Function at 0x65f4f0
Capabilities:
Enumerate files on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x727b6a
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 4], 0
push 0xa
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x280], eax
call fcn.0042a540
push 0xa
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 1
call fcn.0042a540
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 2
mov dword [ebp - 0x274], 0
call fcn.00429050
push 0x75b554
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 3
call fcn.00428840
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 4
call fcn.00428840
push 0
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x27c]
push eax
push SysReAllocStringLen
call fcn.005b62f0
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x27c]
call fcn.00428810
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 3
call fcn.00428810
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
cmp dword [ebp - 0x288], 1
push 0
push 0
push 0x184
push dword [edi + 0x58]
sete al
mov dword [ebp - 0x278], eax
call ebx
push 0x785520
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00428bd0
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 6
push ecx
mov ecx, eax
call fcn.00429100
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.00428810
lea esp, [esp]
cmp esi, 0xffffffff
je 0x65f748
mov ecx, 0x789270
lea eax, [ebp - 0x244]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x65f67a
test dx, dx
je 0x65f676
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x65f67a
add eax, 4
add ecx, 4
test dx, dx
jne 0x65f654
xor eax, eax
jmp 0x65f67f
sbb eax, eax
or eax, 1
test eax, eax
je 0x65f72c
mov ecx, 0x789274
lea eax, [ebp - 0x244]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x65f6b8
test dx, dx
je 0x65f6b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x65f6b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x65f692
xor eax, eax
jmp 0x65f6bd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x65f6cd
mov dword [ebp - 0x280], 1
jmp 0x65f72c
mov eax, dword [ebp - 0x270]
test al, 0x10
je 0x65f6ec
cmp dword [ebp - 0x278], 0
jne 0x65f6e4
test al, 2
jne 0x65f72c
lea ecx, [ebp - 0x2b8]
jmp 0x65f720
cmp dword [ebp - 0x278], 0
jne 0x65f6f9
test al, 2
jne 0x65f72c
push ecx
lea eax, [ebp - 0x244]
mov ecx, esp
push eax
call fcn.00428840
call fcn.0057f610
add esp, 4
cmp eax, 1
je 0x65f71a
cmp eax, 2
jne 0x65f72c
lea ecx, [ebp - 0x2a0]
lea eax, [ebp - 0x244]
push eax
call fcn.0042a6a0
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x65f640
test esi, esi
je 0x65f759
jmp 0x65f752
mov dword [ebp - 0x280], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x2b8]
push 1
push eax
call fcn.005b90d0
lea eax, [ebp - 0x2a0]
push 1
push eax
call fcn.005b90d0
mov eax, dword [ebp - 0x280]
add esp, 0x10
test eax, eax
je 0x65f7aa
mov eax, dword [edi]
mov ecx, edi
push 0x789274
call dword [eax + 0xc]
push 0
push 0
push 0x18b
push dword [edi + 0x58]
call ebx
push 3
dec eax
push eax
push 0x19a
push dword [edi + 0x58]
call ebx
lea ecx, [ebp - 0x2b8]
call fcn.00429100
mov dword [ebp - 0x274], eax
test eax, eax
je 0x65f813
nop
mov esi, dword [edi]
lea ecx, [ebp - 0x2b8]
push eax
call fcn.0042ab30
mov ecx, eax
call fcn.00429100
push eax
mov ecx, edi
call dword [esi + 0xc]
push 0
push 0
push 0x18b
push dword [edi + 0x58]
call ebx
push 2
dec eax
push eax
push 0x19a
push dword [edi + 0x58]
call ebx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.0042aa70
mov eax, dword [ebp - 0x274]
test eax, eax
jne 0x65f7c0
lea ecx, [ebp - 0x2a0]
call fcn.00429100
mov dword [ebp - 0x274], eax
test eax, eax
je 0x65f883
jmp 0x65f830
mov esi, dword [edi]
lea ecx, [ebp - 0x2a0]
push eax
call fcn.0042ab30
mov ecx, eax
call fcn.00429100
push eax
mov ecx, edi
call dword [esi + 0xc]
push 0
push 0
push 0x18b
push dword [edi + 0x58]
call ebx
push 1
dec eax
push eax
push 0x19a
push dword [edi + 0x58]
call ebx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0042aa70
mov eax, dword [ebp - 0x274]
test eax, eax
jne 0x65f830
push 0
push 0
push 0x18b
push dword [edi + 0x58]
call ebx
test eax, eax
jne 0x65f8bd
mov eax, dword [edi]
mov ecx, edi
push 0x790eb0
call dword [eax + 0xc]
push 0
push 0
push 0x18b
push dword [edi + 0x58]
call ebx
push 0xffffffffffffffff
dec eax
push eax
push 0x19a
push dword [edi + 0x58]
call ebx
push 0
push 0
push 0x186
push dword [edi + 0x58]
call ebx
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x78]
call fcn.004289a0
mov eax, dword [edi + 0x50]
test eax, eax
je 0x65f95b
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x65f95b
push 0
push 0
push 0x18b
push dword [edi + 0x58]
call ebx
mov esi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0x58]
movdqu xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
movd xmm0, dword [edi + 0x40]
cvtdq2pd xmm0, xmm0
mov edx, dword [edi + 0x50]
movd xmm1, ecx
xor ecx, ecx
cvtdq2pd xmm1, xmm1
divsd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
setae cl
xor eax, eax
test ecx, ecx
setne al
push eax
push dword [edx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 1
call fcn.0042a600
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0
call fcn.0042a600
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 4