Function at 0x1019f83
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x1057624
call fcn.0101d9b8
sub esp, 0x4bc
mov eax, dword [0x106406c]
push ebx
mov dword [ebp - 0x10], eax
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x484]
call fcn.01010c62
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 0x4c0], ebx
call fcn.01010c62
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x480]
call fcn.01010c62
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4b0]
call fcn.01010c62
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48c]
call fcn.01010c62
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4a8]
call fcn.01010c62
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x498]
call fcn.01010c62
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x490]
call fcn.01010c62
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4a4]
call fcn.01010c62
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4a0]
call fcn.01010c62
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x488]
call fcn.01010c62
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4ac]
call fcn.01010c62
mov byte [ebp - 4], 0xc
call fcn.01026840
cmp eax, 5
jne 0x101a138
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4ac]
call fcn.01010c92
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x488]
call fcn.01010c92
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4a0]
call fcn.01010c92
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4a4]
call fcn.01010c92
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x490]
call fcn.01010c92
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x498]
call fcn.01010c92
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4a8]
call fcn.01010c92
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48c]
call fcn.01010c92
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4b0]
call fcn.01010c92
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x480]
call fcn.01010c92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4b4]
call fcn.01010c92
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x484]
call fcn.01010c92
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x101a130
call fcn.010165a3
mov dword [ebp + 8], ebx
xor eax, eax
inc eax
jmp 0x101a7fe
lea eax, [ebp - 0x24]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x49c], esp
push eax
call fcn.01018545
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xc
call fcn.01018876
cmp eax, ebx
jne 0x101a172
push 0x1005288
push 3
call fcn.0101254c
pop ecx
pop ecx
jmp 0x101a2ed
lea eax, [ebp - 0x488]
push eax
push 0x14
lea eax, [ebp - 0x24]
push eax
call fcn.01026b60
test eax, eax
je 0x101a2ed
call fcn.01052100
cmp eax, ebx
je 0x101a1b1
cmp eax, 0xb7
je 0x101a1b1
push 0x1005230
push eax
push 3
call fcn.01012616
add esp, 0xc
jmp 0x101a2ed
push 0x105
lea ecx, [ebp - 0x484]
call fcn.01011310
push 0x104
push eax
call fcn.010522f0
test eax, eax
lea ecx, [ebp - 0x484]
push 0xffffffffffffffff
je 0x101a1e2
call fcn.01010a85
jmp 0x101a2ed
call fcn.01010a85
push 0x1004f68
lea ecx, [ebp - 0x494]
call fcn.0101236d
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.01025680
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x494]
call fcn.01010c92
lea eax, [ebp - 0x484]
push eax
call fcn.010259a0
test al, al
jne 0x101a24b
push dword [ebp - 0x484]
push 0x1005204
push 3
call fcn.0101254c
jmp 0x101a1a9
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.01025680
lea eax, [ebp - 0x480]
push eax
call fcn.01025920
test al, al
je 0x101a3fa
push dword [ebp - 0x488]
push 0x10051b8
push 1
call fcn.0101254c
add esp, 0xc
lea eax, [ebp - 0x480]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x49c], esp
push eax
call fcn.01018545
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xc
call fcn.0101973a
cmp eax, ebx
je 0x101a2cb
push 0x1005170
push 1
call fcn.0101254c
pop ecx
pop ecx
jmp 0x101a57b
lea eax, [ebp - 0x22c]
push eax
push ebx
push dword [ebp - 0x488]
push dword [ebp - 0x484]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x101a3ba
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4ac]
call fcn.01010c92
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x488]
call fcn.01010c92
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4a0]
call fcn.01010c92
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4a4]
call fcn.01010c92
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x490]
call fcn.01010c92
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x498]
call fcn.01010c92
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4a8]
call fcn.01010c92
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48c]
call fcn.01010c92
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4b0]
call fcn.01010c92
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x480]
call fcn.01010c92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4b4]
call fcn.01010c92
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x484]
call fcn.01010c92
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x101a3b3
call fcn.010165a3
mov dword [ebp + 8], ebx
xor eax, eax
jmp 0x101a7fe
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x480]
call fcn.010115c1
lea ecx, [ebp - 0x494]
call fcn.01010c62
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.01025540
jmp 0x101a56c
lea ecx, [ebp - 0x494]
call fcn.01010c62
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x4b8]
call fcn.01010c62
mov byte [ebp - 4], 0x12
push 0x1005160
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.010116f7
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x494]
call fcn.010113c1
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x49c]
call fcn.01010c92
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x101a55d
test byte [ebp - 0x47c], 0x10
jne 0x101a4df
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x49c]
call fcn.0101236d
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.01025680
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x49c]
call fcn.01010c92
lea eax, [ebp - 0x4b8]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4bc], esp
push eax
call fcn.01018545
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x12
call fcn.0101973a
cmp eax, ebx
jne 0x101a4f7
lea eax, [ebp - 0x47c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101a46d
jmp 0x101a556
push dword [ebp - 0x4b8]
push 0x1005128
push 1
call fcn.0101254c
add esp, 0xc
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x480]
call fcn.010113c1
lea ecx, [ebp - 0x49c]
call fcn.01010c62
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.01025540
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x49c]
call fcn.01010c92
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x4b8]
call fcn.01010c92
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x494]
call fcn.01010c92
push dword [ebp - 0x480]
push dword [ebp - 0x488]
push 0x10050c0
push 1
call fcn.0101254c
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x480]
add ecx, 0x28
push eax
call fcn.010113c1
lea eax, [ebp - 0x4ac]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x4bc], esp
push eax
call fcn.01018545
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x480]
call fcn.01019536
cmp eax, ebx
je 0x101a732
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x498]
call fcn.01019baa
test eax, eax
je 0x101a732
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x48c]
call fcn.010113c1
push 0x1004a50
lea ecx, [ebp - 0x48c]
call fcn.0101159b
cmp dword [0x106500c], ebx
je 0x101a630
push 0x10050a8
lea ecx, [ebp - 0x48c]
call fcn.0101159b
push 0x10050b0
lea ecx, [ebp - 0x48c]
call fcn.0101159b
mov eax, dword [ebp - 0x480]
push dword [eax - 0xc]
lea ecx, [ebp - 0x48c]
push eax
call fcn.01010f92
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ecx
lea eax, [ebp - 0x4ac]
mov ecx, esp
mov dword [ebp - 0x49c], esp
push eax
lea edi, [ebp - 0x490]
call fcn.01010eb5
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0xc
mov ecx, edi
xor edi, edi
call fcn.01019428
cmp eax, ebx
je 0x101a732
push ecx
lea eax, [ebp - 0x4a0]
mov ecx, esp
mov dword [ebp - 0x4bc], esp
push eax
call fcn.01010eb5
mov byte [ebp - 4], 0x19
push ecx
lea eax, [ebp - 0x4a4]
mov ecx, esp
mov dword [ebp - 0x494], esp
push eax
call fcn.01010eb5
mov byte [ebp - 4], 0x1a
push ecx
lea eax, [ebp - 0x498]
mov ecx, esp
mov dword [ebp - 0x4b8], esp
push eax
call fcn.01010eb5
mov byte [ebp - 4], 0x1b
push ecx
lea eax, [ebp - 0x48c]
mov ecx, esp
mov dword [ebp - 0x4c8], esp
push eax
call fcn.01010eb5
mov byte [ebp - 4], 0x1c
push ecx
lea eax, [ebp - 0x490]
mov ecx, esp
mov dword [ebp - 0x4c4], esp
push eax
call fcn.01010eb5
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 4], 0xc
call fcn.010284d0
cmp eax, ebx
je 0x101a732
mov dword [ebp - 0x4c0], 1
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4ac]
call fcn.01010c92
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x488]
call fcn.01010c92
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4a0]
call fcn.01010c92
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4a4]
call fcn.01010c92
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x490]
call fcn.01010c92
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x498]
call fcn.01010c92
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4a8]
call fcn.01010c92
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48c]
call fcn.01010c92
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4b0]
call fcn.01010c92
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x480]
call fcn.01010c92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4b4]
call fcn.01010c92
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x484]
call fcn.01010c92
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x101a7f8
call fcn.010165a3
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0101cfec
pop edi
pop ebx
leave
ret 4