Function at 0x65b050
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x268
push ebx
push ebp
xor ebp, ebp
cmp ecx, ebp
push esi
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
je 0x65b328
cmp edx, 0x105
jl 0x65b328
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, 0x43
lea edi, [esp + 0x168]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00656860
cmp eax, 1
jne 0x65b0ce
call fcn.00656810
cmp eax, 1
lea ecx, [esp + 0x18]
jne 0x65b0c2
mov edx, 0xff
jmp 0x65b0d7
mov esi, 0x64
mov edx, 0x1ff
jmp 0x65b0dc
mov edx, 0x7f
lea ecx, [esp + 0x18]
mov esi, 0x1e
call fcn.00656c60
mov eax, dword [esp + 0x18]
lea ebx, [eax + esi]
cmp ebx, ebp
mov dword [esp + 0x1c], ebx
jl 0x65b31b
cmp ebx, 0x1388
jg 0x65b31b
push 0x10e
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x65b2e6
lea eax, [esp + 0x168]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x65b125
sub eax, edx
cmp eax, 1
jl 0x65b2e6
cmp eax, 0x104
jg 0x65b2e6
mov byte [esp + eax + 0x168], 0x5c
mov byte [esp + eax + 0x169], 0x2a
inc eax
inc eax
mov byte [esp + eax + 0x168], 0x2e
inc eax
mov byte [esp + eax + 0x168], 0x64
inc eax
mov cl, 0x6c
mov byte [esp + eax + 0x168], cl
inc eax
cmp ebx, ebp
mov byte [esp + eax + 0x168], cl
mov byte [esp + eax + 0x169], 0
jle 0x65b257
jmp 0x65b190
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x65b2e6
mov al, byte [esp + 0x54]
test al, al
je 0x65b2df
mov ebx, ebp
lea esp, [esp]
mov al, byte [esp + 0x54]
test al, al
je 0x65b22f
cmp dword [esp + 0x14], 0x1388
jg 0x65b22f
mov eax, dword [esp + 0x28]
test al, 0x10
jne 0x65b212
test ah, 1
jne 0x65b212
mov edx, dword [esp + 0x14]
inc edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x14], edx
call fcn.0065ac70
test eax, eax
je 0x65b212
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jge 0x65b2f3
xor eax, eax
lea edi, [esp + 0x54]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x65b1d0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, ebp
sub edx, ebx
cmp edx, 0x32
jl 0x65b253
cmp dword [esp + 0x14], 0x1388
jg 0x65b253
cmp ebp, dword [esp + 0x1c]
jl 0x65b190
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
test ebx, ebx
jle 0x65b2e6
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x65b2e6
mov al, byte [esp + 0x54]
test al, al
je 0x65b2df
mov al, byte [esp + 0x54]
test al, al
je 0x65b2c7
mov eax, dword [esp + 0x28]
test al, 0x10
jne 0x65b2aa
test ah, 1
jne 0x65b2aa
inc ebp
cmp ebp, ebx
jge 0x65b2f3
lea edx, [esp + 0x28]
push edx
xor eax, eax
lea edi, [esp + 0x58]
mov ecx, 0x41
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x65b290
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp ebp, ebx
jl 0x65b261
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.00698a30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret