Function at 0x47305a
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x35c], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.inf
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00407f00
lea edx, [ebp - 0x20c]
push edx
call sub.ntdll.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x20c]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
push str..inf
push 0x104
mov eax, dword [ebp - 0x108]
push eax
call fcn.00409000
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x4731d5
mov eax, dword [ebp - 0x358]
and eax, 0x10
test eax, eax
jne 0x4731ac
lea ecx, [ebp - 0x32c]
push ecx
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.00409000
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
call fcn.00473d00
test eax, eax
je 0x473189
mov ecx, dword [ebp - 0x35c]
add ecx, 1
mov dword [ebp - 0x35c], ecx
cmp dword [ebp + 8], 0
je 0x473187
mov edx, dword [ebp + 0xc]
push edx
push 4
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x473187
jmp 0x4731c8
jmp 0x4731ac
cmp dword [ebp + 8], 0
je 0x4731ac
mov edx, dword [ebp + 0xc]
push edx
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x4731ac
jmp 0x4731c8
lea edx, [ebp - 0x358]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x473116
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x51f204
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00407f00
lea ecx, [ebp - 0x20c]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x20c]
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x108]
mov byte [eax], 0x5c
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
push str.msos.dll
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.00409000
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x473339
mov edx, dword [ebp - 0x358]
and edx, 0x10
test edx, edx
jne 0x473310
push str.msoss.dll
lea eax, [ebp - 0x32c]
push eax
call fcn.00402980
add esp, 8
test eax, eax
jne 0x473299
jmp 0x473310
lea ecx, [ebp - 0x32c]
push ecx
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.00409000
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x36c]
call fcn.00474062
test eax, eax
je 0x4732c9
jmp 0x473310
push 1
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0042c7f9
add esp, 8
test eax, eax
jne 0x473310
mov edx, dword [ebp - 0x35c]
add edx, 1
mov dword [ebp - 0x35c], edx
cmp dword [ebp + 8], 0
je 0x473310
mov eax, dword [ebp + 0xc]
push eax
push 4
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call dword [ebp + 8]
test eax, eax
jne 0x473310
jmp 0x47332c
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47326e
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x51f228
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00407f00
lea edx, [ebp - 0x20c]
push edx
call sub.ntdll.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x20c]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
push str.msos.dat
push 0x104
mov eax, dword [ebp - 0x108]
push eax
call fcn.00409000
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x473467
mov eax, dword [ebp - 0x358]
and eax, 0x10
test eax, eax
jne 0x47343e
lea ecx, [ebp - 0x32c]
push ecx
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.00409000
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.0042c7f9
add esp, 8
test eax, eax
jne 0x47343e
mov ecx, dword [ebp - 0x35c]
add ecx, 1
mov dword [ebp - 0x35c], ecx
cmp dword [ebp + 8], 0
je 0x47343e
mov edx, dword [ebp + 0xc]
push edx
push 4
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x47343e
jmp 0x47345a
lea edx, [ebp - 0x358]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4733d2
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp + eax - 0x104]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x218], 0
jmp 0x4734b9
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xf
jae 0x473569
mov ecx, dword [ebp - 0x218]
mov edx, dword [ecx*4 + 0x4b3008]
push edx
push 0x104
mov eax, dword [ebp - 0x108]
push eax
call fcn.00409000
lea ecx, [ebp - 0x104]
push ecx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x473541
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.0042c7f9
add esp, 8
test eax, eax
jne 0x473541
mov eax, dword [ebp - 0x35c]
add eax, 1
mov dword [ebp - 0x35c], eax
cmp dword [ebp + 8], 0
je 0x47353f
mov ecx, dword [ebp + 0xc]
push ecx
push 4
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x36c]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x47353f
jmp 0x473569
jmp 0x473564
cmp dword [ebp + 8], 0
je 0x473564
mov ecx, dword [ebp + 0xc]
push ecx
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x36c]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x473564
jmp 0x473569
jmp 0x4734aa
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x102], 0
push str.Program_Files
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00407f00
lea eax, [ebp - 0x104]
push eax
call sub.ntdll.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x104]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x108]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x360], 0
jmp 0x4735e7
mov ecx, dword [ebp - 0x360]
add ecx, 1
mov dword [ebp - 0x360], ecx
cmp dword [ebp - 0x360], 5
jae 0x473697
mov edx, dword [ebp - 0x360]
mov eax, dword [edx*4 + 0x4b3068]
push eax
push 0x104
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.00409000
lea edx, [ebp - 0x104]
push edx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x47366f
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.0042c7f9
add esp, 8
test eax, eax
jne 0x47366f
mov ecx, dword [ebp - 0x35c]
add ecx, 1
mov dword [ebp - 0x35c], ecx
cmp dword [ebp + 8], 0
je 0x47366d
mov edx, dword [ebp + 0xc]
push edx
push 2
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x47366d
jmp 0x473697
jmp 0x473692
cmp dword [ebp + 8], 0
je 0x473692
mov edx, dword [ebp + 0xc]
push edx
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x473692
jmp 0x473697
jmp 0x4735d8
push 0x104
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + eax - 0x104]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x364], 0
jmp 0x4736e9
mov eax, dword [ebp - 0x364]
add eax, 1
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 9
jae 0x473799
mov ecx, dword [ebp - 0x364]
mov edx, dword [ecx*4 + 0x4b3044]
push edx
push 0x104
mov eax, dword [ebp - 0x108]
push eax
call fcn.00409000
lea ecx, [ebp - 0x104]
push ecx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x473771
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.0042c7f9
add esp, 8
test eax, eax
jne 0x473771
mov eax, dword [ebp - 0x35c]
add eax, 1
mov dword [ebp - 0x35c], eax
cmp dword [ebp + 8], 0
je 0x47376f
mov ecx, dword [ebp + 0xc]
push ecx
push 4
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x36c]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x47376f
jmp 0x473799
jmp 0x473794
cmp dword [ebp + 8], 0
je 0x473794
mov ecx, dword [ebp + 0xc]
push ecx
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x36c]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x473794
jmp 0x473799
jmp 0x4736da
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x20a], 0
push str.Program_FilesMicrosoft_OfficeSYSTEM
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00407f00
lea eax, [ebp - 0x20c]
push eax
call sub.ntdll.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x20c]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x108]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
push 0x51f4c8
push 0x104
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.00409000
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x4738fa
mov ecx, dword [ebp - 0x358]
and ecx, 0x10
test ecx, ecx
jne 0x4738d1
lea edx, [ebp - 0x32c]
push edx
push 0x104
mov eax, dword [ebp - 0x108]
push eax
call fcn.00409000
push 1
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x36c]
call fcn.00473af4
test eax, eax
je 0x4738ae
mov edx, dword [ebp - 0x35c]
add edx, 1
mov dword [ebp - 0x35c], edx
cmp dword [ebp + 8], 0
je 0x4738ac
mov eax, dword [ebp + 0xc]
push eax
push 4
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call dword [ebp + 8]
test eax, eax
jne 0x4738ac
jmp 0x4738ed
jmp 0x4738d1
cmp dword [ebp + 8], 0
je 0x4738d1
mov eax, dword [ebp + 0xc]
push eax
push 0
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call dword [ebp + 8]
test eax, eax
jne 0x4738d1
jmp 0x4738ed
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x473839
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x23
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x473a5d
push str.MicrosoftOFFICESystem
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00407f00
lea edx, [ebp - 0x20c]
push edx
call sub.ntdll.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x20c]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
push 0x51f4ec
push 0x104
mov eax, dword [ebp - 0x108]
push eax
call fcn.00409000
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xffffffff
je 0x473a5d
mov eax, dword [ebp - 0x358]
and eax, 0x10
test eax, eax
jne 0x473a34
lea ecx, [ebp - 0x32c]
push ecx
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.00409000
push 1
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
call fcn.00473af4
test eax, eax
je 0x473a11
mov ecx, dword [ebp - 0x35c]
add ecx, 1
mov dword [ebp - 0x35c], ecx
cmp dword [ebp + 8], 0
je 0x473a0f
mov edx, dword [ebp + 0xc]
push edx
push 4
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x473a0f
jmp 0x473a50
jmp 0x473a34
cmp dword [ebp + 8], 0
je 0x473a34
mov edx, dword [ebp + 0xc]
push edx
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
call dword [ebp + 8]
test eax, eax
jne 0x473a34
jmp 0x473a50
lea edx, [ebp - 0x358]
push edx
mov eax, dword [ebp - 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47399c
mov ecx, dword [ebp - 0x368]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._sysloader.dll
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00407f00
push 0
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x36c]
call fcn.00473af4
test eax, eax
je 0x473acb
mov edx, dword [ebp - 0x35c]
add edx, 1
mov dword [ebp - 0x35c], edx
cmp dword [ebp + 8], 0
je 0x473ac9
mov eax, dword [ebp + 0xc]
push eax
push 4
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call dword [ebp + 8]
jmp 0x473ae8
cmp dword [ebp + 8], 0
je 0x473ae8
mov eax, dword [ebp + 0xc]
push eax
push 0
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call dword [ebp + 8]
mov eax, dword [ebp - 0x210]
mov esp, ebp
pop ebp
ret 8