Function at 0x429a30
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8a31
mov eax, dword fs:[0]
push eax
sub esp, 0x658
mov eax, dword [0x5036e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x5b4], edi
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x578], edi
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x554], 1
call fcn.004990f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429b04
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040edb0
push 9
push str.Prefetch
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.0040eb20
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0x594], ax
lea ecx, [ebp - 0x594]
mov eax, dword [ebp - 0x23c]
add eax, 4
mov dword [ebp - 0x584], 0
push eax
mov dword [ebp - 0x580], 7
mov dword [ebp - 0x554], 3
call fcn.00426b00
cmp dword [ebp - 0x238], 8
lea eax, [ebp - 0x24c]
push dword [ebp - 0x23c]
cmovae eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x594]
push eax
call fcn.0040eb20
push 4
push str..
lea ecx, [ebp - 0x594]
call fcn.0040eb20
cmp dword [ebp - 0x580], 8
lea ecx, [ebp - 0x548]
lea eax, [ebp - 0x594]
cmovae eax, dword [ebp - 0x594]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x580]
mov esi, eax
mov dword [ebp - 0x5b0], esi
mov dword [ebp - 0x554], 1
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x429c2f
mov ecx, dword [ebp - 0x594]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429c25
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
xor eax, eax
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x580], 7
mov word [ebp - 0x594], ax
cmp esi, 0xffffffff
jne 0x429d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.0046fbc0
mov ecx, eax
push 1
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x42a714
push 0x63
push str.d:jenkins.jenkinsworkspacepay_group_sys_clean_sys_clean_clientclient_sys_clean_srcprefetch.cc
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], al
call fcn.0040ecb0
push 3
push 0x4d3b60
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x598], 0xf
mov byte [ebp - 0x5ac], 0
call fcn.0040ecb0
push 0x172
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x5ac]
push eax
lea ecx, [ebp - 0x664]
call fcn.0040a7e0
mov esi, eax
push str._error__failed_to_find_first_file___path:
push esi
mov byte [ebp - 4], 5
call fcn.0040b5c0
cmp dword [ebp - 0x238], 8
lea ecx, [ebp - 0x24c]
mov eax, str._null_
cmovae ecx, dword [ebp - 0x24c]
test ecx, ecx
cmovne eax, ecx
push eax
push esi
call fcn.00409890
push 0x4d639c
push esi
call fcn.0040b5c0
add esp, 0x18
mov ecx, esi
push edi
call fcn.0040b460
call fcn.0046fbc0
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0x664]
call fcn.0040b820
lea ecx, [ebp - 0x5ac]
call fcn.0040afe0
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.0040afe0
jmp 0x42a714
lea eax, [ebp - 0x548]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42a70d
mov edi, 1
mov dword [ebp - 0x554], edi
nop dword [eax + eax]
cmp word [ebp - 0x51c], 0x2e
mov esi, edi
jne 0x429dd0
mov ax, word [ebp - 0x51a]
test ax, ax
je 0x42a6f1
cmp ax, 0x2e
jne 0x429dd0
cmp word [ebp - 0x518], 0
je 0x42a6f1
test byte [ebp - 0x548], 0x10
jne 0x42a6f1
push 0xac
lea eax, [ebp - 0x2f8]
push 0
push eax
call fcn.004990f0
add esp, 0xc
xor eax, eax
mov byte [ebp - 4], 6
mov word [ebp - 0x574], ax
lea ecx, [ebp - 0x574]
mov eax, dword [ebp - 0x23c]
or edi, 4
inc eax
mov dword [ebp - 0x564], 0
push eax
mov dword [ebp - 0x560], 7
mov dword [ebp - 0x554], edi
call fcn.00426b00
cmp dword [ebp - 0x238], 8
lea eax, [ebp - 0x24c]
push dword [ebp - 0x23c]
cmovae eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x574]
push eax
call fcn.0040eb20
push 1
push 0x4d3590
lea ecx, [ebp - 0x574]
call fcn.0040eb20
lea ecx, [ebp - 0x51c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429e71
sub ecx, edx
lea eax, [ebp - 0x51c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x574]
call fcn.0040eb20
mov edi, esi
xor ecx, ecx
or edi, 0xc
mov dword [ebp - 0x554], edi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5cc], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
movq qword [ebp - 0x5bc], xmm0
mov word [eax], cx
lea eax, [ebp - 0x5cc]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x2f8]
call fcn.004136b0
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d8], 0
xor eax, eax
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 7
mov word [ebp - 0x2c8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], eax
movups xmmword [ebp - 0x2b0], xmm0
movups xmmword [ebp - 0x29c], xmm0
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], eax
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x280], eax
call fcn.0041e410
mov dword [ebp - 0x284], eax
xor eax, eax
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 7
mov word [ebp - 0x27c], ax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
mov edx, dword [ebp - 0x5b8]
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x429ff3
mov ecx, dword [ebp - 0x5cc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429fe9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
and edi, 0xfffffffb
mov dword [ebp - 0x57c], edi
mov dword [ebp - 0x554], edi
mov edx, dword [ebp - 0x560]
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x42a046
mov ecx, dword [ebp - 0x574]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a03c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
xor eax, eax
mov dword [ebp - 0x564], 0
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x560], 7
mov word [ebp - 0x574], ax
call fcn.00429860
test al, al
je 0x42a552
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
lea ecx, [ebp - 0x2f8]
call fcn.004293c0
cmp dword [ebp - 0x21c], 0
mov byte [ebp - 4], 0x10
je 0x42a552
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a0d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040edb0
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 0x11
push eax
mov eax, dword [ebp - 0x21c]
add eax, 0x20
push eax
call fcn.004317d0
mov edx, dword [ebp - 0x220]
add esp, 8
test al, al
mov byte [ebp - 4], 0x10
sete al
mov byte [ebp - 0x54d], al
cmp edx, 8
jb 0x42a164
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a154
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
mov al, byte [ebp - 0x54d]
add esp, 8
test al, al
je 0x42a53c
mov eax, dword [ebp - 0x21c]
add eax, 0x20
push eax
call fcn.00431890
mov edi, dword [ebp - 0x21c]
add esp, 4
add edi, 0x20
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x54c], eax
jb 0x42a198
mov edi, dword [edi]
cmp eax, 8
jae 0x42a1b3
movups xmm0, xmmword [edi]
mov dword [ebp - 0x220], 7
movups xmmword [ebp - 0x234], xmm0
jmp 0x42a201
mov esi, eax
lea ecx, [ebp - 0x234]
or esi, 7
mov eax, SysReAllocString
cmp esi, 0x7ffffffe
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040e5f0
mov ecx, eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x234], ecx
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.004985f0
mov eax, dword [ebp - 0x54c]
add esp, 0xc
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x578]
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x12
mov edi, dword [eax + 4]
mov esi, dword [eax]
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x558], edi
mov dword [ebp - 0x55c], esi
call fcn.004136b0
mov edx, dword [ebp - 0x574]
mov dword [ebp - 0x54c], edx
cmp esi, edi
je 0x42a2d5
mov eax, edi
nop word [eax + eax]
mov edi, dword [esi]
test edi, edi
je 0x42a2ba
mov ecx, dword [edi + 0x30]
lea eax, [ebp - 0x574]
add edi, 0x20
cmp dword [ebp - 0x560], 8
cmovae eax, edx
cmp dword [edi + 0x14], 8
jb 0x42a274
mov edi, dword [edi]
cmp ecx, dword [ebp - 0x564]
jne 0x42a2b4
test ecx, ecx
je 0x42a2cf
movzx edx, word [edi]
movzx esi, word [eax]
cmp dx, si
jb 0x42a2a8
sub edi, eax
cmp dx, si
ja 0x42a2a8
cmp ecx, 1
je 0x42a2c9
movzx edx, word [edi + eax + 2]
add eax, 2
dec ecx
movzx esi, word [eax]
cmp dx, si
jae 0x42a290
mov edx, dword [ebp - 0x54c]
mov esi, dword [ebp - 0x55c]
mov eax, dword [ebp - 0x558]
add esi, 4
mov dword [ebp - 0x55c], esi
cmp esi, eax
jne 0x42a250
jmp 0x42a2cf
mov esi, dword [ebp - 0x55c]
mov edx, dword [ebp - 0x54c]
mov eax, dword [ebp - 0x560]
cmp eax, 8
jb 0x42a30f
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42a305
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push ecx
push edx
call fcn.004776ff
add esp, 8
mov edi, dword [ebp - 0x578]
cmp esi, dword [edi + 4]
je 0x42a344
mov eax, dword [ebp - 0x21c]
mov ecx, dword [esi]
mov edx, dword [eax]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jl 0x42a4f2
jg 0x42a33a
cmp edx, dword [ecx]
jbe 0x42a4f2
mov dword [ecx], edx
mov dword [ecx + 4], eax
jmp 0x42a4f2
call fcn.0046fbc0
mov ecx, eax
push 1
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x42a4c3
push 0x63
push str.d:jenkins.jenkinsworkspacepay_group_sys_clean_sys_clean_clientclient_sys_clean_srcprefetch.cc
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], 0xf
mov byte [ebp - 0x5ac], al
call fcn.0040ecb0
push 3
push 0x4d3b60
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x564], 0
mov dword [ebp - 0x560], 0xf
mov byte [ebp - 0x574], 0
call fcn.0040ecb0
push 0x191
lea eax, [ebp - 0x5ac]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp - 0x664]
call fcn.0040a7e0
mov esi, eax
push str.resent_run_app:
push esi
mov byte [ebp - 4], 0x15
call fcn.0040b5c0
mov ecx, dword [ebp - 0x21c]
add esp, 8
add ecx, 0x20
cmp dword [ecx + 0x14], 8
jb 0x42a400
mov ecx, dword [ecx]
test ecx, ecx
mov eax, str._null_
cmovne eax, ecx
push eax
push esi
call fcn.00409890
add esp, 8
call fcn.0046fbc0
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0x664]
call fcn.0040b820
mov edx, dword [ebp - 0x560]
mov byte [ebp - 4], 0x13
cmp edx, 0x10
jb 0x42a46a
mov ecx, dword [ebp - 0x574]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42a460
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
mov edx, dword [ebp - 0x598]
mov dword [ebp - 0x564], 0
mov dword [ebp - 0x560], 0xf
mov byte [ebp - 0x574], 0
mov byte [ebp - 4], 0x12
cmp edx, 0x10
jb 0x42a4c3
mov ecx, dword [ebp - 0x5ac]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42a4b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
mov ecx, dword [edi + 4]
cmp dword [edi + 8], ecx
je 0x42a4e3
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
mov dword [ecx], eax
add dword [edi + 4], 4
jmp 0x42a4f2
lea eax, [ebp - 0x21c]
push eax
push ecx
mov ecx, edi
call fcn.00427220
mov edx, dword [ebp - 0x220]
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x42a536
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a52c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
mov edi, dword [ebp - 0x57c]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x42a552
push eax
lea ecx, [ebp - 0x21c]
call fcn.00428cf0
mov edx, dword [ebp - 0x250]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x42a596
mov ecx, dword [ebp - 0x264]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a58c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
mov edx, dword [ebp - 0x268]
xor eax, eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
cmp edx, 8
jb 0x42a5f3
mov ecx, dword [ebp - 0x27c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a5e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
xor eax, eax
mov dword [ebp - 0x26c], 0
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x268], 7
mov word [ebp - 0x27c], ax
call fcn.00428790
lea ecx, [ebp - 0x290]
call fcn.004289f0
lea ecx, [ebp - 0x2a8]
call fcn.00413e30
lea ecx, [ebp - 0x2d4]
call fcn.00428ad0
mov ecx, dword [ebp - 0x2e0]
test ecx, ecx
je 0x42a694
mov edx, dword [ebp - 0x2d8]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x42a66c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d8], 0
mov edx, dword [ebp - 0x2e4]
cmp edx, 8
jb 0x42a6d4
mov ecx, dword [ebp - 0x2f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a6ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a75f
push edx
push ecx
call fcn.004776ff
add esp, 8
xor eax, eax
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0x548]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x429da0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x578]
push dword [ebp - 0x5b4]
mov edx, dword [edi + 4]
mov ecx, edx
mov esi, dword [edi]
sub ecx, esi
sar ecx, 2
push ecx
push edx
push esi
call fcn.00427e90
add esp, 0x10
lea ecx, [ebp - 0x24c]
call fcn.0040b030
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004779c3
mov esp, ebp
pop ebp
ret
call fcn.0049c66a
int3