Function at 0x10065740
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b1a6
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x718], ebx
mov dword [ebp - 0x6b8], esi
mov dword [ebp - 0x6e8], eax
mov eax, dword [eax]
mov dword [ebp - 0x6f4], ebx
cmp dword [eax - 0xc], esi
jne 0x100657f5
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1006616d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 1
mov eax, 0x10172dc0
mov ecx, ebx
test eax, 0xffff0000
jne 0x100657d1
movzx eax, ax
push eax
call fcn.1000d1d0
jmp 0x100657dd
push 0
push 0x10172dc0
call fcn.1000adf0
mov dword [ebp - 4], 0
mov dword [ebp - 0x6b8], 1
mov eax, ebx
jmp 0x10066151
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x6f0], esi
push 0
push eax
call fcn.100ec480
push 0x20a
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.100ec480
add esp, 0x18
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x10066177
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 4], 3
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x10066181
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6c8], eax
mov byte [ebp - 4], 5
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1006618b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 7
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x10066195
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6c0], eax
mov byte [ebp - 4], 9
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1006619f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6b0], eax
mov byte [ebp - 4], 0xb
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x100661a9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6ac], eax
mov byte [ebp - 4], 0xd
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x100661b3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6bc], eax
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x6bc]
push edi
push str..__s._
push eax
call fcn.10012500
add esp, 0xc
lea ecx, [ebp - 0x82c]
call fcn.1005ec10
mov byte [ebp - 4], 0x10
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 0x6cc], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x82c]
call fcn.10064af0
mov byte [ebp - 4], 0x10
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
mov byte [ebp - 4], 0x13
xor eax, eax
mov edi, dword [ebp - 0x6bc]
xor ebx, ebx
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
mov dword [ebp - 0x6e0], edi
mov dword [ebp - 0x6dc], eax
test edi, edi
je 0x100659b0
cmp word [edi], ax
je 0x100659b0
nop word [eax + eax]
inc eax
mov dword [ebp - 0x6dc], eax
mov ebx, eax
cmp word [edi + eax*2], 0
jne 0x100659a0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x82c]
call fcn.10064af0
test edi, edi
je 0x100659ff
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
mov dword [ebp - 0x6d0], edi
mov dword [ebp - 0x6cc], ebx
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x6d4]
push 0
push eax
lea ecx, [ebp - 0x82c]
call fcn.10061980
mov byte [ebp - 4], 0x14
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x6c4]
push 0x10179f5c
push dword [ebp - 0x6e8]
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
push eax
call fcn.10019d90
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x6a8]
push 0x250
push 0
push eax
call fcn.100ec480
add esp, 0x18
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp - 0x6c4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x6ec], eax
cmp eax, 0xffffffff
je 0x10065fdf
push 0x104
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.1010b4c8
lea eax, [ebp - 0x428]
push 0x2e
push eax
call fcn.100ec5da
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x10065e30
push str..lnk
push ebx
call fcn.1010927f
add esp, 8
test eax, eax
jne 0x10065e30
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10065ad5
sub ecx, edx
lea eax, [ebp - 0x428]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.10011620
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x440]
push 0
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.10052460
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 0x18
cmp dword [edx + 0x14], 8
jb 0x10065b21
mov edx, dword [edx]
test edx, edx
jne 0x10065b29
xor ecx, ecx
jmp 0x10065b3f
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10065b30
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x6c0]
call fcn.1000adf0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x458]
call fcn.1000dfa0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x440]
call fcn.1000dfa0
mov ecx, dword [ebp - 0x6c0]
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
mov dword [ebp - 0x6e0], ecx
mov dword [ebp - 0x6dc], eax
test ecx, ecx
je 0x10065bae
cmp word [ecx], ax
je 0x10065bae
nop word [eax + eax]
inc eax
mov dword [ebp - 0x6dc], eax
cmp word [ecx + eax*2], 0
jne 0x10065ba0
mov byte [ebp - 4], 0x1a
push 0
push eax
push ecx
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x82c]
call fcn.100443b0
or esi, 2
mov dword [ebp - 0x6b8], esi
mov byte [ebp - 4], 0x19
cmp dword [eax + 8], 0
mov dword [ebp - method.CBufferRefT_unsigned_short_int_.virtual_0], vtable.CBufferRefT_unsigned_short_int_.0
jg 0x10065be9
xor edi, edi
jmp 0x10065bee
mov eax, dword [eax + 4]
mov edi, dword [eax]
and esi, 0xfffffffd
mov dword [ebp - 0x6b8], esi
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x6d8]
mov dword [ebp - 0x6fc], eax
mov dword [ebp - method.CBufferT_int_.virtual_0], vtable.CBufferT_int_.0
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x6d4]
test eax, eax
je 0x10065c28
push eax
call fcn.100f6855
add esp, 4
mov byte [ebp - 4], 0x16
mov dword [ebp - method.CBufferRefT_int_.virtual_0], vtable.CBufferRefT_int_.0
test edi, edi
je 0x10065e30
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x6e8]
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x10179f74
push eax
call fcn.10047c30
push str..lnk
push ebx
call fcn.1010927f
add esp, 0x18
test eax, eax
jne 0x10065e30
push eax
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10043040
add esp, 0x10
test eax, eax
je 0x10065e30
push 1
push dword [ebp - 0x6b4]
call fcn.100440d0
add esp, 8
test eax, eax
je 0x10065e30
push ecx
lea eax, [ebp - 0x6b4]
mov dword [ebp - 0x6fc], esp
mov ecx, esp
push eax
call fcn.10020cf0
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x700]
push eax
mov byte [ebp - 4], 0x16
call fcn.10053400
add esp, 8
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6b0]
push eax
call fcn.1000b6e0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x700]
call fcn.1000b560
push 0x10179aa4
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x708]
push eax
call fcn.10019d90
mov byte [ebp - 4], 0x1f
push dword [0x101c0318]
push eax
lea eax, [ebp - 0x704]
push eax
call fcn.10019d90
add esp, 0x18
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6ac]
push eax
call fcn.1000b6e0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x704]
call fcn.1000b560
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x708]
call fcn.1000b560
push dword [ebp - 0x6ac]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10065e1c
push ecx
lea eax, [ebp - 0x6b4]
mov dword [ebp - 0x6fc], esp
mov ecx, esp
push eax
call fcn.10020cf0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x70c]
push eax
mov byte [ebp - 4], 0x16
call fcn.10053400
add esp, 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6b0]
push eax
call fcn.1000b6e0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x70c]
call fcn.1000b560
push 0x10179aa4
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x714]
push eax
call fcn.10019d90
mov byte [ebp - 4], 0x23
push dword [0x101c0318]
push eax
lea eax, [ebp - 0x710]
push eax
call fcn.10019d90
add esp, 0x18
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x6ac]
push eax
call fcn.1000b6e0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x710]
call fcn.1000b560
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x714]
call fcn.1000b560
push 1
push dword [ebp - 0x6ac]
call fcn.100440d0
add esp, 8
test eax, eax
jne 0x10065e4d
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp - 0x6ec]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10065a60
jmp 0x10065e57
mov dword [ebp - 0x6f0], 1
push dword [ebp - 0x6ec]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x6f0], 0
je 0x10065fdf
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x100661bd
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp - 0x6f4]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x10065ead
movzx eax, ax
mov ecx, edi
push eax
call fcn.1000d1d0
jmp 0x10065ed4
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10065eb6
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000adf0
mov byte [ebp - 4], 0x16
or esi, 1
mov dword [ebp - 0x6b8], esi
mov byte [ebp - 4], 0x13
or esi, 0xffffffff
mov edx, dword [ebp - 0x6c4]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065f05
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x82c]
call fcn.1005fdf0
mov byte [ebp - 4], 0xd
mov eax, esi
mov edx, dword [ebp - 0x6bc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065f35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov eax, esi
mov edx, dword [ebp - 0x6ac]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065f56
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, esi
mov edx, dword [ebp - 0x6b0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065f77
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x6c0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065f98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x6f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065fb9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x6c8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10065fda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1006612d
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x100661c7
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp - 0x6f4]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x2f
mov eax, 0x10172dc0
mov ecx, edi
test eax, 0xffff0000
jne 0x1006601b
movzx eax, ax
push eax
call fcn.1000d1d0
jmp 0x10066027
push 0
push 0x10172dc0
call fcn.1000adf0
mov byte [ebp - 4], 0x16
or esi, 1
mov dword [ebp - 0x6b8], esi
mov byte [ebp - 4], 0x13
or esi, 0xffffffff
mov edx, dword [ebp - 0x6c4]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10066058
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x82c]
call fcn.1005fdf0
mov byte [ebp - 4], 0xd
mov eax, esi
mov edx, dword [ebp - 0x6bc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10066088
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov eax, esi
mov edx, dword [ebp - 0x6ac]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100660a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, esi
mov edx, dword [ebp - 0x6b0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100660ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x6c0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100660eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x6f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006610c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x6c8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006612d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x6b4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1006614f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
int3