Function at 0x101e998
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x280
mov eax, 0x1055b45
call fcn.01021f2c
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x280], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x1064ba8
push esi
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x284], eax
call fcn.01015076
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x268]
call fcn.01015076
push esi
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 1
call fcn.01015076
push 0x105
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
call fcn.010158a3
mov ecx, dword [ebp - 0x268]
push dword [ecx - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x101ecab
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.01015023
push 0x10039fc
lea ecx, [ebp - 0x26c]
call fcn.010161a7
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 3
call fcn.010360f6
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.010147cd
push dword [ebp - 0x270]
mov ecx, edi
call fcn.0101a9be
test eax, eax
je 0x101ecab
push 0x100525c
push edi
lea eax, [ebp - 0x26c]
push eax
call fcn.01015847
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 4
call fcn.01015959
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.010147cd
mov esi, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x101eaf7
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.010147cd
lea ecx, [esi - 0x10]
jmp 0x101ecd0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, 0x1001678
test byte [ebp - 0x260], 0x10
je 0x101ebac
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x1005258
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x101eb9f
push 0x1005250
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x101eb9f
push esi
push dword [ebp - 0x274]
lea eax, [ebp - 0x28c]
push eax
call fcn.01015847
lea ecx, [ebp - 0x234]
push ecx
push eax
lea eax, [ebp - 0x278]
push eax
mov byte [ebp - 4], 5
call fcn.01015847
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 6
call fcn.01015959
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x28c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.010147cd
mov ecx, dword [ebp - 0x280]
jmp 0x101ec79
test byte [ebp - 0x260], 0x10
jne 0x101ec84
push 0x1005244
call edi
mov ebx, eax
lea eax, [ebp - 0x234]
push eax
call edi
cmp eax, ebx
jle 0x101ec84
push 0xffffffffffffffff
mov eax, 0x1005244
push eax
push 0xffffffffffffffff
push eax
call edi
mov ebx, eax
lea eax, [ebp - 0x234]
push eax
call edi
sub eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CompareStringW]
lea eax, [ebp + eax*2 - 0x234]
push eax
push 1
push 0x7f
call ebx
cmp eax, 2
jne 0x101ec84
push 0xffffffffffffffff
push 0x100522c
push 0xffffffffffffffff
lea eax, [ebp - 0x234]
push eax
push 1
push 0x7f
call ebx
cmp eax, 2
je 0x101ec84
push esi
push dword [ebp - 0x274]
lea eax, [ebp - 0x27c]
push eax
call fcn.01015847
lea ecx, [ebp - 0x234]
push ecx
push eax
lea eax, [ebp - 0x288]
push eax
mov byte [ebp - 4], 7
call fcn.01015847
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 8
call fcn.01015959
mov ecx, dword [ebp - 0x288]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.010147cd
mov ecx, dword [ebp - 0x284]
push dword [ebp - 0x264]
call fcn.010172fc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101eb02
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.010147cd
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.010147cd
call fcn.01021fbe
ret 8