Function at 0x101daf8
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x4c0
mov eax, 0x1055a55
call fcn.01021f2c
mov edi, 0x1064ba8
xor ebx, ebx
push edi
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], ebx
call fcn.01015076
push edi
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c4], ebx
call fcn.01015076
push edi
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 2
call fcn.01015076
push edi
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 3
call fcn.01015076
push edi
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 4
call fcn.01015076
push edi
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 5
call fcn.01015076
push edi
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 6
call fcn.01015076
push edi
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 7
call fcn.01015076
push edi
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 8
call fcn.01015076
push edi
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 9
call fcn.01015076
push edi
lea ecx, [ebp - 0x488]
mov byte [ebp - 4], 0xa
call fcn.01015076
push edi
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0xb
call fcn.01015076
lea eax, [ebp - 0x24]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push eax
mov byte [ebp - 4], 0xc
call fcn.0101c334
call fcn.0101c48e
cmp eax, ebx
jne 0x101dcc5
push 0x1004d70
push 3
call fcn.01016717
mov ecx, dword [ebp - 0x4a4]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x488]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x494]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x4a0]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x498]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x48c]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x480]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x4ac]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp ecx, ebx
je 0x101dcbe
call fcn.0101a986
xor eax, eax
jmp 0x101e26b
lea eax, [ebp - 0x488]
push eax
push 0x14
lea eax, [ebp - 0x24]
push eax
call fcn.0103626e
test eax, eax
je 0x101dc06
call fcn.010524a0
cmp eax, ebx
je 0x101dd01
cmp eax, 0xb7
je 0x101dd01
push 0x1004d18
push eax
push 3
call fcn.010167cb
jmp 0x101dc06
push 0x105
lea ecx, [ebp - 0x484]
call fcn.010158a3
push 0x104
push eax
call fcn.0105235c
push 0xffffffffffffffff
lea ecx, [ebp - 0x484]
test eax, eax
je 0x101dd32
call fcn.01015023
jmp 0x101dc06
call fcn.01015023
push 0x1004a48
lea ecx, [ebp - 0x4a8]
call fcn.010161a7
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x484]
push eax
mov byte [ebp - 4], 0xd
call fcn.010360f6
mov ecx, dword [ebp - 0x4a8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xc
call fcn.010147cd
lea eax, [ebp - 0x484]
push eax
call fcn.010371a4
test al, al
jne 0x101dda1
push dword [ebp - 0x484]
push 0x1004cec
push 3
call fcn.010168f9
add esp, 0xc
jmp 0x101dc06
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.010360f6
lea eax, [ebp - 0x480]
push eax
call fcn.01035549
test al, al
je 0x101de83
push dword [ebp - 0x488]
push 0x1004ca0
push 1
call fcn.010168f9
add esp, 0xc
lea eax, [ebp - 0x480]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push eax
call fcn.0101c334
call fcn.0101cd24
cmp eax, ebx
je 0x101de17
push 0x1004c58
push 1
call fcn.01016717
jmp 0x101e00f
lea eax, [ebp - 0x22c]
push eax
push ebx
push dword [ebp - 0x488]
push dword [ebp - 0x484]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x101dc06
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x480]
call fcn.010158cd
push edi
lea ecx, [ebp - 0x4b8]
call fcn.01015076
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x480]
push eax
mov byte [ebp - 4], 0xe
call fcn.01036032
mov ecx, dword [ebp - 0x4b8]
add ecx, 0xfffffff0
jmp 0x101e006
push edi
lea ecx, [ebp - 0x4b8]
call fcn.01015076
push edi
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0xf
call fcn.01015076
push 0x1004c48
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x4b0]
push eax
mov byte [ebp - 4], 0x10
call fcn.01015847
push eax
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x11
call fcn.01015959
mov ecx, dword [ebp - 0x4b0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.010147cd
mov ebx, dword [ebp - 0x4b8]
lea eax, [ebp - 0x47c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x4b0], eax
cmp eax, 0xffffffff
je 0x101dff5
test byte [ebp - 0x47c], 0x10
jne 0x101df6d
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.010161a7
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x484]
push eax
mov byte [ebp - 4], 0x12
call fcn.010360f6
mov ecx, dword [ebp - 0x4bc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.010147cd
lea eax, [ebp - 0x4a8]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4c0], esp
push eax
call fcn.0101c334
call fcn.0101cd24
test eax, eax
jne 0x101df8a
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101df00
jmp 0x101dfe9
push dword [ebp - 0x4a8]
push 0x1004c10
push 1
call fcn.010168f9
add esp, 0xc
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x480]
call fcn.01015959
push edi
lea ecx, [ebp - 0x4bc]
call fcn.01015076
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x480]
push eax
mov byte [ebp - 4], 0x13
call fcn.01036032
mov ecx, dword [ebp - 0x4bc]
add ecx, 0xfffffff0
call fcn.010147cd
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x4a8]
add ecx, 0xfffffff0
call fcn.010147cd
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0xc
call fcn.010147cd
push dword [ebp - 0x480]
push dword [ebp - 0x488]
push 0x1004ba8
push 1
call fcn.010168f9
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x480]
add ecx, 0x28
push eax
call fcn.01015959
lea eax, [ebp - 0x4a4]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4c0], esp
push eax
call fcn.0101c334
lea ecx, [ebp - 0x480]
call fcn.0101d120
xor ebx, ebx
cmp eax, ebx
je 0x101e1ad
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.0101d589
test eax, eax
je 0x101e1ad
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x48c]
call fcn.01015959
push 0x1001d58
lea ecx, [ebp - 0x48c]
call fcn.01018c3e
cmp dword [0x1064900], ebx
je 0x101e0bf
push 0x1004b94
lea ecx, [ebp - 0x48c]
call fcn.01018c3e
push fcn.01004b9c
lea ecx, [ebp - 0x48c]
call fcn.01018c3e
mov eax, dword [ebp - 0x480]
push dword [eax - 0xc]
lea ecx, [ebp - 0x48c]
push eax
call fcn.010155f6
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x494]
push eax
push ecx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4c0], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x4a0]
call fcn.010150a5
call fcn.0101d327
test eax, eax
je 0x101e1ad
push ecx
lea eax, [ebp - 0x494]
mov dword [ebp - 0x4c0], esp
mov ecx, esp
push eax
call fcn.010150a5
push ecx
lea eax, [ebp - 0x490]
mov dword [ebp - 0x4b0], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x14
call fcn.010150a5
push ecx
lea eax, [ebp - 0x498]
mov dword [ebp - 0x4b8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x15
call fcn.010150a5
push ecx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x4c8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x16
call fcn.010150a5
push ecx
mov eax, edi
mov dword [ebp - 0x4cc], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x17
call fcn.010150a5
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 4], 0xc
call fcn.01036973
test eax, eax
je 0x101e1ad
mov dword [ebp - 0x4c4], 1
mov ecx, dword [ebp - 0x4a4]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x488]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x494]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x4a0]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x498]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x48c]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x480]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x4ac]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x101e265
call fcn.0101a986
mov eax, dword [ebp - 0x4c4]
call fcn.01021fbe
ret 4