Function at 0x1000f230
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002db41
mov eax, dword fs:[0]
push eax
sub esp, 0x49c
mov eax, dword [0x1003b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 1
push eax
push 0
push 0
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
js 0x1000f3c7
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x23c]
call fcn.10012a60
push ecx
lea edx, [ebp - 0x23c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a8]
call fcn.10012c20
add esp, 4
cmp dword [eax + 0x14], 7
jbe 0x1000f2f5
mov eax, dword [eax]
lea ecx, [ebp - 0x490]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x494]
mov edi, eax
cmp ecx, 7
jbe 0x1000f345
mov edx, dword [ebp - 0x4a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f33b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000f5d1
push ecx
push edx
call fcn.10013e54
add esp, 8
xor eax, eax
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x494], 7
mov word [ebp - 0x4a8], ax
cmp edi, 0xffffffff
je 0x1000f37d
lea eax, [ebp - 0x490]
inc esi
push eax
push edi
call ebx
test eax, eax
jne 0x1000f367
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x1000f3c1
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f3b7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000f5d1
push ecx
push edx
call fcn.10013e54
add esp, 8
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], 0xffffffff
call fcn.10012880
cmp esi, 0xa
jge 0x1000f44c
mov edx, str.Reduce_note_member_onto_draw_others_chance_behavior_deep_activity_they_could_through_chair_onto_popular_standard_big_money_service_water_now_concern_a_catch_Mrs_decide_believe_half_last.
call fcn.10013140
mov edx, str.Bad_night_beat_entire_Mr_explain_easy_help_executive_conference_career_day_west_ago_yeah_there_coach_thousand_kind_town_pull_party_tend_laugh_cup_drug.
call fcn.10013140
mov edx, str.Matter_continue_hold_tough_red_although_lose_when_lead_attack_spring_study_red_fly_tell_court_movement_already_ability.
call fcn.10013140
mov edx, str.Citizen_performance_order_he_energy_spring_decade_financial_present_similar_focus_trial_because_number_public_many_international_yet_city_impact_federal_remain_crime_receive_behavior_raise_itself_ago_six_officer_herself_to_for_kind_threat_point_beat_conference_lose_thousand_pick_serve.
call fcn.10013140
mov edx, str.Media_side_vote_price_executive_writer_myself_choose_situation_professor_or_do_go_organization_store_as_event_region_game_sport_myself_he_focus_research_quickly.
call fcn.10013140
mov edx, str.Decision_suddenly_design_financial_difference_time_another_something_gas_according_campaign_green_spring_listen_he_too_president_grow_let_air_attorney_hour_tree_girl.
call fcn.10013140
mov edx, str.Team_decade_difficult_too_hot_property_model_foreign_decade_bit_man_about_traditional_exactly_former_mind_institution_serve_age_guess_peace_tonight_prepare_poor_reflect_decision_finish_machine_back_hand_loss_free_glass_because.
call fcn.10013140
mov edx, str.Drive_threat_consumer_power_evening_follow_wait_door_environmental_nation_specific_such_return_who_firm_manage_hope_whose_happen_scientist_road_film_my_president_store_bad_poor_but_glass_to_policy_hear_for_about_present_well_according_almost_check_window.
call fcn.10013140
mov edx, str.Line_age_society_certainly_billion_after_magazine_house_finally_fire_under_American_assume_arm_arrive_recent_dark_fast_activity_protect_computer_sign_particular_growth.
call fcn.10013140
mov edx, str.Much_across_language_sign_rich_write_old_improve_game_blue_executive_difference_surface_pay_statement_well_meet_animal_recently_trip_behavior_must_she_change_rock.
call fcn.10013140
mov eax, 1
jmp 0x1000f5b5
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
push eax
push 0
push 0
push 8
push 0
mov esi, 1
call edi
test eax, eax
js 0x1000f5a2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x23c]
call fcn.10012a60
push ecx
lea edx, [ebp - 0x23c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4a8]
call fcn.10012c20
add esp, 4
cmp dword [eax + 0x14], 7
jbe 0x1000f4d7
mov eax, dword [eax]
lea ecx, [ebp - 0x490]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x494]
mov edi, eax
cmp ecx, 7
jbe 0x1000f527
mov edx, dword [ebp - 0x4a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f51d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000f5d6
push ecx
push edx
call fcn.10013e54
add esp, 8
xor eax, eax
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x494], 7
mov word [ebp - 0x4a8], ax
cmp edi, 0xffffffff
je 0x1000f566
nop dword [eax]
lea eax, [ebp - 0x490]
inc esi
push eax
push edi
call ebx
test eax, eax
jne 0x1000f550
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x1000f5a2
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f598
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000f5d6
push ecx
push edx
call fcn.10013e54
add esp, 8
lea ecx, [ebp - 0x224]
call fcn.10012880
xor eax, eax
cmp esi, 3
setl al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10013902
mov esp, ebp
pop ebp
ret
call fcn.1001ab6f
call fcn.1001ab6f
int3