Function at 0x421141
Capabilities:
Enumerate files on windows

Disassembly:
push 0x34c
mov eax, 0x50e4db
call fcn.004ec79c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2a4], eax
call fcn.00411dd9
mov al, byte [eax]
xor ebx, ebx
test al, al
jne 0x421209
lea eax, [ebp - 0x358]
push eax
call fcn.004071c6
lea eax, [ebp - 0x350]
push str.CSystemCommands::GetNextUserPath___start
push eax
mov dword [ebp - 4], ebx
call fcn.004058d5
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x358]
call fcn.0040574e
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00405549
push ebx
push 1
mov esi, edi
call fcn.0040754f
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x358]
call fcn.00405a60
push 0x525140
push dword [ebp - 0x2a4]
call fcn.00407685
lea eax, [ebp - 0x4c]
push str.SYSTEMDRIVE
push eax
call fcn.0041f51b
pop ecx
pop ecx
push 9
pop edi
mov dword [ebp - 4], edi
call fcn.0041a135
test eax, eax
lea eax, [ebp - 0x4c]
jne 0x42133d
push str.Documents_and_Settings_
jmp 0x421342
lea eax, [ebp - 0x350]
push eax
mov dword [ebp - 4], 2
call fcn.00405430
mov byte [ebp - 4], 3
call fcn.00411dd9
lea ecx, [ebp - 0x2cc]
call fcn.00405346
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x42123f
mov esi, dword [eax + 4]
jmp 0x421242
lea esi, [eax + 4]
lea eax, [ebp - 0x350]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CSystemCommands::GetNextUserPath___start
push eax
call fcn.004058d5
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x2cc]
mov byte [ebp - 4], 3
call fcn.0040754f
lea eax, [ebp - 0x2ac]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 5
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4212eb
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x350]
call fcn.0040532c
push 0x8c0
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x2cc]
call fcn.0040754f
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 2
call fcn.0040539b
or dword [ebp - 4], 0xffffffff
jmp 0x4211c9
push str.Users_
push eax
call fcn.0040512d
mov ecx, dword [ebp - 0x2a4]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x4c]
call fcn.00407341
call fcn.00411dd9
cmp byte [eax], 0
jne 0x4213e1
lea eax, [ebp - 0x358]
push eax
call fcn.004071c6
push dword [ebp - 0x2a4]
mov ebx, 0x525218
push ecx
push ebx
push ecx
lea eax, [ebp - 0x350]
push str.CSystemCommands::GetNextUserPath___path:
push eax
mov byte [ebp - 4], 0xa
call fcn.004058d5
add esp, 0xc
push eax
call fcn.004058d5
add esp, 0xc
push eax
call fcn.00405173
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x358]
call fcn.0040574e
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 0xb
call fcn.00405549
push 0
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 9
call fcn.00405a60
jmp 0x421534
lea eax, [ebp - 0x350]
push eax
mov byte [ebp - 4], 0xc
call fcn.00405430
mov byte [ebp - 4], 0xd
call fcn.00411dd9
lea ecx, [ebp - 0x2cc]
call fcn.00405346
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 8
jb 0x421414
mov esi, dword [eax + 4]
jmp 0x421417
lea esi, [eax + 4]
lea eax, [ebp - 0x350]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CSystemCommands::GetNextUserPath___path:
push eax
call fcn.004058d5
pop ecx
pop ecx
mov ebx, 0x525218
push ebx
push eax
call fcn.004058d5
pop ecx
pop ecx
push dword [ebp - 0x2a4]
push eax
call fcn.00405173
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x2cc]
mov byte [ebp - 4], 0xd
call fcn.0040754f
lea eax, [ebp - 0x2ac]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0xf
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4214de
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x350]
call fcn.0040532c
push 0x8d2
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x10
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x2cc]
call fcn.0040754f
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0xd
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0xc
call fcn.0040539b
mov dword [ebp - 4], edi
jmp 0x421534
push 0x52a074
lea eax, [ebp - 0x4c]
push eax
call fcn.0040512d
call fcn.00411dd9
cmp byte [eax], 0
jne 0x4215c2
lea eax, [ebp - 0x358]
push eax
call fcn.004071c6
lea eax, [ebp - 0x4c]
push eax
push ecx
push ebx
push ecx
lea eax, [ebp - 0x350]
push 0x52a078
push eax
mov byte [ebp - 4], 0x13
call fcn.004058d5
add esp, 0xc
push eax
call fcn.004058d5
add esp, 0xc
push eax
call fcn.00405173
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x358]
call fcn.0040574e
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00405549
push 0
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 9
call fcn.00405a60
jmp 0x421712
lea eax, [ebp - 0x350]
push eax
mov byte [ebp - 4], 0x15
call fcn.00405430
mov byte [ebp - 4], 0x16
call fcn.00411dd9
lea ecx, [ebp - 0x2cc]
call fcn.00405346
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x18], 8
jb 0x4215f5
mov esi, dword [eax + 4]
jmp 0x4215f8
lea esi, [eax + 4]
lea eax, [ebp - 0x350]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x52a078
push eax
call fcn.004058d5
pop ecx
pop ecx
push ebx
push eax
call fcn.004058d5
pop ecx
pop ecx
lea ecx, [ebp - 0x4c]
push ecx
push eax
call fcn.00405173
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x2cc]
mov byte [ebp - 4], 0x16
call fcn.0040754f
lea eax, [ebp - 0x2ac]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4216b8
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x350]
call fcn.0040532c
push 0x8d4
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x19
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x2cc]
call fcn.0040754f
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x16
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x15
call fcn.0040539b
mov dword [ebp - 4], 9
jmp 0x421712
mov esi, dword [ebp - 0x2b0]
mov eax, dword [esi]
test eax, eax
jne 0x421965
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x42172e
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x2a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
call fcn.00411dd9
cmp byte [eax], 0
jne 0x42180b
lea eax, [ebp - 0x358]
push eax
call fcn.004071c6
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x350]
push ecx
push ebx
push ecx
push str.CSystemCommands::GetNextUserPath___try_to_find_first_folder:
push eax
mov byte [ebp - 4], 0x1c
call fcn.004058d5
add esp, 0xc
push eax
call fcn.004058d5
add esp, 0xc
push eax
call fcn.00405173
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x358]
call fcn.0040574e
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
call fcn.00405549
push 0
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 9
call fcn.00405a60
mov esi, dword [ebp - 0x2b0]
cmp dword [esi], 0xffffffff
je 0x42197b
cmp word [ebp - 0x274], 0x2e
je 0x4217f3
mov eax, 0x2e2e
cmp word [ebp - 0x274], ax
je 0x4217f3
test byte [ebp - 0x2a0], 0x10
jne 0x42199f
lea eax, [ebp - 0x2a0]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4217ce
jmp 0x42197b
lea eax, [ebp - 0x350]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00405430
mov byte [ebp - 4], 0x1f
call fcn.00411dd9
lea ecx, [ebp - 0x2cc]
call fcn.00405346
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 8
jb 0x42183e
mov esi, dword [eax + 4]
jmp 0x421841
lea esi, [eax + 4]
lea eax, [ebp - 0x350]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CSystemCommands::GetNextUserPath___try_to_find_first_folder:
push eax
call fcn.004058d5
pop ecx
pop ecx
push ebx
push eax
call fcn.004058d5
pop ecx
pop ecx
push dword [ebp - 0x2a4]
push eax
call fcn.00405173
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x2cc]
mov byte [ebp - 4], 0x1f
call fcn.0040754f
lea eax, [ebp - 0x2ac]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x21
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x421903
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x350]
call fcn.0040532c
push 0x8d9
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x22
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x2cc]
call fcn.0040754f
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x1f
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x1e
call fcn.0040539b
mov dword [ebp - 4], 9
jmp 0x4217bf
lea ecx, [ebp - 0x2a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4217bf
mov eax, dword [ebp - 0x2b0]
push dword [eax]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 1
lea esi, [ebp - 0x4c]
call fcn.0040754f
mov al, bl
call fcn.004ec7f8
ret
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x2a4]
call fcn.0040512d
call fcn.00411dd9
cmp byte [eax], 0
jne 0x421a35
lea eax, [ebp - 0x358]
push eax
call fcn.004071c6
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x350]
push ecx
push ebx
push ecx
push str.CSystemCommands::GetNextUserPath___Current_is_folder:
push eax
mov byte [ebp - 4], 0x25
call fcn.004058d5
add esp, 0xc
push eax
call fcn.004058d5
add esp, 0xc
push eax
call fcn.00405173
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x358]
call fcn.0040574e
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 0x26
call fcn.00405549
push 0
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 9
call fcn.00405a60
mov bl, 1
jmp 0x42198b
lea eax, [ebp - 0x350]
push eax
mov byte [ebp - 4], 0x27
call fcn.00405430
mov byte [ebp - 4], 0x28
call fcn.00411dd9
lea ecx, [ebp - 0x2cc]
call fcn.00405346
mov byte [ebp - 4], 0x29
cmp dword [eax + 0x18], 8
jb 0x421a68
mov esi, dword [eax + 4]
jmp 0x421a6b
lea esi, [eax + 4]
lea eax, [ebp - 0x350]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CSystemCommands::GetNextUserPath___Current_is_folder:
push eax
call fcn.004058d5
pop ecx
pop ecx
push ebx
push eax
call fcn.004058d5
pop ecx
pop ecx
push dword [ebp - 0x2a4]
push eax
call fcn.00405173
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x2cc]
mov byte [ebp - 4], 0x28
call fcn.0040754f
lea eax, [ebp - 0x2ac]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x2a
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x421b2d
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x350]
call fcn.0040532c
push 0x8eb
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x2b
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x2cc]
call fcn.0040754f
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x28
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x27
call fcn.0040539b
jmp 0x421a2e