Function at 0x442b00
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4570c0
push 0x44bffc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x298
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 4], ebx
push 0x475374
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4611f4
push 0x475374
call fcn.00449570
test eax, eax
je 0x442b76
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [0x47735c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x47547c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x47547c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x47547a], al
push 0x47547c
push 0x475374
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x442be3
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x475370], ebx
je 0x442c0c
push 0x475374
push 0x47547c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
push ebx
push 0xc
mov ecx, dword [0x475370]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x475a64]
mov esi, eax
mov dword [ebp - 0x1a0], esi
cmp dword [0x475478], ebx
je 0x442cf3
xor edx, edx
div dword [0x47522c]
test edx, edx
jne 0x442cf3
cmp dword [0x475950], ebx
je 0x442cb7
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x19c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x442c9e
mov eax, dword [0x475950]
test eax, eax
lea ecx, [ebp - 0x19c]
push ecx
je 0x442c91
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x442c49
lea edx, [ebp - 0x19c]
push edx
call edi
lea eax, [ebp - 0x19c]
push eax
call ebx
jmp 0x442c49
call edi
lea edx, [ebp - 0x19c]
push edx
call ebx
jmp 0x442c49
push 8
mov eax, dword [0x475950]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x442cb7
mov eax, 2
jmp 0x442cf8
push esi
push 0x45a4b0
lea ecx, [ebp - 0x180]
push ecx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
call ebx
add esp, 0xc
lea edx, [ebp - 0x180]
push edx
push 0
push 0xc
mov eax, dword [0x475478]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [ebp - 0x1a4], eax
jmp 0x442d04
mov eax, 1
mov dword [ebp - 0x1a4], eax
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, 2
jne 0x442d23
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x475230
push 0x45a164
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x442e84
push 0x475374
call fcn.00443710
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x164]
push ecx
call fcn.004434e0
mov eax, dword [0x475a64]
mov esi, eax
mov dword [ebp - 0x1d4], esi
inc eax
mov dword [0x475a64], eax
mov eax, dword [0x475478]
test eax, eax
je 0x442e3f
mov eax, esi
xor edx, edx
div dword [0x47522c]
test edx, edx
jne 0x442e3f
mov eax, dword [0x475950]
test eax, eax
je 0x442e16
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x1d0]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x442dfd
mov eax, dword [0x475950]
test eax, eax
lea ecx, [ebp - 0x1d0]
push ecx
je 0x442de8
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x442d98
lea edx, [ebp - 0x1d0]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x442d98
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x1d0]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x442d98
push 8
mov eax, dword [0x475950]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x442e16
mov eax, 2
jmp 0x442e44
push esi
push 0x45a4b0
lea ecx, [ebp - 0x1b4]
push ecx
call ebx
add esp, 0xc
lea edx, [ebp - 0x1b4]
push edx
push 0
push 0xc
mov eax, dword [0x475478]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [ebp - 0x1d8], eax
cmp eax, 2
jne 0x442e69
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x475230
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x442d51
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x475230
push 0x45a15c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x442ffe
push 0x475374
call fcn.00443710
mov dword [ebp - 0x164], eax
mov bl, 0x42
mov ecx, dword [ebp - 0x164]
push ecx
call fcn.004434e0
mov dword [ebp - 0x160], eax
test eax, eax
je 0x442ecd
mov byte [eax + 0x22], bl
mov eax, dword [0x475a64]
mov esi, eax
mov dword [ebp - 0x208], esi
inc eax
mov dword [0x475a64], eax
mov eax, dword [0x475478]
test eax, eax
je 0x442fb3
mov eax, esi
xor edx, edx
div dword [0x47522c]
test edx, edx
jne 0x442fb3
mov eax, dword [0x475950]
test eax, eax
je 0x442f86
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x442f6d
mov eax, dword [0x475950]
test eax, eax
lea ecx, [ebp - 0x204]
push ecx
je 0x442f58
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x442f08
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x442f08
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x442f08
push 8
mov eax, dword [0x475950]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x442f86
mov eax, 2
jmp 0x442fb8
push esi
push 0x45a4b0
lea ecx, [ebp - 0x1e8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x1e8]
push edx
push 0
push 0xc
mov eax, dword [0x475478]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [ebp - 0x20c], eax
cmp eax, 2
jne 0x442fdd
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x475230
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x442eb4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x475230
push 0x45a154
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x443169
mov eax, dword [ebp - 0x164]
test eax, eax
jne 0x443036
push 0x475374
call fcn.00443710
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x164]
push ecx
call fcn.004434e0
mov eax, dword [0x475a64]
mov esi, eax
mov dword [ebp - 0x23c], esi
inc eax
mov dword [0x475a64], eax
mov eax, dword [0x475478]
test eax, eax
je 0x443124
mov eax, esi
xor edx, edx
div dword [0x47522c]
test edx, edx
jne 0x443124
mov eax, dword [0x475950]
test eax, eax
je 0x4430fb
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4430e2
mov eax, dword [0x475950]
test eax, eax
lea ecx, [ebp - 0x238]
push ecx
je 0x4430cd
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x44307d
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x44307d
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x44307d
push 8
mov eax, dword [0x475950]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x4430fb
mov eax, 2
jmp 0x443129
push esi
push 0x45a4b0
lea ecx, [ebp - 0x21c]
push ecx
call ebx
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0xc
mov eax, dword [0x475478]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [ebp - 0x240], eax
cmp eax, 2
jne 0x44314e
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x475230
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x443036
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x47738c]
test eax, eax
push 0x475230
push 0x45a16c
je 0x443389
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, 0xffffffff
je 0x4433a8
mov eax, dword [ebp - 0x164]
test eax, eax
jne 0x4431ae
push 0x475374
call fcn.00443710
mov dword [ebp - 0x164], eax
mov edi, 0x475374
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x47547c
mov edx, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4611ec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x104
push 0x47547c
push 0x475954
call fcn.0044d55b
add esp, 0xc
mov dword [ebp - 0x16c], eax
mov dword [0x475a58], 0
lea eax, [ebp - 0x15c]
push eax
push 0x4611e4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x168], eax
cmp eax, 0xffffffff
je 0x443254
mov dword [0x475a58], 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x164]
push ecx
call fcn.00443870
mov eax, dword [0x475a64]
mov esi, eax
mov dword [ebp - 0x270], esi
inc eax
mov dword [0x475a64], eax
mov eax, dword [0x475478]
test eax, eax
je 0x443348
mov eax, esi
xor edx, edx
div dword [0x47522c]
test edx, edx
jne 0x443348
mov eax, dword [0x475950]
test eax, eax
je 0x44331f
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x26c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x443306
mov eax, dword [0x475950]
test eax, eax
lea ecx, [ebp - 0x26c]
push ecx
je 0x4432f1
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4432a1
lea edx, [ebp - 0x26c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4432a1
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x26c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4432a1
push 8
mov eax, dword [0x475950]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x44331f
mov eax, 2
jmp 0x44334d
push esi
push 0x45a4b0
lea ecx, [ebp - 0x250]
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0x250]
push edx
push 0
push 0xc
mov eax, dword [0x475478]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [ebp - 0x274], eax
cmp eax, 2
jne 0x443372
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x475230
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44325a
push ebx
jmp 0x4433a2
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x4433a8
mov dword [0x475a60], 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [0x475a64]
mov dword [ebp - 0x2a4], esi
mov eax, dword [0x475478]
test eax, eax
je 0x443473
mov eax, dword [0x475950]
test eax, eax
je 0x443445
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x2a0]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x44342b
mov eax, dword [0x475950]
test eax, eax
lea edx, [ebp - 0x2a0]
push edx
je 0x44341e
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4433d6
lea eax, [ebp - 0x2a0]
push eax
call edi
lea ecx, [ebp - 0x2a0]
push ecx
call ebx
jmp 0x4433d6
call edi
lea eax, [ebp - 0x2a0]
push eax
call ebx
jmp 0x4433d6
push 8
mov ecx, dword [0x475950]
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x443445
mov eax, 2
jmp 0x443478
push esi
push 0x45a4b0
lea edx, [ebp - 0x284]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
push 0
push 0xc
mov ecx, dword [0x475478]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [ebp - 0x2a8], eax
cmp eax, 2
mov dword [ebp - 4], 0xffffffff
jne 0x442b5e
mov eax, 2
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4