Function at 0x7d01f471
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push ebx
push esi
push edi
push 1
lea eax, [ebp - 0x458]
xor ebx, ebx
push 2
push eax
push ebx
mov dword [ebp - 4], ebx
xor esi, esi
call sym.SHELL32.dll_Ordinal_175
lea eax, [ebp - 0x458]
push 0x7cf34a1c
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push ebx
lea eax, [ebp - 0x250]
push 0x104
push eax
lea eax, [ebp - 0x458]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x7d01f5dd
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x7d01f70f
test byte [ebp - 0x14c], 0x10
je 0x7d01f566
lea eax, [ebp - 0x14c]
push eax
call fcn.7d01f431
test eax, eax
je 0x7d01f566
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
inc edi
cmp dword [ebp - 4], ebx
je 0x7d01f52f
lea eax, [esi + edi*2 + 2]
push 0x42
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
jmp 0x7d01f53c
lea eax, [esi + edi*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
je 0x7d01f57f
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x120]
add eax, esi
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x7cf472a8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add esi, edi
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x7d01f581
jmp 0x7d01f4ee
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
call sym.SHELL32.dll_IsUserAnAdmin
test eax, eax
je 0x7d01f6a0
push 1
lea eax, [ebp - 0x458]
push 0x17
push eax
push ebx
call sym.SHELL32.dll_Ordinal_175
lea eax, [ebp - 0x458]
push 0x7cf34a1c
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push ebx
lea eax, [ebp - 0x250]
push 0x104
push eax
lea eax, [ebp - 0x458]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x7d01f5e4
xor eax, eax
jmp 0x7d01f728
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x7d01f6a0
test byte [ebp - 0x14c], 0x10
je 0x7d01f67c
lea eax, [ebp - 0x14c]
push eax
call fcn.7d01f431
test eax, eax
je 0x7d01f67c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
inc edi
cmp dword [ebp - 4], ebx
je 0x7d01f645
lea eax, [esi + edi*2 + 2]
push 0x42
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
jmp 0x7d01f652
lea eax, [esi + edi*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
je 0x7d01f695
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x120]
add eax, esi
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x7cf472a8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add esi, edi
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x7d01f697
jmp 0x7d01f604
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x7d01f70f
cmp dword [ebp + 8], ebx
mov byte [esi + eax], bl
je 0x7d01f6c8
push ebx
push 1
push dword [ebp + 8]
inc esi
push ebx
push esi
push eax
push dword [0x7d04e97c]
call sub.USER32.dll_DdeCreateDataHandle
mov esi, eax
jmp 0x7d01f702
push 0x3ec
push 0x7cf47698
push dword [0x7d04e97c]
call sub.USER32.dll_DdeCreateStringHandleW
mov edi, eax
push ebx
push 1
push edi
inc esi
push ebx
push esi
push dword [ebp - 4]
push dword [0x7d04e97c]
call sub.USER32.dll_DdeCreateDataHandle
push edi
mov esi, eax
push dword [0x7d04e97c]
call sub.USER32.dll_DdeFreeStringHandle
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x7d01f728
push ebx
push 1
push dword [ebp + 8]
push ebx
push 1
push 0x7cf47564
push dword [0x7d04e97c]
call sub.USER32.dll_DdeCreateDataHandle
pop edi
pop esi
pop ebx
leave
ret 4