Function at 0x41258f
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file system object information

Disassembly:
push 0x56c
mov eax, 0x41ab8b
call fcn.004180c5
mov ebx, ecx
xor esi, esi
lea eax, [ebp + 8]
xor edi, edi
inc esi
push eax
lea ecx, [ebp - 0x52c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x544], esi
call dword [0x42433c]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::MakeLower]
call dword [sym.imp.pcoshelper.dll_Ordinal_1258]
cmp eax, 5
jbe 0x41260c
push edi
push str.:users_all_users_
lea ecx, [ebp - 0x52c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find]
cmp eax, 0xffffffff
je 0x41260c
lea ecx, [ebp - 0x52c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
jmp 0x412e92
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
mov ecx, 0x104
cmp eax, edi
jne 0x41263d
push ecx
push ecx
mov ecx, ebx
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer_1]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
mov ecx, ebx
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
mov ecx, ebx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::MakeLower]
cmp byte [ebp + 0x14], 0
jne 0x41269f
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x42433c]
mov esi, ebx
call fcn.00414be4
lea ecx, [ebp - 0x52c]
test al, al
je 0x41267e
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
inc eax
jmp 0x412e92
mov eax, dword [ebx]
push edi
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find]
cmp eax, 0xffffffff
je 0x41269f
mov eax, dword [sym.imp.pcoshelper.dll_Ordinal_1337]
cmp dword [eax], 1
je 0x41269f
lea ecx, [ebp - 0x52c]
jmp 0x412667
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x540]
call dword [0x42433c]
push 0x428d5c
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 2
call dword [0x424498]
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x540]
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.pcoshelper.dll_Ordinal_1048]
pop ecx
pop ecx
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0x250
lea eax, [ebp - 0x264]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x548], eax
cmp eax, 0xffffffff
jne 0x412732
lea ecx, [ebp - 0x540]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
jmp 0x412697
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 0x90], edi
je 0x4127ea
push dword [ebp + 8]
lea ecx, [ebp - 0x520]
call dword [0x424498]
push 0x42ab74
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
test eax, eax
je 0x4127de
push 0x42ab78
lea ecx, [ebp - 0x520]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
test eax, eax
je 0x4127de
mov edi, dword [0x433e08]
sub edi, dword [0x433e10]
mov eax, dword [0x433e0c]
sbb eax, dword [0x433e14]
mov ecx, edi
or ecx, eax
mov dword [ebp - 0x538], eax
push 0
je 0x4127c8
push 0x64
push dword [0x433e04]
push dword [0x433e00]
call fcn.00418180
push dword [ebp - 0x538]
push edi
push edx
push eax
call fcn.004182a0
push eax
push dword [ebp - 0x520]
push dword [0x434a80]
push dword [ebx + 0x90]
call esi
xor edi, edi
lea ecx, [ebp - 0x520]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x54c]
call dword [0x424328]
lea ecx, [ebp - 0x528]
call dword [0x424328]
push 0x2b0
lea eax, [ebp - 0x518]
push edi
mov byte [ebp - 4], 6
push eax
mov dword [ebp - 0x51c], edi
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [ebp + 0x10], edi
jne 0x41284c
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 3
jle 0x41284c
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x42433c]
mov ecx, ebx
call fcn.00414ca7
mov dword [ebp + 0x10], eax
cmp dword [ebx + 0xec], edi
je 0x412a4f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp eax, 3
jle 0x412a4f
cmp eax, 0x104
jge 0x412a4f
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x42433c]
mov esi, ebx
call fcn.00415ecf
test al, al
jne 0x412a4f
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x42433c]
call fcn.004161aa
test eax, eax
je 0x412a4f
push dword [ebp + 8]
call dword [sym.imp.pcoshelper.dll_Ordinal_347]
pop ecx
test al, al
je 0x412a4f
push 0x38
call sub.mfc90u.dll_new
pop ecx
test eax, eax
je 0x4128dd
mov esi, eax
call fcn.00416968
mov esi, eax
jmp 0x4128df
xor esi, esi
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
mov dword [ebp - 0x520], esi
call dword [0x42433c]
mov ecx, esi
call fcn.0041699c
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
jne 0x412921
push 0x80070057
call fcn.00403aa5
lea eax, [ebp - 0x53c]
push eax
lea edi, [ebp - 0x534]
call fcn.004168ae
mov eax, dword [ebp - 0x534]
mov dword [esi], eax
mov eax, dword [ebp - 0x530]
mov dword [esi + 4], eax
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x412917
lea eax, [ebp - 0x53c]
push eax
lea edi, [ebp - 0x534]
call fcn.004168ae
mov eax, dword [ebp - 0x534]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x530]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x412917
lea eax, [ebp - 0x53c]
push eax
lea edi, [ebp - 0x534]
call fcn.004168ae
mov eax, dword [ebp - 0x534]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x530]
mov dword [esi + 0x14], eax
cmp dword [ebp - 0x248], 0
je 0x4129dc
push dword [ebp - 0x248]
push dword [ebp - 0x244]
call fcn.004169e6
jmp 0x4129e9
mov eax, dword [ebp - 0x244]
and dword [esi + 0x24], 0
mov dword [esi + 0x20], eax
push 0x4001
push 0x2b4
lea eax, [ebp - 0x51c]
push eax
xor edi, edi
push edi
push dword [ebp - 0x528]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x412a16
mov eax, dword [ebp - 0x518]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x520]
push eax
mov dword [esi + 0x30], 3
lea eax, [ebx + 0x40]
mov byte [esi + 0x34], 0
call fcn.004163dd
mov eax, dword [ebx + 0x90]
cmp eax, edi
je 0x412a4f
push edi
push edi
push dword [0x434a8c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x42ab74
lea eax, [ebp - 0x238]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412a80
test dx, dx
je 0x412a7c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412a80
add eax, 4
add ecx, 4
test dx, dx
jne 0x412a5a
xor eax, eax
jmp 0x412a85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412e20
mov ecx, 0x42ab78
lea eax, [ebp - 0x238]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412abe
test dx, dx
je 0x412aba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412abe
add eax, 4
add ecx, 4
test dx, dx
jne 0x412a98
xor eax, eax
jmp 0x412ac3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412e20
push 0
push dword [ebx + 0x88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x412e3d
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x248]
xor ecx, ecx
xor esi, esi
or eax, esi
or ecx, edx
add dword [0x433e00], ecx
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x534], ecx
adc dword [0x433e04], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 4], 6
push dword [ebp + 8]
lea eax, [ebp - 0x528]
push str._s_s
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
lea eax, [ebp - 0x528]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x42433c]
mov esi, ebx
call fcn.00415ecf
test al, al
jne 0x412e20
test byte [ebp - 0x264], 0x10
je 0x412ba0
push dword [ebp + 0x14]
lea esi, [ebp - 0x528]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov eax, esp
mov dword [ebp - 0x524], esp
push 0x42a2f8
push eax
call fcn.004038b1
pop ecx
pop ecx
mov ecx, ebx
call fcn.0041258f
mov dword [ebp - 0x544], eax
cmp eax, 2
je 0x412e47
jmp 0x412e20
cmp dword [ebx + 0xf4], 0
je 0x412bb6
test byte [ebp - 0x264], 5
jne 0x412e20
push ecx
mov dword [ebp - 0x524], esp
mov esi, esp
push ecx
lea eax, [ebp - 0x238]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x424498]
push esi
call fcn.00415a3c
call fcn.00415ab0
test eax, eax
jne 0x412e20
cmp dword [ebp + 0x10], eax
setne al
xor ecx, ecx
cmp byte [ebp + 0x14], cl
setne cl
mov dword [ebp - 0x520], ecx
test eax, eax
jne 0x412c51
push ecx
lea eax, [ebp - 0x238]
mov ecx, esp
mov dword [ebp - 0x524], esp
push eax
call dword [0x424498]
mov edi, ebx
call fcn.00414ae3
and dword [ebp - 0x520], 0
test eax, eax
jne 0x412c51
cmp dword [ebx + 0xe8], eax
je 0x412c49
mov ecx, dword [ebp - 0x534]
or ecx, dword [ebp - 0x530]
jne 0x412c49
inc eax
mov dword [ebp - 0x520], 2
test eax, eax
je 0x412e20
cmp dword [ebx + 0xf8], 0
je 0x412c83
cmp dword [ebp - 0x520], 1
push dword [ebp - 0x24c]
sete al
push dword [ebp - 0x250]
movzx eax, al
push eax
mov esi, ebx
call fcn.00414d47
test eax, eax
jne 0x412e20
push dword [ebp - 0x528]
call dword [sym.imp.pcoshelper.dll_Ordinal_679]
pop ecx
test eax, eax
jne 0x412e20
push 0x38
call sub.mfc90u.dll_new
pop ecx
test eax, eax
je 0x412caf
mov esi, eax
call fcn.00416968
mov esi, eax
jmp 0x412cb1
xor esi, esi
push ecx
lea eax, [ebp - 0x528]
mov ecx, esp
mov dword [ebp - 0x560], esp
push eax
mov dword [ebp - 0x524], esi
call dword [0x42433c]
mov ecx, esi
call fcn.0041699c
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x412917
lea eax, [ebp - 0x568]
push eax
lea edi, [ebp - 0x554]
call fcn.004168ae
mov eax, dword [ebp - 0x554]
mov dword [esi], eax
mov eax, dword [ebp - 0x550]
mov dword [esi + 4], eax
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x412917
lea eax, [ebp - 0x578]
push eax
lea edi, [ebp - 0x55c]
call fcn.004168ae
mov eax, dword [ebp - 0x55c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x558]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x412917
lea eax, [ebp - 0x570]
push eax
lea edi, [ebp - 0x53c]
call fcn.004168ae
mov eax, dword [ebp - 0x53c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x538]
mov dword [esi + 0x14], eax
cmp dword [ebp - 0x248], 0
je 0x412daf
push dword [ebp - 0x248]
push dword [ebp - 0x244]
call fcn.004169e6
jmp 0x412dbc
mov eax, dword [ebp - 0x244]
and dword [esi + 0x24], 0
mov dword [esi + 0x20], eax
push 0x4001
push 0x2b4
lea eax, [ebp - 0x51c]
push eax
xor edi, edi
push edi
push dword [ebp - 0x528]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x412de9
mov eax, dword [ebp - 0x518]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0x520]
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebx + 0x40]
call fcn.004163dd
mov eax, dword [ebx + 0x90]
cmp eax, edi
je 0x412e20
push edi
push edi
push dword [0x434a8c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x548]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412a4f
jmp 0x412e47
mov dword [ebp - 0x544], 2
push dword [ebp - 0x548]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x528]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x54c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x540]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x52c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [ebp - 0x544]
call fcn.0041810f
ret 0x10