Function at 0x74209e
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x698
mov eax, 0x7b444f
call fcn.00772fd1
push 0x48
pop ecx
mov esi, str.H2FuoosT8buzvoh6VBOU4BhhGCGhCUAmIU4fkGkGmrjpa9RDK6eCD5ymkhmuoHsJNE3rPbiLClEiIC6pml6UkepYeAwKMQ22i4ck9bqChk8RXyoRXMrmQnUbT7hRYJsE3WSQbsxOP80wech3AgkIufrv9dmlCaNnMN4EDlT9HIYTCnuZuFflwizJ2ivqrsuW6LFsnUQBCf8C2h98J7px5JIjLYjfPd9rxWFeBdC6yvbqQoFGwUffuaDrjOtQat5Kyol3hcpzD6v7Reth3O3pU7Jw19qfJ3gtx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x414]
mov dword [ebp - 0x698], eax
rep movsd dword es:[edi], dword [esi]
push 0x35
pop ecx
xor ebx, ebx
movsw word es:[edi], word [esi]
mov esi, str.AHBdOUGB84mIy9SOqSGxsUILpVKKAkFkqoTiZgpmy7xcCKLKLvkqwhsFIYhUdg3DnIdMuqjlHJ2Snvuc1tdEvlUWSaSwkJuNETm4mrmpCdZKBoDtJmi1lfPEW9xLSxVYbCu731fSBuuAVbdNdkNLgXGPKpshcAWug3IvTqtQFx3X9xF0SNgdDTnLXumCVdY7cs3yK65yfQdL8Gr4b1VVu
mov dword [ebp - 0x6a4], ebx
lea edi, [ebp - 0x2f0]
mov dword [ebp - 0x6a0], ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x69c], ebx
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x414]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x42c]
call fcn.00405a50
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x6a4]
call fcn.004082f0
push ebx
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], bl
call fcn.004096c0
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00405a50
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x6a4]
call fcn.004082f0
push ebx
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], bl
call fcn.004096c0
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x19
push eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x8983e4
test eax, eax
je 0x742349
lea eax, [ebp - 0x218]
push 0x8b08b4
push eax
call fcn.0075fe06
and dword [ebp - 0x434], 0
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x430], 7
mov word [ebp - 0x444], ax
cmp word [ebp - 0x218], ax
je 0x7421e1
lea eax, [ebp - 0x218]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x444]
call fcn.00402820
push esi
mov byte [ebp - 4], 3
call fcn.0075fe99
pop ecx
push eax
push esi
lea ecx, [ebp - 0x444]
call fcn.004044c0
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x694]
lea eax, [ebp - 0x444]
cmovae eax, dword [ebp - 0x444]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x74232e
mov ebx, dword [ebp - 0x698]
push 0x2e
pop edi
lea eax, [ebp - 0x694]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x742322
cmp word [ebp - 0x668], di
je 0x742242
cmp word [ebp - 0x666], 0
je 0x742242
cmp word [ebp - 0x666], di
jne 0x74227e
cmp word [ebp - 0x664], 0
je 0x742242
test byte [ebp - 0x694], 0x10
jne 0x742242
and dword [ebp - 0x41c], 0
xor eax, eax
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
cmp word [ebp - 0x218], ax
je 0x7422b7
lea eax, [ebp - 0x218]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00402820
cmp word [ebp - 0x668], 0
mov byte [ebp - 4], 4
jne 0x7422dc
xor eax, eax
jmp 0x7422e9
lea eax, [ebp - 0x668]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004044c0
lea eax, [ebp - 0x42c]
mov ecx, ebx
push eax
call fcn.00609260
push 0
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
call fcn.00402760
jmp 0x742242
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 0
call fcn.00402760
mov esi, 0x8983e4
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call ebx
test eax, eax
je 0x7424fe
lea eax, [ebp - 0x218]
push 0x8b08b4
push eax
call fcn.0075fe06
xor eax, eax
mov dword [ebp - 0x430], 7
xor ebx, ebx
mov word [ebp - 0x444], ax
pop ecx
pop ecx
mov dword [ebp - 0x434], ebx
cmp word [ebp - 0x218], ax
je 0x7423a4
lea eax, [ebp - 0x218]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x444]
call fcn.00402820
push esi
mov byte [ebp - 4], 5
call fcn.0075fe99
pop ecx
push eax
push esi
lea ecx, [ebp - 0x444]
call fcn.004044c0
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x694]
lea eax, [ebp - 0x444]
cmovae eax, dword [ebp - 0x444]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x7424ed
mov edi, dword [ebp - 0x698]
lea eax, [ebp - 0x694]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x7424e7
push 0x2e
pop eax
cmp word [ebp - 0x668], ax
je 0x742402
cmp word [ebp - 0x666], 0
je 0x742402
cmp word [ebp - 0x666], ax
jne 0x742441
cmp word [ebp - 0x664], 0
je 0x742402
test byte [ebp - 0x694], 0x10
jne 0x742402
xor eax, eax
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], ax
cmp word [ebp - 0x218], ax
jne 0x742470
mov eax, ebx
jmp 0x74247d
lea eax, [ebp - 0x218]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00402820
cmp word [ebp - 0x668], 0
mov byte [ebp - 4], 6
jne 0x7424a2
mov eax, ebx
jmp 0x7424af
lea eax, [ebp - 0x668]
push eax
call fcn.0075fe99
pop ecx
push eax
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004044c0
lea eax, [ebp - 0x42c]
mov ecx, edi
push eax
call fcn.00609260
push ebx
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 5
call fcn.00402760
jmp 0x742402
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call edi
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.00402760
lea ecx, [ebp - 0x6a4]
call fcn.006ec102
call fcn.00772f7b
ret