Function at 0x1001f53
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x594
mov eax, dword [0x10060b0]
mov edx, dword [0x10064cc]
test edx, edx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x594], ebx
jne 0x100215a
push 0x119
call esi
test eax, eax
pop ecx
mov dword [0x10064cc], eax
je 0x1001fc2
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x10c
push eax
call esi
test eax, eax
pop ecx
mov ecx, dword [0x10064cc]
mov dword [ecx + 0xc], eax
jne 0x1001fd4
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01004a3d
leave
ret 0x10
or dword [ecx + 8], 0xffffffff
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x590]
push eax
mov byte [ecx + 0x10], 0
mov dword [ecx + 4], ecx
mov dword [ecx], ecx
push dword [ebx]
call dword [sym.imp.msvcrt.dll__splitpath]
mov eax, dword [0x10064cc]
add eax, 0x10
lea ecx, [ebp - 0x590]
mov dword [ebp - 0x588], eax
mov edx, ecx
add esp, 0x14
sub dword [ebp - 0x588], edx
mov dl, byte [ecx]
mov esi, dword [ebp - 0x588]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x1002024
lea ecx, [ebp - 0x304]
mov esi, ecx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100203c
sub ecx, esi
mov edx, ecx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002048
mov ecx, edx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx]
lea eax, [ebp - 0x104]
mov cl, byte [eax]
inc eax
mov byte [esi], cl
inc esi
test cl, cl
jne 0x1002068
lea eax, [ebp - 0x204]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100207a
mov edi, dword [ebx]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002086
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
inc eax
and ecx, 3
cmp dword [ebp + 0x10], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x588], eax
jle 0x100212b
mov eax, dword [ebp - 0x588]
lea edi, [ebx + eax*4]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x590]
push eax
push dword [edi]
call dword [sym.imp.msvcrt.dll__splitpath]
mov esi, dword [edi]
add esp, 0x14
lea eax, [ebp - 0x104]
mov cl, byte [eax]
inc eax
mov byte [esi], cl
inc esi
test cl, cl
jne 0x10020e4
lea eax, [ebp - 0x204]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10020f6
mov edi, dword [edi]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002102
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc dword [ebp - 0x588]
mov eax, dword [ebp - 0x588]
cmp eax, dword [ebp + 0x10]
rep movsb byte es:[edi], byte [esi]
jl 0x10020ac
mov ecx, dword [ebp + 0x10]
test ecx, ecx
mov edx, dword [0x10064cc]
jle 0x1002456
xor eax, eax
mov esi, dword [edx + 0xc]
or dword [eax + esi], 0xffffffff
mov esi, dword [edx + 0xc]
mov byte [eax + esi + 6], 0
add eax, 0x10c
dec ecx
jne 0x100213e
jmp 0x1002456
mov eax, dword [edx + 8]
cmp eax, 0xffffffff
jne 0x1002190
push 0x10011d0
push dword [ebp - 0x58c]
call fcn.01001ebf
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x58c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [0x10064cc]
mov dword [ecx + 8], eax
jmp 0x10021a6
lea ecx, [ebp - 0x444]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10023e1
mov eax, dword [0x10064cc]
cmp dword [eax + 8], 0xffffffff
je 0x10023e1
test byte [ebp - 0x444], 0x10
je 0x10022a2
cmp dword [ebp + 0x14], 0
je 0x1002450
push 2
mov edi, 0x10011cc
lea esi, [ebp - 0x418]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1002450
push 3
mov edi, 0x10011c8
lea esi, [ebp - 0x418]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1002450
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push 0x119
call esi
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1002450
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x10c
push eax
call esi
test eax, eax
pop ecx
mov dword [ebx + 0xc], eax
jne 0x1002234
push ebx
call dword [sym.imp.msvcrt.dll_free]
jmp 0x100244f
lea eax, [ebp - 0x418]
lea edx, [ebx + 0x10]
mov esi, edx
mov ecx, eax
sub esi, ecx
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x1002243
dec edx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x100224e
mov eax, dword [0x10064cc]
mov edi, edx
mov edx, dword [ebp + 0x10]
mov esi, 0x10011c4
movsw word es:[edi], word [esi]
or dword [ebx + 8], 0xffffffff
test edx, edx
mov ecx, dword [eax]
mov dword [ebx], ecx
mov dword [ebx + 4], eax
jle 0x1002290
xor ecx, ecx
mov esi, dword [ebx + 0xc]
or dword [ecx + esi], 0xffffffff
mov esi, dword [ebx + 0xc]
mov byte [ecx + esi + 6], 0
add ecx, 0x10c
dec edx
jne 0x1002278
mov dword [eax], ebx
mov eax, dword [ebx]
mov dword [eax + 4], ebx
mov dword [0x10064cc], ebx
jmp 0x1002450
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x588], eax
jle 0x1002450
mov esi, ebx
imul esi, esi, 0x10c
add esi, eax
xor eax, eax
sub esi, 0x10c
dec ebx
cmp dword [esi], eax
setne al
mov edi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x100232d
mov eax, dword [ebp - 0x594]
push dword [eax + ebx*4]
push dword [ebp - 0x58c]
call fcn.01001ebf
lea eax, [ebp - 0x584]
push eax
push dword [ebp - 0x58c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov byte [esi + 4], 0
mov edi, ecx
test edi, edi
je 0x1002382
lea eax, [ebp - 0x558]
mov edx, eax
mov ecx, esi
sub ecx, edx
lea edx, [ecx + 6]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1002321
jmp 0x1002364
cmp byte [esi + 4], 0
je 0x100236f
lea ecx, [ebp - 0x584]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
test edi, edi
mov byte [esi + 4], 0
je 0x1002382
lea eax, [ebp - 0x558]
mov edx, eax
mov ecx, esi
sub ecx, edx
lea edx, [ecx + 6]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100235a
mov al, byte [ebp - 0x584]
and al, 0x10
mov byte [esi + 5], al
test edi, edi
je 0x1002382
cmp byte [esi + 5], 0
je 0x100239b
mov byte [esi + 4], 1
jmp 0x10022d0
mov eax, dword [esi]
test eax, eax
je 0x1002397
cmp eax, 0xffffffff
je 0x1002397
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi], 0
mov byte [esi + 4], 0
test edi, edi
je 0x10023d7
lea edi, [esi + 6]
lea eax, [ebp - 0x418]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x10023ca
test cl, cl
je 0x10023c6
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x10023ca
inc eax
inc eax
inc edi
inc edi
test cl, cl
jne 0x10023a8
xor eax, eax
jmp 0x10023cf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002463
test ebx, ebx
jg 0x10022c0
jmp 0x1002450
mov eax, dword [0x10064cc]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x10023f5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [0x10064cc]
mov eax, dword [esi + 4]
cmp eax, esi
mov dword [0x10064cc], eax
je 0x1002412
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esi]
mov dword [ecx + 4], eax
jmp 0x1002419
and dword [0x10064cc], 0
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov eax, dword [esi + 0xc]
jle 0x1002440
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x1002437
cmp eax, 0xffffffff
je 0x1002437
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
add edi, 0x10c
dec ebx
jne 0x1002425
push dword [esi + 0xc]
mov edi, dword [sym.imp.msvcrt.dll_free]
call edi
push esi
call edi
pop ecx
pop ecx
mov edx, dword [0x10064cc]
test edx, edx
jne 0x100215a
jmp 0x1001fc2
mov eax, dword [ebp - 0x588]
imul ebx, ebx, 0x10c
mov byte [ebx + eax + 4], 1
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x58c]
call fcn.01001ebf
xor eax, eax
inc eax
jmp 0x1001fc5