Function at 0x1300d6f0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x13032c57
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x1303de70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x824], 0
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.1301b7a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x130361e4
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
je 0x1300da86
mov edx, dword [ebp - 0x474]
and edx, 0x10
jne 0x1300da5d
lea ecx, [ebp - 0x560]
call fcn.13003680
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
push 1
push 3
lea ecx, [ebp - 0x524]
call fcn.13009830
mov byte [ebp - 4], 2
lea eax, [ebp - 0x524]
test eax, eax
je 0x1300d7e2
lea ecx, [ebp - 0x51c]
mov dword [ebp - 0x848], ecx
jmp 0x1300d7ec
mov dword [ebp - 0x848], 0
lea edx, [ebp - 0x448]
push edx
mov eax, dword [ebp - 0x848]
push eax
call fcn.130095b0
add esp, 8
lea ecx, [ebp - 0x57c]
push ecx
lea ecx, [ebp - 0x524]
call fcn.13004cd0
mov byte [ebp - 4], 3
mov word [ebp - 0x784], 0
push 0x206
push 0
lea edx, [ebp - 0x782]
push edx
call fcn.1301b7a0
add esp, 0xc
lea eax, [ebp - 0x784]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x130361f0
lea ecx, [ebp - 0x784]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x57c]
call fcn.13005c40
push eax
lea edx, [ebp - 0x784]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov byte [ebp - 0x494], 0
xor eax, eax
mov dword [ebp - 0x493], eax
mov dword [ebp - 0x48f], eax
mov dword [ebp - 0x48b], eax
mov dword [ebp - 0x487], eax
mov dword [ebp - 0x483], eax
mov dword [ebp - 0x47f], eax
mov dword [ebp - 0x47b], eax
mov word [ebp - 0x477], ax
mov byte [ebp - 0x475], al
mov dword [ebp - 0x49c], 0
lea ecx, [ebp - 0x49c]
push ecx
lea edx, [ebp - 0x784]
push edx
call fcn.1300c110
add esp, 8
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x49c], 0
je 0x1300d99b
mov eax, dword [ebp - 0x498]
push eax
mov ecx, dword [ebp - 0x49c]
push ecx
lea ecx, [ebp - 0x7f4]
call fcn.1300a270
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0x7f4]
call fcn.1300a320
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x810]
call fcn.13002830
cmp eax, 0x20
jne 0x1300d971
mov dword [ebp - 0x814], 0
jmp 0x1300d941
mov eax, dword [ebp - 0x814]
add eax, 1
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0x20
jae 0x1300d971
mov ecx, dword [ebp - 0x814]
push ecx
lea ecx, [ebp - 0x810]
call fcn.1300a5e0
movsx edx, byte [eax]
xor edx, 7
mov eax, dword [ebp - 0x814]
mov byte [ebp + eax - 0x544], dl
jmp 0x1300d932
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x81c], ecx
mov edx, dword [ebp - 0x81c]
push edx
call fcn.1301c137
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x810]
call fcn.130043e0
mov dword [ebp - 0x818], 0
jmp 0x1300d9b6
mov eax, dword [ebp - 0x818]
add eax, 1
mov dword [ebp - 0x818], eax
lea ecx, [ebp - 0x57c]
call fcn.13002830
cmp dword [ebp - 0x818], eax
jae 0x1300d9f8
mov ecx, dword [ebp - 0x818]
push ecx
lea ecx, [ebp - 0x57c]
call fcn.13002ea0
mov dword [ebp - 0x84c], eax
mov edx, dword [ebp - 0x84c]
movzx eax, word [edx]
xor eax, 5
mov ecx, dword [ebp - 0x84c]
mov word [ecx], ax
jmp 0x1300d9a7
lea edx, [ebp - 0x57c]
push edx
lea ecx, [ebp - 0x560]
call fcn.13004a30
lea eax, [ebp - 0x560]
push eax
mov ecx, 0x1303f9dc
call fcn.130131a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x57c]
call fcn.130036a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4d0]
call fcn.130041a0
lea ecx, [ebp - 0x4d0]
call fcn.13002d90
mov dword [ebp - 4], 5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x560]
call fcn.130036a0
lea ecx, [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1300d78f
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1301b81a
mov esp, ebp
pop ebp
ret