 0x1f4
mov ebx, esp
mov dword [ebp - 0x40], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x3c], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x38], ebx
mov dword [ecx], edi
mov dword [edx], esi
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
lea eax, str.Program_Files
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc8
call fcn.1017da50
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov esi, dword [ecx]
mov edi, 0xffffffff
mov ecx, 0x7b1c0f1c
mov edx, 0x9c6906ef
cmp esi, edi
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x645b3982
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
mov esi, dword [ecx]
and esi, 0x10
mov ecx, 0x3b13c382
mov edx, 0x9fc481b2
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov ecx, dword [ebp - 0x44]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x101c648c
call fcn.1019b990
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x511d7e51
mov edx, 0x46f574a8
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov ecx, dword [ebp - 0x44]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x101c648e
call fcn.1019b990
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x511d7e51
mov edx, 0x370ecf95
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
lea eax, [0x101c6491]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10105450
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x40]
add esp, 8
mov edx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1019b890
mov ecx, dword [ebp - 0x40]
add esp, 8
mov eax, dword [ebp - 0x44]
add eax, 0x2c
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1019b8a0
mov ecx, dword [ebp - 0x40]
add esp, 8
lea eax, [0x101c6493]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1019b8a0
add esp, 8
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call fcn.1010b030
add esp, 4
mov bl, al
mov eax, dword [ebp - 0x1c]
mov ecx, 0x1f26100a
mov edx, 0x23942de0
test bl, 1
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x75a7dd0
jmp 0x1010d327
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1010d330
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0xa446388a
mov edx, 0x9e612b49
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
add eax, 0x96
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1010d330
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x35726db0
mov edx, 0x9e612b49
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x75a7dd0
jmp 0x1010d327
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov edi, dword [0x101d10bd]
mov dword [esi], edi
mov edi, dword [0x101d10c1]
mov dword [esi + 4], edi
mov di, word [0x101d10c5]
mov word [esi + 8], di
mov bl, byte [0x101d10c7]
mov byte [esi + 0xa], bl
mov esi, dword [0x101d10aa]
mov dword [edx], esi
mov esi, dword [0x101d10ae]
mov dword [edx + 4], esi
mov si, word [0x101d10b2]
mov word [edx + 8], si
add eax, 0x64
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1010d330
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0xfe598de8
mov edx, 0x3f51aa73
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x40]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1010d330
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0xf09eff70
mov edx, 0x433046f8
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1010d330
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x579a953b
mov edx, 0x433046f8
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x75a7dd0
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xfe598de8
jmp 0x1010d327
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1010cac0
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x47492633
mov edx, 0x8ce76048
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x50]
mov dword [ecx], 1
mov dword [eax], 0xcc7c3a3b
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x511d7e51
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xce12f26d
jmp 0x1010d327
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
add ecx, 0x2c
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1019b990
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0xcecd28e5
mov edx, 0xa5b17425
cmp esi, 0
cmove ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x50]
mov dword [ecx], 1
mov dword [eax], 0xcc7c3a3b
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xce12f26d
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x75a7dd0
jmp 0x1010d327
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x52140352
mov edx, 0x645b3982
cmp esi, 0
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1010d327
sub esp, 4
mov dword [esp], 5
call fcn.10070520
mov eax, dword [ebp - 0x30]
add esp, 4
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x7b1c0f1c
jmp 0x1010d327
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x50]
mov dword [ecx], 0
mov dword [eax], 0xcc7c3a3b
jmp 0x1010d327
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017ab8f
mov eax, dword [ebp - 0x54]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x1010cafa