Function at 0x10033b50
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x1a3c
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x1a38], eax
mov eax, dword [esp + 0x1a40]
push ebp
push esi
push edi
mov edi, edx
mov esi, dword [edi + 0x14]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp esi, dword [edi + 0x18]
jbe 0x10033b8d
call fcn.100d13c5
mov ebp, dword [edi + 8]
mov edi, esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 0x18]
cmp dword [eax + 0x14], esi
jbe 0x10033baf
call fcn.100d13c5
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 8]
test ebp, ebp
je 0x10033bba
cmp ebp, eax
je 0x10033bbf
call fcn.100d13c5
cmp edi, esi
je 0x10034052
mov esi, dword [esp + 0x18]
add esi, 0x268
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10033cfb
push 0x400
lea edx, [esp + 0x244]
push 0
push edx
call fcn.100d4cc0
add esp, 0xc
test ebp, ebp
jne 0x10033c17
call fcn.100d13c5
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x10033c0c
call fcn.100d13c5
cmp dword [edi + 0x18], 0x10
jb 0x10033c1c
mov eax, dword [edi + 4]
jmp 0x10033c1f
mov eax, dword [ebp]
jmp 0x10033c02
lea eax, [edi + 4]
mov edx, 0x400
lea ecx, [esp + 0x240]
jmp 0x10033c30
cmp byte [ecx], 0
je 0x10033c3d
inc ecx
sub edx, 1
jne 0x10033c30
jmp 0x10033c5b
test edx, edx
je 0x10033c5b
mov ecx, 0x400
sub ecx, edx
mov edx, 0x400
sub edx, ecx
lea ecx, [esp + ecx + 0x240]
call fcn.100040d0
mov ecx, 0x400
lea eax, [esp + 0x240]
cmp byte [eax], 0
je 0x10033c74
inc eax
sub ecx, 1
jne 0x10033c67
jmp 0x10033c97
test ecx, ecx
je 0x10033c97
mov eax, 0x400
sub eax, ecx
mov edx, 0x400
sub edx, eax
lea ecx, [esp + eax + 0x240]
mov eax, 0x1012d650
call fcn.100040d0
mov ecx, 0x400
lea eax, [esp + 0x240]
cmp byte [eax], 0
je 0x10033cb0
inc eax
sub ecx, 1
jne 0x10033ca3
jmp 0x10033cd0
test ecx, ecx
je 0x10033cd0
mov eax, 0x400
sub eax, ecx
mov edx, 0x400
sub edx, eax
lea ecx, [esp + eax + 0x240]
mov eax, esi
call fcn.100040d0
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10033cfb
lea ecx, [esp + 0x240]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x10033cfb
mov eax, dword [esp + 0xc]
inc dword [eax + 4]
push 0x400
lea edx, [esp + 0x244]
push 0
push edx
call fcn.100d4cc0
add esp, 0xc
test ebp, ebp
jne 0x10033d4d
call fcn.100d13c5
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x10033d27
call fcn.100d13c5
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x10033d32
mov eax, dword [eax]
mov edx, 0x400
lea ecx, [esp + 0x240]
mov edi, edi
cmp byte [ecx], 0
je 0x10033d52
inc ecx
sub edx, 1
jne 0x10033d40
jmp 0x10033d70
mov eax, dword [ebp]
jmp 0x10033d1d
test edx, edx
je 0x10033d70
mov ecx, 0x400
sub ecx, edx
mov edx, 0x400
sub edx, ecx
lea ecx, [esp + ecx + 0x240]
call fcn.100040d0
mov ecx, 0x400
lea eax, [esp + 0x240]
lea esp, [esp]
cmp byte [eax], 0
je 0x10033d8d
inc eax
sub ecx, 1
jne 0x10033d80
jmp 0x10033db0
test ecx, ecx
je 0x10033db0
mov eax, 0x400
sub eax, ecx
mov edx, 0x400
sub edx, eax
lea ecx, [esp + eax + 0x240]
mov eax, 0x1012d63c
call fcn.100040d0
mov edx, 0x400
lea eax, [esp + 0x240]
lea esp, [esp]
cmp byte [eax], 0
je 0x10033dcd
inc eax
sub edx, 1
jne 0x10033dc0
jmp 0x10033df4
test edx, edx
je 0x10033df4
mov eax, dword [esp + 0x18]
mov ecx, 0x400
sub ecx, edx
mov edx, 0x400
sub edx, ecx
add eax, 0x470
lea ecx, [esp + ecx + 0x240]
call fcn.100040d0
push 0x13c
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.100d4cc0
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1003401f
mov edi, edi
push 0x400
lea eax, [esp + 0x644]
push 0
push eax
call fcn.100d4cc0
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0x10033e76
call fcn.100d13c5
xor eax, eax
mov esi, dword [esp + 0x14]
cmp esi, dword [eax + 0x10]
jb 0x10033e64
call fcn.100d13c5
cmp dword [esi + 0x18], 0x10
jb 0x10033e7a
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 4]
add eax, 4
jmp 0x10033e81
mov eax, dword [eax]
jmp 0x10033e56
mov edi, dword [esp + 0x14]
add edi, 4
mov eax, 0x400
lea ecx, [esp + 0x640]
lea ecx, [ecx]
cmp byte [ecx], 0
je 0x10033e9d
inc ecx
sub eax, 1
jne 0x10033e90
jmp 0x10033edf
test eax, eax
je 0x10033edf
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [esp + edx + 0x640]
je 0x10033edb
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x10033ed7
mov dl, byte [edi + eax]
test dl, dl
je 0x10033ed7
mov byte [eax], dl
dec ecx
inc eax
dec esi
test ecx, ecx
jne 0x10033ec1
jmp 0x10033edb
test ecx, ecx
jne 0x10033edc
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [esp + 0x640]
jmp 0x10033ef0
cmp byte [ecx], 0
je 0x10033efd
inc ecx
sub eax, 1
jne 0x10033ef0
jmp 0x10033f44
test eax, eax
je 0x10033f44
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [esp + edx + 0x640]
je 0x10033f40
mov edi, 0x1012d650
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x10033f3c
mov dl, byte [edi + eax]
test dl, dl
je 0x10033f3c
mov byte [eax], dl
dec ecx
inc eax
dec esi
test ecx, ecx
jne 0x10033f26
jmp 0x10033f40
test ecx, ecx
jne 0x10033f41
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [esp + 0x640]
cmp byte [ecx], 0
je 0x10033f5d
inc ecx
sub eax, 1
jne 0x10033f50
jmp 0x10033fa3
test eax, eax
je 0x10033fa3
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [esp + edx + 0x640]
je 0x10033f9f
lea edi, [esp + 0x4c]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x10033f9b
mov dl, byte [edi + eax]
test dl, dl
je 0x10033f9b
mov byte [eax], dl
dec ecx
inc eax
dec esi
test ecx, ecx
jne 0x10033f85
jmp 0x10033f9f
test ecx, ecx
jne 0x10033fa0
dec eax
mov byte [eax], 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x64c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x1003400b
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1003400b
push edi
push esi
push 0xffffffffffffffff
lea eax, [esp + 0x64c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x20]
push 2
push 0
push 0
push esi
call edx
test al, al
je 0x10034004
mov eax, dword [esp + 0xc]
inc dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10033e30
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1003404e
call fcn.100d13c5
xor eax, eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [eax + 0x10]
jb 0x1003403c
call fcn.100d13c5
add dword [esp + 0x14], 0x1c
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
jmp 0x10033b9a
mov eax, dword [eax]
jmp 0x1003402e
push 0x800
lea edx, [esp + 0xa44]
push 0
push edx
call fcn.100d4cc0
add esp, 0xc
push 0
push 0x1a
lea eax, [esp + 0xa48]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x400
lea eax, [esp + 0xa40]
lea esp, [esp]
cmp word [eax], 0
je 0x100340a0
add eax, 2
sub ecx, 1
jne 0x10034090
jmp 0x100340c3
test ecx, ecx
je 0x100340c3
mov eax, 0x400
sub eax, ecx
mov ecx, 0x400
sub ecx, eax
lea edx, [esp + eax*2 + 0xa40]
mov eax, 0x1012d6d0
call fcn.100044a0
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push ecx
lea edx, [esp + 0x1244]
push 0x1012d6f0
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0xc
lea eax, [esp + 0xa40]
push eax
lea ecx, [esp + 0x1244]
push ecx
push str.EncryptedNumber
push 0x1012caa0
call edi
mov edx, dword [ebp + 4]
push edx
lea eax, [esp + 0x1244]
push 0x1012d6f0
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0xa40]
push ecx
lea edx, [esp + 0x1244]
push edx
push str.HelpFileNumber
push 0x1012caa0
call edi
push 0x200
lea eax, [esp + 0x24]
push 0
push eax
call fcn.100d4cc0
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea esi, [esp + 0xa40]
call fcn.10026e70
mov ecx, dword [esp + 0x1a44]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100d0738
add esp, 0x1a3c
ret 4