Function at 0x659bf0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x268
push ebx
push ebp
xor ebp, ebp
cmp ecx, ebp
push esi
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
je 0x659ec8
cmp edx, 0x105
jl 0x659ec8
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, 0x43
lea edi, [esp + 0x168]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00655400
cmp eax, 1
jne 0x659c6e
call fcn.006553b0
cmp eax, 1
lea ecx, [esp + 0x18]
jne 0x659c62
mov edx, 0xff
jmp 0x659c77
mov esi, 0x64
mov edx, 0x1ff
jmp 0x659c7c
mov edx, 0x7f
lea ecx, [esp + 0x18]
mov esi, 0x1e
call fcn.00655800
mov eax, dword [esp + 0x18]
lea ebx, [eax + esi]
cmp ebx, ebp
mov dword [esp + 0x1c], ebx
jl 0x659ebb
cmp ebx, 0x1388
jg 0x659ebb
push 0x10e
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x659e86
lea eax, [esp + 0x168]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x659cc5
sub eax, edx
cmp eax, 1
jl 0x659e86
cmp eax, 0x104
jg 0x659e86
mov byte [esp + eax + 0x168], 0x5c
mov byte [esp + eax + 0x169], 0x2a
inc eax
inc eax
mov byte [esp + eax + 0x168], 0x2e
inc eax
mov byte [esp + eax + 0x168], 0x64
inc eax
mov cl, 0x6c
mov byte [esp + eax + 0x168], cl
inc eax
cmp ebx, ebp
mov byte [esp + eax + 0x168], cl
mov byte [esp + eax + 0x169], 0
jle 0x659df7
jmp 0x659d30
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x659e86
mov al, byte [esp + 0x54]
test al, al
je 0x659e7f
mov ebx, ebp
lea esp, [esp]
mov al, byte [esp + 0x54]
test al, al
je 0x659dcf
cmp dword [esp + 0x14], 0x1388
jg 0x659dcf
mov eax, dword [esp + 0x28]
test al, 0x10
jne 0x659db2
test ah, 1
jne 0x659db2
mov edx, dword [esp + 0x14]
inc edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x14], edx
call fcn.00659810
test eax, eax
je 0x659db2
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jge 0x659e93
xor eax, eax
lea edi, [esp + 0x54]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x659d70
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, ebp
sub edx, ebx
cmp edx, 0x32
jl 0x659df3
cmp dword [esp + 0x14], 0x1388
jg 0x659df3
cmp ebp, dword [esp + 0x1c]
jl 0x659d30
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
test ebx, ebx
jle 0x659e86
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x659e86
mov al, byte [esp + 0x54]
test al, al
je 0x659e7f
mov al, byte [esp + 0x54]
test al, al
je 0x659e67
mov eax, dword [esp + 0x28]
test al, 0x10
jne 0x659e4a
test ah, 1
jne 0x659e4a
inc ebp
cmp ebp, ebx
jge 0x659e93
lea edx, [esp + 0x28]
push edx
xor eax, eax
lea edi, [esp + 0x58]
mov ecx, 0x41
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x659e30
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp ebp, ebx
jl 0x659e01
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.006975d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret