Function at 0x1000c5a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069149
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push 0xffffffffffffffff
push 0
push eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.10002420
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1000c61c
push 2
push 0x1007d864
lea ecx, [ebp - 0x2c]
call fcn.100027a0
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
lea edi, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
lea esi, [ebp - 0x2c]
cmp ebx, 0x10
cmovae edi, edx
add edi, ecx
cmp ebx, 0x10
cmovae esi, edx
add esi, ecx
cmp ebx, 0x10
lea ecx, [ebp - 0x2c]
mov eax, esi
cmovae ecx, edx
sub eax, ecx
push eax
push 0x2e
push ecx
call fcn.1004a330
add esp, 0xc
test eax, eax
cmovne esi, eax
cmp esi, edi
jne 0x1000c6be
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c0]
push 0x1007d894
push eax
call fcn.1000d380
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp eax, esi
je 0x1000c6a7
cmp dword [ebp - 0x18], 0x10
jb 0x1000c68c
push dword [ebp - 0x2c]
call fcn.100498af
add esp, 4
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.100022b0
cmp dword [ebp - 0x1ac], 0x10
jb 0x1000c6be
push dword [ebp - 0x1c0]
call fcn.100498af
add esp, 4
mov ebx, dword [ebp - 0x1a4]
lea eax, [ebp - 0x14]
push 1
push 0xffffffffffffffff
push eax
mov ecx, ebx
mov byte [ebp - 0x14], 0x5c
call fcn.1000cc70
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebx + 0x10]
dec ecx
cmp eax, ecx
je 0x1000c704
push 1
push 0x1007ab08
lea ecx, [ebp - 0x44]
call fcn.10001990
push 1
push 0x1007d890
lea ecx, [ebp - 0x44]
call fcn.10001990
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1d8]
push ebx
push eax
call fcn.1000d280
add esp, 0xc
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.10003570
add esp, 0xc
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1c4], 0x10
jb 0x1000c757
push dword [ebp - 0x1d8]
call fcn.100498af
add esp, 4
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x1a0]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x1c4], 0xf
cmovae eax, dword [ebp - 0x5c]
push ecx
push eax
mov dword [ebp - 0x1c8], 0
mov byte [ebp - 0x1d8], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c852
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esp, [esp]
test byte [ebp - 0x1a0], 0x10
jne 0x1000c832
mov edx, ebx
lea ecx, [ebp - 0x1f0]
call fcn.1000c9f0
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x1c0]
push eax
call fcn.100033e0
add esp, 0xc
mov ecx, dword [ebp - 0x1a8]
push eax
mov byte [ebp - 4], 6
call fcn.10003360
cmp dword [ebp - 0x1ac], 0x10
jb 0x1000c7fc
push dword [ebp - 0x1c0]
call fcn.100498af
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1dc], 0x10
mov dword [ebp - 0x1ac], 0xf
mov dword [ebp - 0x1b0], 0
mov byte [ebp - 0x1c0], 0
jb 0x1000c832
push dword [ebp - 0x1f0]
call fcn.100498af
add esp, 4
lea eax, [ebp - 0x1a0]
push eax
push esi
call edi
test eax, eax
jne 0x1000c7a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
jmp 0x1000c854
xor esi, esi
cmp dword [ebp - 0x48], 0x10
jb 0x1000c865
push dword [ebp - 0x5c]
call fcn.100498af
add esp, 4
cmp dword [ebp - 0x30], 0x10
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
jb 0x1000c888
push dword [ebp - 0x44]
call fcn.100498af
add esp, 4
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jb 0x1000c8ab
push dword [ebp - 0x2c]
call fcn.100498af
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret