Function at 0x1001501
Capabilities:
Enumerate files on windows
Get common file path
Set current directory
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x100702c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x284], ebx
mov byte [ebp - 0x28d], bl
mov byte [ebp - 0x27e], bl
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push ebx
push ebx
push 0x100
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
push esi
push dword [ebp + 8]
call fcn.01001b27
call dword [sym.imp.msvcrt.dll_clock]
push 0x10070b8
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, dword [0x10070c0]
or eax, 8
push 0x190
mov word [0x1007002], ax
lea eax, [ebp - 0x434]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.msvcrt.dll__wsetlocale]
mov edi, 0x10018fc
push edi
push 1
call esi
push edi
push 3
call esi
push edi
push 4
call esi
push edi
push 5
call esi
add esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
push 0x10018f4
lea eax, [ebp - 0x34]
push 8
push eax
call sub.msvcrt.dll_swprintf_s
lea eax, [ebp - 0x34]
push eax
push 2
call esi
push 0x100
push 1
push 0x1007410
mov byte [0x1007004], 1
mov byte [section..data], 1
mov dword [0x1007044], 0x10018ec
call sub.msvcrt.dll_memset
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 0x24
mov edi, 0x8000
add eax, 0x20
mov dword [0x1007040], ebx
mov ebx, dword [sym.imp.msvcrt.dll__fileno]
push edi
push eax
call ebx
pop ecx
mov esi, dword [sym.imp.msvcrt.dll__setmode]
push eax
call esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
pop ecx
pop ecx
add eax, 0x40
push edi
push eax
call ebx
pop ecx
push eax
call esi
and dword [ebp - 0x29c], 0
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
pop ecx
pop ecx
mov dword [ebp - 0x28c], eax
jle 0x10016ad
mov edi, 0x200
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x28c]
mov esi, dword [eax + ecx*4]
mov al, byte [esi]
cmp al, 0x2f
je 0x10037f8
cmp al, 0x2d
je 0x10037f8
cmp byte [ebp - 0x28d], 0
jne 0x10030ab
cmp byte [ebp - 0x27e], 0
jne 0x100330d
cmp dword [ebp - 0x288], 0
jne 0x100306a
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x28c], eax
je 0x10038a5
mov eax, dword [0x10073f8]
mov byte [eax - 1], 0xa
mov eax, dword [0x10073f4]
mov byte [eax - 1], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call ebx
push eax
call dword [sym.imp.msvcrt.dll__isatty]
pop ecx
pop ecx
test eax, eax
je 0x10016fa
mov dword [0x1007024], 0x1002732
mov dword [0x1007020], 0x100265c
cmp dword [ebp - 0x284], 0
jne 0x100332d
cmp dword [0x1007060], 0
jne 0x100174e
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x28c]
mov ecx, dword [eax + ecx*4]
inc dword [ebp - 0x28c]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100172a
sub eax, esi
push 0x10018e8
add eax, ecx
push eax
push ecx
call fcn.01001cb0
cmp dword [0x1007060], 0
je 0x10033b0
cmp dword [0x1007064], fcn.01002b6d
je 0x1002986
mov eax, dword [0x1007008]
push 0x100
inc eax
push eax
push 0x1007410
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x1007068], 0x1001a19
call fcn.010022de
cmp eax, dword [0x1007060]
jne 0x10033b7
cmp dword [0x1007060], 1
jne 0x10017ae
cmp dword [0x1007010], 0
je 0x10017ae
mov dword [0x1007068], 0x1001a8d
mov ebx, dword [ebp - 0x294]
test ebx, ebx
jne 0x10033f4
mov ebx, dword [ebp - 0x28c]
cmp ebx, dword [ebp + 8]
je 0x1002874
mov edi, dword [ebp + 8]
lea eax, [ebx + 1]
cmp edi, eax
jg 0x1003980
cmp dword [ebp - 0x29c], 0
jne 0x1003980
cmp ebx, edi
jge 0x1001800
mov eax, dword [ebp - 0x2a0]
push dword [eax + ebx*4]
call fcn.01002588
test eax, eax
jne 0x1003980
mov eax, dword [ebp - 0x2a4]
test eax, eax
jne 0x10034da
cmp dword [ebp - 0x29c], 0
jne 0x10036b8
cmp ebx, edi
jge 0x10018c1
mov eax, dword [ebp - 0x2a0]
lea esi, [eax + ebx*4]
mov eax, edi
sub eax, ebx
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x27c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1003727
mov ecx, dword [esi]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001857
sub eax, edi
push eax
push ecx
push 0x104
lea eax, [ebp - 0x250]
push eax
call fcn.010025b5
lea eax, [ebp - 0x250]
push eax
call fcn.0100252f
mov edi, eax
cmp edi, 0xffffffff
je 0x10018a0
push edi
lea eax, [ebp - 0x250]
push eax
push dword [0x100fe20]
call fcn.010011f1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001850
add esi, 4
dec dword [ebp - 0x294]
jne 0x1001836
call dword [0x1007020]
cmp byte [0x100fe24], 0
pop edi
pop esi
pop ebx
jne 0x1003747
mov ecx, dword [ebp - 4]
mov eax, dword [0x1007018]
xor ecx, ebp
call fcn.0100190b
leave
ret
and dword [0x1007040], 0xfffffffc
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
push 0
push dword [0x100fe20]
call fcn.010011f1
jmp 0x10017cb
cmp dword [0x1007068], 0
jne 0x10017ae
mov dword [0x1007068], 0x1002a72
jmp 0x10017ae
xor edi, edi
cmp dword [ebp - 0x288], edi
jle 0x10016ad
mov esi, dword [ebp + edi*4 - 0x434]
test esi, esi
je 0x10016ad
push 0x10030aa
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
push eax
push esi
call fcn.01001cb0
inc edi
cmp edi, dword [ebp - 0x288]
jl 0x1003078
jmp 0x10016ad
cmp byte [ebp - 0x27e], 0
je 0x10032fe
push 0x13
jmp 0x10032f9
or dword [0x1007040], 8
jmp 0x10037f8
or dword [0x1007040], 0x10
jmp 0x10037f8
mov dword [0x1007064], 0x100238a
mov byte [ebp - 0x28d], 1
jmp 0x10037f8
or dword [0x1007040], 2
jmp 0x10037f8
or dword [0x1007040], 4
jmp 0x10037f8
push 0x10037f0
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x100311e
push 0x10037f0
jmp 0x1003135
push 0x10037ec
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x1003146
push 0x10037ec
or dword [0x1007040], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x100389c
or dword [0x1007040], 0x80
jmp 0x10037f8
or dword [0x1007040], 0x100
jmp 0x10037f8
mov dword [0x1007064], fcn.01002b6d
mov byte [ebp - 0x27e], 1
jmp 0x10037f8
mov dword [ebp - 0x29c], 1
jmp 0x10037f8
mov dword [0x100fe20], 0x10053d8
jmp 0x10037f8
or dword [0x1007040], 0x18
jmp 0x10037f8
je 0x100320e
cmp ecx, 0x41
je 0x100320e
cmp ecx, 0x43
je 0x1003872
cmp ecx, 0x44
je 0x1003298
cmp ecx, 0x45
jle 0x10031cb
cmp ecx, 0x47
jle 0x1003270
lea esi, [esi + eax - 1]
mov al, byte [ebp - 0x27d]
mov byte [ebp - 0x297], al
lea eax, [ebp - 0x298]
push eax
push dword [0x1007044]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 6
push eax
mov byte [ebp - 0x298], 0x2f
mov byte [ebp - 0x296], 0
call fcn.0100508a
add esp, 0x10
jmp 0x10037f8
xor eax, eax
mov word [0x1007002], ax
jmp 0x1003253
movsx eax, al
push eax
call dword [sym.imp.msvcrt.dll_isxdigit]
pop ecx
test eax, eax
je 0x1003259
mov al, byte [esi]
cmp al, 0x39
movsx eax, al
jg 0x1003235
sub eax, 0x30
jmp 0x1003240
push eax
call dword [sym.imp.msvcrt.dll_tolower]
pop ecx
sub eax, 0x57
mov ecx, dword [0x1007002]
shl ecx, 4
add ecx, eax
mov word [0x1007002], cx
inc esi
mov al, byte [esi]
test al, al
jne 0x1003218
dec esi
jmp 0x10037f8
cmp ecx, 0x64
je 0x1003298
add ecx, 0xffffff9a
cmp ecx, 1
ja 0x10031cb
cmp byte [ebp - 0x27d], 0x66
je 0x100328d
cmp byte [ebp - 0x27d], 0x46
je 0x100328d
mov dword [ebp - 0x284], esi
jmp 0x100389c
mov dword [ebp - 0x294], esi
jmp 0x100389c
mov dword [ebp - 0x2a4], esi
jmp 0x100389c
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push 3
push eax
call fcn.0100508a
add esp, 0xc
push 0
call dword [sym.imp.msvcrt.dll_exit]
mov al, byte [ebp - 0x27d]
mov byte [ebp - 0x298], al
lea eax, [ebp - 0x298]
push eax
push dword [0x1007044]
mov byte [ebp - 0x297], 0
push 0xb
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.0100508a
add esp, 0x10
push 2
jmp 0x10032ba
push 0x15
call fcn.01005210
mov dword [0x1007064], 0x100238a
jmp 0x10016a0
mov dword [0x1007064], fcn.01002b6d
jmp 0x10016a0
cmp dword [ebp - 0x284], 0
jne 0x10016bc
push 1
jmp 0x10032f9
mov ebx, dword [ebp - 0x284]
push 2
mov edi, 0x10037e8
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100337a
push 2
mov edi, 0x10037e4
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100337a
push eax
push eax
push 3
push eax
push eax
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003384
push ebx
push dword [0x1007044]
push 7
jmp 0x10032e2
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push esi
push 0x1004788
push fcn.01001cb0
call fcn.010011f1
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, eax
je 0x1001741
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001741
push 0xc
jmp 0x10032f9
mov esi, dword [sym.imp.msvcrt.dll__itoa]
push 0xa
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
push 0xa
lea eax, [ebp - 0x14]
push eax
push dword [0x1007060]
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 8
push eax
call fcn.0100508a
add esp, 0x28
jmp 0x1001792
or dword [0x1007040], 1
push 2
mov edi, 0x10037e8
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1003441
push 2
mov edi, 0x10037e4
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1003441
push 0x10037e0
push ebx
call dword [sym.imp.msvcrt.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x284], eax
test eax, eax
jne 0x100344c
push ebx
push dword [0x1007044]
push 9
jmp 0x10032e2
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 0x284], eax
mov esi, dword [sym.imp.msvcrt.dll_fgets]
mov ebx, 0x105
jmp 0x10034a2
lea eax, [ebp - 0x13c]
push 0x1004788
push eax
call dword [sym.imp.msvcrt.dll_strcspn]
pop ecx
mov byte [ebp + eax - 0x13c], 0
pop ecx
lea eax, [ebp - 0x13c]
push eax
call fcn.0100252f
mov edi, eax
cmp edi, 0xffffffff
je 0x10034a2
push edi
lea eax, [ebp - 0x13c]
push eax
push dword [0x100fe20]
call fcn.010011f1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x284]
lea eax, [ebp - 0x13c]
push ebx
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x1003459
mov eax, dword [ebp - 0x284]
cmp eax, dword [sym.imp.msvcrt.dll__iob]
je 0x10034cf
push eax
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
mov ebx, dword [ebp - 0x28c]
jmp 0x10017cb
cmp byte [eax], 0
je 0x100180e
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor esi, esi
push esi
push esi
call edi
mov dword [ebp - 0x294], eax
test eax, eax
je 0x1003538
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [ebp - 0x284], esi
test esi, esi
jne 0x100352b
push dword [0x1007044]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 2
push eax
call fcn.0100508a
add esp, 0xc
jmp 0x10032f3
push esi
push dword [ebp - 0x294]
call edi
test eax, eax
jne 0x100354c
push esi
call dword [sym.imp.msvcrt.dll_free]
push dword [0x1007044]
push 0x11
jmp 0x10032e2
mov esi, dword [ebp - 0x2a4]
mov edi, 0x105
push 0x3b
push esi
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
mov dword [ebp - 0x294], eax
test eax, eax
je 0x100356f
mov byte [eax], 0
cmp byte [esi], 0
je 0x1003665
movzx eax, word [0x1007002]
push eax
push 2
push 0x10037dc
call dword [0x1007024]
movzx eax, word [0x1007002]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [0x1007024]
movzx eax, word [0x1007002]
push eax
push 3
push 0x10037d8
call dword [0x1007024]
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1003688
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x10035f4
mov eax, dword [sym.imp.msvcrt.dll__iob]
push esi
push dword [0x1007044]
add eax, 0x40
push 4
push eax
call fcn.0100508a
add esp, 0x10
jmp 0x1003665
mov eax, dword [ebp + 8]
push dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x2a0]
sub eax, ebx
mov dword [ebp - 0x2a4], eax
lea esi, [ecx + ebx*4]
push eax
jmp 0x1003653
lea eax, [ebp - 0x13c]
push eax
call fcn.0100252f
mov dword [ebp - 0x288], eax
cmp eax, 0xffffffff
je 0x1003647
push eax
lea eax, [ebp - 0x13c]
push eax
push dword [0x100fe20]
call fcn.010011f1
push dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x29c]
push dword [ebp - 0x2a4]
push esi
push edi
lea eax, [ebp - 0x13c]
push eax
call fcn.01004a2e
test eax, eax
jge 0x1003611
mov eax, dword [ebp - 0x294]
lea esi, [eax + 1]
test eax, eax
jne 0x1003557
push dword [ebp - 0x284]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x10018c1
push dword [ebp - 0x284]
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x284]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [0x1007044]
add eax, 0x40
push 4
push eax
call fcn.0100508a
add esp, 0x14
jmp 0x10032f3
cmp edi, ebx
jle 0x10018c1
mov eax, dword [ebp - 0x2a0]
sub edi, ebx
lea ebx, [eax + ebx*4]
mov esi, 0x105
jmp 0x1003708
lea eax, [ebp - 0x13c]
push eax
call fcn.0100252f
mov dword [ebp - 0x288], eax
cmp eax, 0xffffffff
je 0x1003708
push eax
lea eax, [ebp - 0x13c]
push eax
push dword [0x100fe20]
call fcn.010011f1
push dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x29c]
lea eax, [ebp - 0x13c]
push edi
push ebx
push esi
push eax
call fcn.01004a2e
test eax, eax
jl 0x10018c1
jmp 0x10036d2
push dword [esi]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [0x1007044]
add eax, 0x40
push 4
push eax
call fcn.0100508a
add esp, 0x10
jmp 0x10018b2
push dword [0x1007044]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0x16
push eax
call fcn.0100508a
add esp, 0xc
jmp 0x10018d7
inc esi
mov al, byte [esi]
mov byte [ebp - 0x27d], al
test al, al
jne 0x100381f
inc dword [ebp - 0x28c]
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp + 8]
jge 0x1001686
jmp 0x1001665
movsx eax, byte [ebp - 0x27d]
add eax, 0xffffffc1
cmp eax, 0x39
ja case.0x1003835.64
movzx eax, byte [eax + 0x100379d]
jmp dword [eax*4 + 0x1003765]
cmp byte [esi + 1], 0x3a
jne 0x10031cf
add esi, 2
cmp byte [esi], 0
je 0x10032c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movsx ecx, byte [ebp - 0x27d]
cmp ecx, 0x61
jle 0x10031a4
cmp ecx, 0x63
jne 0x100325f
cmp dword [ebp - 0x288], 0x64
mov dword [0x1007064], 0x100238a
jge 0x10032f7
mov ecx, dword [ebp - 0x288]
inc dword [ebp - 0x288]
mov dword [ebp + ecx*4 - 0x434], esi
lea esi, [esi + eax - 1]
jmp 0x10037f8
cmp dword [0x1007060], 0
jne 0x10016bc
jmp 0x100331c
and dword [0x1007010], 0
jmp 0x10037f8
or dword [0x1007040], 1
jmp 0x1001800