Function at 0x65abe0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x268
push ebx
push ebp
xor ebp, ebp
cmp ecx, ebp
push esi
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
je 0x65aeb8
cmp edx, 0x105
jl 0x65aeb8
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, 0x43
lea edi, [esp + 0x168]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.006563f0
cmp eax, 1
jne 0x65ac5e
call fcn.006563a0
cmp eax, 1
lea ecx, [esp + 0x18]
jne 0x65ac52
mov edx, 0xff
jmp 0x65ac67
mov esi, 0x64
mov edx, 0x1ff
jmp 0x65ac6c
mov edx, 0x7f
lea ecx, [esp + 0x18]
mov esi, 0x1e
call fcn.006567f0
mov eax, dword [esp + 0x18]
lea ebx, [eax + esi]
cmp ebx, ebp
mov dword [esp + 0x1c], ebx
jl 0x65aeab
cmp ebx, 0x1388
jg 0x65aeab
push 0x10e
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x65ae76
lea eax, [esp + 0x168]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x65acb5
sub eax, edx
cmp eax, 1
jl 0x65ae76
cmp eax, 0x104
jg 0x65ae76
mov byte [esp + eax + 0x168], 0x5c
mov byte [esp + eax + 0x169], 0x2a
inc eax
inc eax
mov byte [esp + eax + 0x168], 0x2e
inc eax
mov byte [esp + eax + 0x168], 0x64
inc eax
mov cl, 0x6c
mov byte [esp + eax + 0x168], cl
inc eax
cmp ebx, ebp
mov byte [esp + eax + 0x168], cl
mov byte [esp + eax + 0x169], 0
jle 0x65ade7
jmp 0x65ad20
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x65ae76
mov al, byte [esp + 0x54]
test al, al
je 0x65ae6f
mov ebx, ebp
lea esp, [esp]
mov al, byte [esp + 0x54]
test al, al
je 0x65adbf
cmp dword [esp + 0x14], 0x1388
jg 0x65adbf
mov eax, dword [esp + 0x28]
test al, 0x10
jne 0x65ada2
test ah, 1
jne 0x65ada2
mov edx, dword [esp + 0x14]
inc edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x14], edx
call fcn.0065a800
test eax, eax
je 0x65ada2
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jge 0x65ae83
xor eax, eax
lea edi, [esp + 0x54]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x65ad60
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, ebp
sub edx, ebx
cmp edx, 0x32
jl 0x65ade3
cmp dword [esp + 0x14], 0x1388
jg 0x65ade3
cmp ebp, dword [esp + 0x1c]
jl 0x65ad20
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
test ebx, ebx
jle 0x65ae76
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x65ae76
mov al, byte [esp + 0x54]
test al, al
je 0x65ae6f
mov al, byte [esp + 0x54]
test al, al
je 0x65ae57
mov eax, dword [esp + 0x28]
test al, 0x10
jne 0x65ae3a
test ah, 1
jne 0x65ae3a
inc ebp
cmp ebp, ebx
jge 0x65ae83
lea edx, [esp + 0x28]
push edx
xor eax, eax
lea edi, [esp + 0x58]
mov ecx, 0x41
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x65ae20
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp ebp, ebx
jl 0x65adf1
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.006985c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret