Function at 0x1002ee52
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7b8
push ebx
push esi
push edi
xor ebx, ebx
push 0x13c
lea eax, [ebp - 0x250]
push ebx
push eax
mov dword [ebp - 0x254], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x24c
lea eax, [ebp - 0x4a0]
push ebx
push eax
mov dword [ebp - 0x4a4], ebx
call sub.ntdll.dll_memset
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x324]
or dword [ebp - 8], 0xffffffff
add esp, 0xc
cmp eax, ebx
je 0x1002eebe
push esi
call eax
pop ecx
cmp eax, 1
je 0x1002eebe
call fcn.1003397f
xor eax, eax
jmp 0x1002f160
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x114]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1002eec9
push 3
pop ecx
mov edi, str.My_Documents
lea esi, [ebp - 0x114]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1002eeee
mov dword [ebp - 8], 5
push 7
pop ecx
mov edi, str.Desktop
lea esi, [ebp - 0x114]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002ef05
mov dword [ebp - 8], ebx
push 0x11
pop ecx
mov edi, str.Network_Favorites
lea esi, [ebp - 0x114]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1002ef20
mov dword [ebp - 8], 0x13
cmp dword [ebp - 8], 0xffffffff
je 0x1002ef91
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x5ac]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x114]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_strchr]
pop ecx
pop ecx
cmp eax, ebx
je 0x1002ef7c
cmp byte [eax + 1], bl
je 0x1002ef7c
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002ef54
lea edi, [ebp - 0x5ac]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x1002ef64
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x5ac]
mov byte [ebp + eax - 0x114], cl
inc eax
cmp cl, bl
jne 0x1002ef7e
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002ef9a
sub eax, edx
lea edi, [ebp - 0x114]
dec edi
cmp byte [ebp + eax - 0x115], 0x5c
jne 0x1002efc5
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1002efb4
mov esi, 0x1004efc4
movsw word es:[edi], word [esi]
jmp 0x1002efd5
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1002efc5
mov esi, 0x10048ab8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002efde
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x7b4]
push ecx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
mov esi, 0x4e3
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x7b4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
mov cl, 2
cmp eax, 0xffffffff
jne 0x1002f02b
push ebx
push 1
jmp 0x1002f151
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push 1
push dword [ebp + 8]
xor eax, eax
call fcn.1002ed9f
add esp, 0xc
test eax, eax
je 0x1002eeb7
mov ecx, 0x1004efc8
lea eax, [ebp - 0x478]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002f079
cmp dx, bx
je 0x1002f075
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002f079
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1002f053
xor eax, eax
jmp 0x1002f07e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x1002f12c
push 0x2c
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x254]
push eax
call sub.ntdll.dll_memcpy
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
call edi
push ebx
push ebx
inc eax
push eax
lea ecx, [ebp - 0x228]
push ecx
push eax
lea eax, [ebp - 0x478]
push eax
push 0x200
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x270]
push eax
call edi
cmp eax, ebx
je 0x1002f0f7
push ebx
push ebx
push eax
lea ecx, [ebp - 0x124]
push ecx
push eax
lea eax, [ebp - 0x270]
push eax
push 0x200
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x228]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002f100
lea ecx, [ebp - 0x254]
push ecx
sub eax, edx
push 1
push dword [ebp + 8]
lea edi, [eax + 0x2e]
xor eax, eax
mov cl, 2
call fcn.1002ed9f
add esp, 0xc
test eax, eax
je 0x1002eeb7
lea eax, [ebp - 0x4a4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1002f048
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push ebx
mov cl, 2
push dword [ebp + 8]
xor edi, edi
xor eax, eax
call fcn.1002ed9f
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret