Function at 0x728874a4
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8cc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x8c8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [esp + 0x1c], eax
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [esp + 0x4b8], ax
lea eax, [esp + 0x4ba]
mov ebx, edx
push eax
mov edi, ecx
mov dword [esp + 0x2c], ebx
call fcn.72888170
xor eax, eax
push esi
push eax
mov word [esp + 0x29c], ax
lea eax, [esp + 0x29e]
push eax
call fcn.72888170
xor eax, eax
push esi
push eax
mov word [esp + 0x6e0], ax
lea eax, [esp + 0x6e2]
push eax
call fcn.72888170
add esp, 0x24
cmp word [edi], 0
mov dword [esp + 0x10], 0x80004005
je 0x72887a8f
mov eax, dword [esp + 0x14]
cmp word [eax], 0
je 0x72887a8f
test ebx, ebx
je 0x72887553
and dword [ebx], 0
mov esi, 0x104
push esi
lea eax, [esp + 0x4b4]
push edi
push eax
call fcn.72887e90
lea eax, [esp + 0x4bc]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x72887574
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x4ae], 0x5c
je 0x728875a8
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x4b4]
push 0x72881144
push eax
call fcn.72887ee1
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x4b0]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x728875c7
mov eax, 0x80004005
jmp 0x72887a94
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov dword [esp + 0x27c], eax
and eax, 0x3ff
shl ecx, 0x10
or ecx, eax
or ecx, 0x400
lea eax, [esp + 0x288]
mov dword [esp + 0x280], ecx
mov dword [esp + 0x284], 0x409
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7288760b
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x4b4]
push eax
lea eax, [esp + 0x290]
push eax
call fcn.72887ee1
push esi
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x6d4]
push eax
call fcn.72887e90
add esp, 0x18
xor edi, edi
xor eax, eax
test edi, edi
jle 0x72887672
mov ecx, dword [esp + edi*4 + 0x27c]
cmp dword [esp + eax*4 + 0x27c], ecx
je 0x7288766a
inc eax
cmp eax, edi
jl 0x7288765c
cmp eax, edi
jl 0x7288774b
lea eax, [esp + 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7288767c
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
push 0xa
lea eax, [esp + 0x4a4]
push eax
push dword [esp + edi*4 + 0x288]
call fcn.72887f85
add esp, 0xc
push eax
lea eax, [esp + 0x290]
push eax
call fcn.72887ee1
lea eax, [esp + 0x294]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x728876c4
sub eax, ecx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x28c]
push 0x72881148
push eax
call fcn.72887ee1
lea eax, [esp + 0x294]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x728876f7
sub eax, ecx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
push dword [esp + 0x18]
lea eax, [esp + 0x290]
push eax
call fcn.72887ee1
add esp, 0xc
lea eax, [esp + 0x288]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x72887801
push esi
lea eax, [esp + 0x6c4]
push eax
lea eax, [esp + 0x290]
push eax
call fcn.72887e90
add esp, 0xc
inc edi
cmp edi, 3
jb 0x7288764f
lea eax, [esp + 0x288]
mov dword [esp + 0x18], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x72887767
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x4b4]
push eax
lea eax, [esp + 0x290]
push eax
call fcn.72887ee1
lea eax, [esp + 0x294]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x7288779d
sub eax, ecx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x28c]
push 0x7288114c
push eax
call fcn.72887ee1
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
lea eax, [esp + 0x288]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x728877e5
sub eax, ecx
sar eax, 1
lea edi, [eax - 3]
cmp ebx, 0xffffffff
je 0x72887850
jmp 0x728879aa
and dword [esp + 0x10], 0
mov edi, dword [esp + 0x20]
test edi, edi
je 0x72887834
push 2
push 0
lea eax, [esp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [edi], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], 0
je 0x72887850
push esi
lea eax, [esp + 0x28c]
push eax
push dword [esp + 0x24]
call fcn.72887e90
add esp, 0xc
mov eax, dword [esp + 0x10]
jmp 0x72887a94
test byte [esp + 0x28], 0x10
je 0x728879aa
mov ecx, 0x72881154
lea eax, [esp + 0x54]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x72887893
test dx, dx
je 0x7288788f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x72887893
add eax, 4
add ecx, 4
test dx, dx
jne 0x7288786d
xor eax, eax
jmp 0x72887898
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x728879aa
mov ecx, 0x72881158
lea eax, [esp + 0x54]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x728878cf
test dx, dx
je 0x728878cb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x728878cf
add eax, 4
add ecx, 4
test dx, dx
jne 0x728878a9
xor eax, eax
jmp 0x728878d4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x728879aa
xor eax, eax
mov word [esp + edi*2 + 0x288], ax
lea eax, [esp + 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x728878f0
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x290]
push eax
call fcn.72887ee1
lea eax, [esp + 0x294]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x72887923
sub eax, ecx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x28c]
push 0x72881160
push eax
call fcn.72887ee1
lea eax, [esp + 0x294]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x72887956
sub eax, ecx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
push dword [esp + 0x18]
lea eax, [esp + 0x290]
push eax
call fcn.72887ee1
add esp, 0xc
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x728879aa
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x58]
call fcn.72887d57
pop ecx
test eax, eax
je 0x728879aa
cmp word [eax], 0
je 0x728879c0
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x72887859
jmp 0x728879c5
and dword [esp + 0x10], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x10], 0
jge 0x72887806
cmp dword [esp + 0x18], 0
je 0x72887850
and dword [esp + 0x18], 0
lea eax, [esp + 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x728879f1
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x4b4]
push eax
lea eax, [esp + 0x74610290]
je 0x72887a7f
je 0x72887a8d
popal
imul eax, dword [eax], 0x83000002
les ecx, [ecx*4 - 0x7499fdb8]
adc byte [ebx - 0x7a99fd40], al
sal byte [ebp - 0xb], cl
sub eax, ecx
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [esp + 0x28c]
push 0x7288114c
push eax
call fcn.72887ee1
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
lea eax, [esp + 0x288]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x72887a6f
sub eax, ecx
sar eax, 1
lea edi, [eax - 3]
js 0x72887a7e
cmp ebx, 0xffffffff
jne 0x728879aa
jmp 0x72887850
invalid
mov eax, 0x80070057
mov ecx, dword [esp + 0x8d4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.72887da8
mov esp, ebp
pop ebp
ret