Function at 0x100831d
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xeac
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0xea4], 0xffffffff
push ebx
push esi
push edi
mov dword [ebp - 0xeac], eax
xor eax, eax
mov esi, 0x208
xor edi, edi
push esi
mov word [ebp - 0xa40], ax
lea eax, [ebp - 0xa3e]
push edi
push eax
mov dword [ebp - 0xea8], edi
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push edi
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0x24
lea eax, [ebp - 0x834]
push eax
push 1
push edi
push 0x28
push edi
call ebx
cmp eax, edi
jl 0x10087af
lea eax, [ebp - 0xea0]
push eax
push 0x104
lea eax, [ebp - 0x834]
push eax
mov dword [ebp - 0xea0], edi
call fcn.01007696
cmp eax, edi
jge 0x10083f2
push eax
push 0x10026f0
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
jmp 0x10087d8
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x1a
push edi
mov dword [ebp - 0xea4], edi
call ebx
cmp eax, edi
jge 0x100842d
push eax
push 0x10026a0
jmp 0x10083df
lea eax, [ebp - 0xea4]
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.01007696
cmp eax, edi
jge 0x1008451
push eax
push 0x1002650
jmp 0x10083df
mov eax, dword [ebp - 0xea0]
cmp eax, dword [ebp - 0xea4]
lea ecx, [ebp + eax*2 - 0x20e]
sbb eax, eax
and eax, ecx
je 0x100879b
push eax
mov ebx, 0x105
push ebx
lea eax, [ebp - 0xa40]
push eax
call fcn.010073ff
push edi
push edi
push edi
lea eax, [ebp - 0x834]
push eax
call fcn.01008276
mov dword [ebp - 0xea0], eax
cmp eax, edi
je 0x100878f
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
call fcn.010073ff
push dword [ebp - 0xea0]
call sub.cmutil.dll_CmFree
lea eax, [ebp - 0x41c]
push eax
push 0x1002624
push dword [0x10143ec]
call fcn.0100f2af
xor eax, eax
push esi
mov word [ebp - 0xc4c], ax
lea eax, [ebp - 0xc4a]
push edi
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x41c]
push eax
push 0x1002618
push 0x100
push edi
push edi
lea eax, [ebp - 0xc4c]
push ebx
push eax
call fcn.0100755a
add esp, 0x34
cmp eax, edi
jge 0x100851a
movzx eax, ax
mov dword [ebp - 0xea8], eax
jmp 0x10087d8
lea eax, [ebp - 0xc4c]
push eax
push 0x10025f8
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
lea eax, [ebp - 0xe9c]
push eax
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xea4], eax
cmp eax, 0xffffffff
jne 0x100855b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100850f
test byte [ebp - 0xe9c], 0x10
je 0x1008771
mov ecx, 0x10025f4
lea eax, [ebp - 0xe70]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1008599
cmp dx, di
je 0x1008595
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1008599
add eax, 4
add ecx, 4
cmp dx, di
jne 0x1008573
xor eax, eax
jmp 0x100859e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x1008771
mov ecx, 0x10025ec
lea eax, [ebp - 0xe70]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10085d7
cmp dx, di
je 0x10085d3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10085d7
add eax, 4
add ecx, 4
cmp dx, di
jne 0x10085b1
xor eax, eax
jmp 0x10085dc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x1008771
lea eax, [ebp - 0xe70]
push eax
push 0x10025d0
push dword [0x10143ec]
call fcn.0100f2af
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call sub.msvcrt.dll_memset
push dword [ebp - 0xeac]
lea eax, [ebp - 0xa40]
push 0x1002580
push eax
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1002560
push 0x100
push edi
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.0100755a
add esp, 0x44
test eax, eax
jl 0x10086a4
lea eax, [ebp - 0x210]
push eax
push 0x1002520
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.0100d8de
mov dword [ebp - 0xea0], eax
cmp eax, edi
je 0x10086b6
push eax
push 0x10024c0
push dword [0x10143ec]
call fcn.0100f2af
mov eax, dword [ebp - 0xea0]
add esp, 0xc
mov dword [ebp - 0xea8], eax
jmp 0x10086b6
push 0x1002468
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push edi
push eax
call sub.msvcrt.dll_memset
push dword [ebp - 0xeac]
lea eax, [ebp - 0xa40]
push 0x1002580
push eax
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x100243c
push 0x100
push edi
push edi
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.0100755a
add esp, 0x38
test eax, eax
jl 0x100875f
lea eax, [ebp - 0x628]
push eax
push 0x10023fc
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
call fcn.0100d8de
mov dword [ebp - 0xea0], eax
cmp eax, edi
je 0x1008771
push eax
push 0x10023a0
push dword [0x10143ec]
call fcn.0100f2af
mov eax, dword [ebp - 0xea0]
add esp, 0xc
mov dword [ebp - 0xea8], eax
jmp 0x1008771
push 0x1002348
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
lea eax, [ebp - 0xe9c]
push eax
push dword [ebp - 0xea4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x100855b
jmp 0x10087c3
mov dword [ebp - 0xea8], 0xffff
jmp 0x10087d8
push 0x10022b0
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
jmp 0x10087d8
push eax
push 0x1002260
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
cmp dword [ebp - 0xea4], 0xffffffff
je 0x10087d8
push dword [ebp - 0xea4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xea8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 4