Function at 0x101dda7
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x4c0
mov eax, 0x1055604
call fcn.01022105
mov edi, 0x1064ac0
xor ebx, ebx
push edi
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], ebx
call fcn.01015177
push edi
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c4], ebx
call fcn.01015177
push edi
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 2
call fcn.01015177
push edi
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 3
call fcn.01015177
push edi
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 4
call fcn.01015177
push edi
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 5
call fcn.01015177
push edi
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 6
call fcn.01015177
push edi
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 7
call fcn.01015177
push edi
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 8
call fcn.01015177
push edi
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 9
call fcn.01015177
push edi
lea ecx, [ebp - 0x488]
mov byte [ebp - 4], 0xa
call fcn.01015177
push edi
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0xb
call fcn.01015177
lea eax, [ebp - 0x24]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push eax
mov byte [ebp - 4], 0xc
call fcn.0101acbb
call fcn.0101c707
cmp eax, ebx
jne 0x101df74
push 0x1005a90
push 3
call fcn.01016bdd
mov ecx, dword [ebp - 0x4a4]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x488]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x494]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x4a0]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x498]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x48c]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x480]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x4ac]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp ecx, ebx
je 0x101df6d
call fcn.0101ab3d
xor eax, eax
jmp 0x101e51a
lea eax, [ebp - 0x488]
push eax
push 0x14
lea eax, [ebp - 0x24]
push eax
call fcn.01035f94
test eax, eax
je 0x101deb5
call fcn.01051f53
cmp eax, ebx
je 0x101dfb0
cmp eax, 0xb7
je 0x101dfb0
push 0x1005a38
push eax
push 3
call fcn.01016c91
jmp 0x101deb5
push 0x105
lea ecx, [ebp - 0x484]
call fcn.01015aa6
push 0x104
push eax
call fcn.01051e0c
test eax, eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x484]
je 0x101dfe1
call fcn.01015124
jmp 0x101deb5
call fcn.01015124
push 0x1005768
lea ecx, [ebp - 0x4a8]
call fcn.01016a0f
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x484]
push eax
mov byte [ebp - 4], 0xd
call fcn.01035e1c
mov ecx, dword [ebp - 0x4a8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xc
call fcn.01014c32
lea eax, [ebp - 0x484]
push eax
call fcn.01036ec9
test al, al
jne 0x101e050
push dword [ebp - 0x484]
push 0x1005a0c
push 3
call fcn.01016dbf
add esp, 0xc
jmp 0x101deb5
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.01035e1c
lea eax, [ebp - 0x480]
push eax
call fcn.01035289
test al, al
je 0x101e132
push dword [ebp - 0x488]
push 0x10059c0
push 1
call fcn.01016dbf
add esp, 0xc
lea eax, [ebp - 0x480]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push eax
call fcn.0101acbb
call fcn.0101d3bd
cmp eax, ebx
je 0x101e0c6
push 0x1005978
push 1
call fcn.01016bdd
jmp 0x101e2be
lea eax, [ebp - 0x22c]
push eax
push ebx
push dword [ebp - 0x488]
push dword [ebp - 0x484]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x101deb5
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x480]
call fcn.01015d13
push edi
lea ecx, [ebp - 0x4b8]
call fcn.01015177
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x480]
push eax
mov byte [ebp - 4], 0xe
call fcn.01035d59
mov ecx, dword [ebp - 0x4b8]
add ecx, 0xfffffff0
jmp 0x101e2b5
push edi
lea ecx, [ebp - 0x4b8]
call fcn.01015177
push edi
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0xf
call fcn.01015177
push 0x1005968
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x4b0]
push eax
mov byte [ebp - 4], 0x10
call fcn.01015dca
push eax
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x11
call fcn.01015b0a
mov ecx, dword [ebp - 0x4b0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.01014c32
mov ebx, dword [ebp - 0x4b8]
lea eax, [ebp - 0x47c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x4b0], eax
je 0x101e2a4
test byte [ebp - 0x47c], 0x10
jne 0x101e21c
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.01016a0f
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x484]
push eax
mov byte [ebp - 4], 0x12
call fcn.01035e1c
mov ecx, dword [ebp - 0x4bc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.01014c32
lea eax, [ebp - 0x4a8]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4c0], esp
push eax
call fcn.0101acbb
call fcn.0101d3bd
test eax, eax
jne 0x101e239
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101e1af
jmp 0x101e298
push dword [ebp - 0x4a8]
push 0x1005930
push 1
call fcn.01016dbf
add esp, 0xc
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x480]
call fcn.01015b0a
push edi
lea ecx, [ebp - 0x4bc]
call fcn.01015177
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x480]
push eax
mov byte [ebp - 4], 0x13
call fcn.01035d59
mov ecx, dword [ebp - 0x4bc]
add ecx, 0xfffffff0
call fcn.01014c32
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x4a8]
add ecx, 0xfffffff0
call fcn.01014c32
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0xc
call fcn.01014c32
push dword [ebp - 0x480]
push dword [ebp - 0x488]
push 0x10058c8
push 1
call fcn.01016dbf
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x480]
add ecx, 0x28
push eax
call fcn.01015b0a
lea eax, [ebp - 0x4a4]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4c0], esp
push eax
call fcn.0101acbb
lea ecx, [ebp - 0x480]
call fcn.0101d1ef
xor ebx, ebx
cmp eax, ebx
je 0x101e45c
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.0101d806
test eax, eax
je 0x101e45c
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x48c]
call fcn.01015b0a
push 0x1001ca8
lea ecx, [ebp - 0x48c]
call fcn.01015ced
cmp dword [0x106481c], ebx
je 0x101e36e
push 0x10058b4
lea ecx, [ebp - 0x48c]
call fcn.01015ced
push 0x10058bc
lea ecx, [ebp - 0x48c]
call fcn.01015ced
mov eax, dword [ebp - 0x480]
push dword [eax - 0xc]
lea ecx, [ebp - 0x48c]
push eax
call fcn.0101580d
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x494]
push eax
push ecx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4c0], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x4a0]
call fcn.010155f4
call fcn.0101d0e4
test eax, eax
je 0x101e45c
push ecx
lea eax, [ebp - 0x494]
mov dword [ebp - 0x4c0], esp
mov ecx, esp
push eax
call fcn.010155f4
push ecx
lea eax, [ebp - 0x490]
mov dword [ebp - 0x4b0], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x14
call fcn.010155f4
push ecx
lea eax, [ebp - 0x498]
mov dword [ebp - 0x4b8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x15
call fcn.010155f4
push ecx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x4c8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x16
call fcn.010155f4
push ecx
mov eax, edi
mov dword [ebp - 0x4cc], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x17
call fcn.010155f4
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 4], 0xc
call fcn.01036699
test eax, eax
je 0x101e45c
mov dword [ebp - 0x4c4], 1
mov ecx, dword [ebp - 0x4a4]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x488]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x494]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x4a0]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x498]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x48c]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x480]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x4ac]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x101e514
call fcn.0101ab3d
mov eax, dword [ebp - 0x4c4]
call fcn.01022197
ret 4