Function at 0x101ec44
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x280
mov eax, 0x10556f4
call fcn.01022105
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x1064ac0
push esi
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x284], eax
call fcn.01015177
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x268]
call fcn.01015177
push esi
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 1
call fcn.01015177
push 0x105
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
call fcn.01015aa6
mov ecx, dword [ebp - 0x268]
push dword [ecx - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x101ef43
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.01015124
push 0x1004864
lea ecx, [ebp - 0x26c]
call fcn.01016a0f
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 3
call fcn.01035e1c
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.01014c32
push dword [ebp - 0x270]
mov ecx, edi
call fcn.0101ad75
test eax, eax
je 0x101ef43
push 0x1005f80
push edi
lea eax, [ebp - 0x26c]
push eax
call fcn.01015dca
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 4
call fcn.01015b0a
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.01014c32
mov esi, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x26c], eax
jne 0x101ed9b
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.01014c32
lea ecx, [esi - 0x10]
jmp 0x101ef68
mov esi, 0x1005f7c
test byte [ebp - 0x260], 0x10
je 0x101ee45
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x1005f78
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x101ee38
push 0x1005f70
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x101ee38
push esi
push edi
lea eax, [ebp - 0x278]
push eax
call fcn.01015dca
lea ecx, [ebp - 0x234]
push ecx
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 5
call fcn.01015dca
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 6
call fcn.01015b0a
mov ecx, dword [ebp - 0x280]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.01014c32
mov ecx, dword [ebp - 0x28c]
jmp 0x101ef11
test byte [ebp - 0x260], 0x10
jne 0x101ef1c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x1005f64
call ebx
lea ecx, [ebp - 0x234]
push ecx
mov dword [ebp - 0x274], eax
call ebx
mov ecx, dword [ebp - 0x274]
cmp eax, ecx
jle 0x101ef1c
mov eax, 0x1005f64
push eax
push eax
call ebx
lea ecx, [ebp - 0x234]
push ecx
mov dword [ebp - 0x274], eax
call ebx
mov ecx, dword [ebp - 0x274]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub eax, ecx
lea eax, [ebp + eax*2 - 0x234]
push eax
call ebx
test eax, eax
jne 0x101ef1c
push 0x1005f4c
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x101ef1c
push esi
push edi
lea eax, [ebp - 0x27c]
push eax
call fcn.01015dca
lea ecx, [ebp - 0x234]
push ecx
push eax
lea eax, [ebp - 0x288]
push eax
mov byte [ebp - 4], 7
call fcn.01015dca
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 8
call fcn.01015b0a
mov ecx, dword [ebp - 0x288]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.01014c32
mov ecx, dword [ebp - 0x284]
push dword [ebp - 0x264]
call fcn.01017b73
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101eda0
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.01014c32
call fcn.01022197
ret 8