Function at 0x4f0cc0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6575a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x390
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x4c], esi
xor edi, edi
mov dword [ebp - 4], edi
wait
cmp dword [esi + 0x2e0], edi
jne 0x4f0d0b
xor eax, eax
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x7c], eax
mov cl, byte [esi + 0x30]
mov byte [ebp - 0x84], cl
lea ecx, [esi + 0x2fc]
call fcn.00526880
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov byte [ebp - 4], 1
lea ecx, [esi + 0x2a8]
call fcn.004b9330
push edi
lea edx, [esi + 0x2c4]
push edx
lea eax, [esi + 0x2b4]
push eax
lea ecx, [esi + 0x5c]
call fcn.005b0d20
push eax
mov ecx, dword [esi + 0x2e0]
call fcn.00414080
mov dword [ebp - 0x80], eax
mov ecx, 0x700724
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
push ecx
call fcn.005bd6c0
add esp, 4
push 0x104
push 0x104
lea ecx, [ebp - 0x24]
call fcn.00401640
push eax
push str.LogsDir
mov edx, dword [ebp - 0x34]
push edx
call fcn.005bd4f0
add esp, 0x10
lea ecx, [ebp - 0x24]
test eax, eax
jne 0x4f0e17
push 0x104
call fcn.00401640
push eax
push 1
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jge 0x4f0df5
push str.SHGetFolderPathW__0__0x001a__0__SHGFP_TYPE_DEFAULT__strSysDir.GetBuffer__260__
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040de50
push 0x6ba4dc
lea eax, [ebp - 0x12c]
push eax
call fcn.0060fb01
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.004048d0
push 0x6768ac
push str._sData_
lea ecx, [ebp - 0x24]
push ecx
call fcn.00414990
add esp, 0xc
jmp 0x4f0e2b
push 0xffffffffffffffff
call fcn.004048d0
push str.Data_
lea ecx, [ebp - 0x24]
call fcn.004017a0
mov ecx, 0x700724
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x2e0]
add eax, 0x14
mov ecx, dword [eax]
cmp dword [ecx - 0xc], edi
jle 0x4f0e84
push 0x66ea40
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00428bb0
add esp, 0xc
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x40]
call fcn.004078d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.004014a0
mov eax, dword [esi + 0x2e0]
add eax, 0x10
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.00428b00
mov byte [ebp - 4], 7
push 0x66ea40
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00428bb0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
push ecx
push eax
lea edx, [ebp - 0x1c]
push edx
call fcn.00428b00
mov byte [ebp - 4], 9
push 0x6768f8
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00428bb0
mov byte [ebp - 4], 0xa
push 0x66f150
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00428bb0
mov bl, 0xb
mov byte [ebp - 4], bl
push 0x676904
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00428bb0
add esp, 0x48
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x39c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.004014a0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call fcn.004014a0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
call fcn.004014a0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004014a0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14]
call fcn.004014a0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.004014a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x4f133a
lea ecx, [ebp - 0x9c]
call fcn.00432c80
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x2a8]
call fcn.004b9330
mov bl, 0x12
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x370]
push ecx
mov ecx, esi
call fcn.004f2360
test al, al
je 0x4f110e
lea edx, [esi + 0x2c4]
push edx
lea ecx, [ebp - 0x13c]
call fcn.00425550
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x14c]
call fcn.004255a0
mov ecx, eax
call fcn.00425710
test al, al
je 0x4f110e
lea ecx, [esi + 0x2b4]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.00425550
push eax
lea edx, [ebp - 0xa4]
push edx
lea ecx, [ebp - 0x134]
call fcn.004255a0
mov ecx, eax
call fcn.004256b0
test al, al
je 0x4f110e
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x144]
call fcn.004255a0
fld qword [eax]
fstp qword [ebp - 0xac]
mov ecx, dword [esi + 0x2e0]
add ecx, 0x10
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00428b00
mov byte [ebp - 4], 0xe
push 0x66ea40
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00428bb0
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x40]
push edx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00428b00
mov byte [ebp - 4], 0x10
push 0x6768f8
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00428bb0
mov byte [ebp - 4], 0x11
push 0x66ea40
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00428bb0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x370]
push ecx
push eax
lea edx, [ebp - 0x38]
push edx
call fcn.00428bb0
add esp, 0x48
mov edi, eax
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x9c]
call fcn.004315b0
push edi
mov ecx, eax
call fcn.004078d0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x38]
call fcn.004014a0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c]
call fcn.004014a0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x20]
call fcn.004014a0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1c]
call fcn.004014a0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x14]
call fcn.004014a0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x48]
call fcn.004014a0
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x39c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4f0f88
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x2ac]
call fcn.004644a0
push eax
lea ecx, [ebp - 0x28]
call fcn.00401450
mov byte [ebp - 4], 0x14
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WFEN
lea ecx, [ebp - 0xc8]
call fcn.0040aa60
mov bl, 0x15
mov byte [ebp - 4], bl
push 0
lea edx, [ebp - 0xc8]
push edx
push 1
call fcn.005bc840
mov ecx, eax
call fcn.005bc2c0
test al, al
je 0x4f119f
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x70], esp
push 0x676bbc
call fcn.0040bea0
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], bl
call fcn.005b49e0
add esp, 8
mov dword [ebp - 0x20], eax
jmp 0x4f11a6
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xc8]
call fcn.00405700
mov eax, dword [ebp - 0x98]
mov edi, dword [eax]
mov dword [ebp - 0x54], edi
cmp edi, dword [ebp - 0x98]
je 0x4f131c
mov ecx, dword [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [edi + 0x18]
push ecx
mov ecx, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.0040bea0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x14
call fcn.004efd00
push 0x66f16a
mov eax, dword [ebp - 0x4c]
add eax, 0x2ac
push eax
call fcn.0040b580
add esp, 0x18
test al, al
je 0x4f12cf
mov esi, dword [ebp - 0x6c]
mov ebx, esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x44], esi
jmp 0x4f1220
cmp esi, dword [ebp - 0x68]
je 0x4f12cf
lea ecx, [esi + 4]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00401450
mov byte [ebp - 4], 0x18
lea edx, [esi + 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401450
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c]
call fcn.004644a0
lea ecx, [ebp - 0x14]
call fcn.004644a0
push 0
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004144e0
cmp eax, 0xffffffff
jne 0x4f12c5
push 0
mov ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004144e0
cmp eax, 0xffffffff
jne 0x4f12c5
push esi
lea ecx, [ebp - 0x6c]
cmp esi, dword [ebp - 0x6c]
je 0x4f1299
lea edx, [ebp - 0x30]
push edx
call fcn.004f0be0
mov dword [ebp - 0x44], ebx
lea esi, [ebx + 0x34]
jmp 0x4f12a5
lea eax, [ebp - 0x48]
push eax
call fcn.004f0be0
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x14]
call fcn.004014a0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1c]
call fcn.004014a0
jmp 0x4f1220
mov ebx, esi
mov dword [ebp - 0x78], ebx
add esi, 0x34
jmp 0x4f12a5
cmp byte [edi + 0x21], 0
jne 0x4f11c0
mov eax, dword [edi + 8]
cmp byte [eax + 0x21], 0
jne 0x4f1300
mov edi, eax
mov dword [ebp - 0x88], edi
mov eax, dword [edi]
cmp byte [eax + 0x21], 0
jne 0x4f11bd
jmp 0x4f12e2
mov eax, dword [edi + 4]
cmp byte [eax + 0x21], 0
jne 0x4f1315
cmp edi, dword [eax + 8]
jne 0x4f1315
mov edi, eax
mov dword [ebp - 0x54], edi
jmp 0x4f1300
mov edi, eax
jmp 0x4f11bd
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.004014a0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.00432c20
mov esi, dword [ebp - 0x4c]
lea ecx, [esi + 4]
call fcn.004a1380
lea ecx, [ebp - 0x50]
push ecx
push str.ItemsPerPage
mov edx, dword [ebp - 0x34]
push edx
call fcn.005bd460
add esp, 0xc
test eax, eax
jne 0x4f1373
push 0x1f4
push str.ItemsPerPage
mov eax, dword [ebp - 0x34]
push eax
call fcn.005bd4b0
add esp, 0xc
jmp 0x4f137a
mov ecx, dword [ebp - 0x50]
test ecx, ecx
jne 0x4f1382
mov ecx, 0x1f4
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x68]
sub edx, dword [ebp - 0x6c]
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, ebx
xor edx, edx
div ecx
mov edi, edx
mov eax, ebx
sub eax, edi
xor edx, edx
div ecx
mov dword [ebp - 0x3c], eax
test edi, edi
je 0x4f13b3
inc dword [ebp - 0x3c]
lea eax, [ebx - 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
lea edi, [eax - 1]
imul edi, ecx
mov dword [ebp - 0x2c], edi
lea ecx, [esi + 0x2fc]
push eax
call fcn.00527030
lea ecx, [esi + 0x2fc]
cmp byte [esi + 0x344], 0
jne 0x4f1403
call fcn.00526870
mov edi, eax
mov eax, dword [ebp - 0x50]
imul edi, eax
mov dword [ebp - 0x2c], edi
lea ecx, [edi + eax - 1]
mov dword [ebp - 0x1c], ecx
mov byte [esi + 0x344], 1
jmp 0x4f140c
mov edx, dword [ebp - 0x3c]
push edx
call fcn.00527170
cmp dword [ebp - 0x1c], ebx
jl 0x4f1417
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x58], ebx
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x5c], eax
mov edi, edi
cmp eax, dword [ebp - 0x30]
je 0x4f1744
push eax
lea ecx, [ebp - 0x114]
call fcn.004efa80
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x58]
cmp eax, edi
jl 0x4f171f
cmp eax, dword [ebp - 0x1c]
jg 0x4f171f
inc eax
mov dword [ebp - 0x58], eax
mov ecx, 0x700724
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
mov esi, dword [ebp - 0x110]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
lea ecx, [esi - 4]
cmp dword [ecx], 0
jl 0x4f14aa
cmp eax, dword [esi - 0x10]
jne 0x4f14aa
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4f14e3
mov edx, dword [eax]
push 2
mov ecx, dword [esi - 0xc]
push ecx
mov ecx, eax
mov edx, dword [edx]
call edx
mov edi, eax
test edi, edi
jne 0x4f14c3
call fcn.00404070
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
push esi
lea edx, [eax + eax + 2]
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0060fbd3
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1e
push 7
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00414520
mov byte [ebp - 4], 0x1f
push 0x673664
mov ecx, eax
call fcn.00404020
test eax, eax
sete byte [ebp - 0x15]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x48]
call fcn.004014a0
lea ecx, [ebp - 0x14]
cmp byte [ebp - 0x15], 0
je 0x4f152e
push 7
jmp 0x4f1566
push 8
lea edx, [ebp - 0x38]
push edx
call fcn.00414520
mov byte [ebp - 4], 0x20
push str.https:__
mov ecx, eax
call fcn.00404020
test eax, eax
sete byte [ebp - 0x15]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x38]
call fcn.004014a0
cmp byte [ebp - 0x15], 0
je 0x4f156d
push 8
lea ecx, [ebp - 0x14]
push 0
call fcn.00448080
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
push eax
push 0
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.00404eb0
push eax
lea ecx, [ebp - 0x14]
call fcn.00448080
mov esi, dword [ebp - 0x4c]
add esi, 4
push 0
push 1
push 0x1002
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xe0], 0
push 0x30
push 0
lea edx, [ebp - 0xdc]
push edx
call fcn.006100a0
add esp, 0xc
mov dword [ebp - 0xe0], 3
mov dword [ebp - 0xdc], ebx
push 0xe4
mov eax, dword [0x716738]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
push edi
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 0xc4], eax
push edi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0xdc], connect
lea ecx, [ebp - 0x108]
call fcn.004014f0
mov dword [ebp - 0xcc], eax
lea edx, [ebp - 0xe0]
push edx
push 0
push 0x104d
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x104]
call fcn.004014f0
push eax
push 1
push ebx
mov ecx, esi
call fcn.00417050
lea ecx, [ebp - 0x14]
call fcn.004014f0
push eax
push 2
push ebx
mov ecx, esi
call fcn.00417050
mov edi, dword [ebp - 0x10c]
add edi, 0xfffffff0
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
lea edx, [edi + 0xc]
cmp dword [edx], 0
jl 0x4f1682
cmp eax, dword [edi]
jne 0x4f1682
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4f16c5
mov edx, dword [eax]
push 2
mov ecx, dword [edi + 4]
push ecx
mov ecx, eax
mov edx, dword [edx]
call edx
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4f169c
call fcn.00404070
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov eax, dword [edi + 4]
lea edx, [eax + eax + 2]
push edx
add edi, 0x10
push edi
lea eax, [eax + eax + 2]
push eax
add ecx, 0x10
push ecx
call fcn.0060fbd3
add esp, 0x10
mov edi, dword [ebp - 0x20]
add edi, 0x10
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x28]
push ecx
push 3
push ebx
mov ecx, esi
call fcn.00417050
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x28]
call fcn.004014a0
mov edx, dword [ebp - 0x110]
push edx
push 4
push ebx
mov ecx, esi
call fcn.00417050
inc ebx
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x14]
call fcn.004014a0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x70]
call fcn.004014a0
jmp 0x4f1723
inc eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x114]
call fcn.004edba0
add dword [ebp - 0x5c], 0x34
mov eax, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x4c]
jmp 0x4f1430
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x7c]
push ecx
lea ecx, [esi + 0x30]
call fcn.0055fd80
cmp dword [esi + 0x2f4], 0
je 0x4f176e
mov edx, dword [esi + 0x2f0]
push edx
mov ecx, esi
call fcn.004f7e30
lea ecx, [esi + 0x2fc]
call fcn.00526890
lea ecx, [esi + 0x2fc]
call fcn.00526920
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.004014a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004014a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.004f0ba0
mov eax, dword [ebp - 0x80]
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret