Function at 0x466000
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589db9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x388
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x3c], esi
xor edi, edi
mov dword [ebp - 4], edi
wait
cmp dword [esi + 0x2a4], edi
jne 0x46604b
xor eax, eax
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x74], eax
mov cl, byte [esi + 0x24]
mov byte [ebp - 0x7c], cl
lea ecx, [esi + 0x2e4]
call fcn.004940b0
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov byte [ebp - 4], 1
push edi
lea ecx, [esi + 0x50]
call fcn.004f9c70
push eax
mov ecx, dword [esi + 0x2a4]
call fcn.00510cf0
mov dword [ebp - 0x78], eax
mov ecx, 0x5f5774
mov edx, dword [0x5f5774]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
push ecx
call fcn.0050a4d0
add esp, 4
push 0x104
push 0x104
lea ecx, [ebp - 0x20]
call fcn.00405c40
push eax
push str.LogsDir
mov edx, dword [ebp - 0x34]
push edx
call fcn.0050a330
add esp, 0x10
lea ecx, [ebp - 0x20]
test eax, eax
jne 0x46613b
push 0x104
call fcn.00405c40
push eax
push 1
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jge 0x466119
push str.SHGetFolderPathW__0__0x001a__0__SHGFP_TYPE_DEFAULT__strSysDir.GetBuffer__260__
push eax
lea ecx, [ebp - 0x124]
call fcn.00434a80
push 0x5cc0a0
lea eax, [ebp - 0x124]
push eax
call fcn.00554cbc
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.00403ab0
push 0x5a0a3c
push str._sData_
lea ecx, [ebp - 0x20]
push ecx
call fcn.0040a750
add esp, 0xc
jmp 0x46614f
push 0xffffffffffffffff
call fcn.00403ab0
push 0x59e4c8
lea ecx, [ebp - 0x20]
call fcn.00407ed0
mov edx, dword [esi + 0x2a4]
add edx, 0x10
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00425d90
mov byte [ebp - 4], 4
push 0x59e4c4
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.00425e40
mov byte [ebp - 4], 5
push 0x5a0a88
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00425e40
mov bl, 6
mov byte [ebp - 4], bl
push 0x59e658
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00425e40
mov byte [ebp - 4], 7
push 0x5a0a94
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00425e40
add esp, 0x3c
mov byte [ebp - 4], 8
mov eax, dword [eax]
lea ecx, [ebp - 0x394]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.00404d60
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00404d60
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.00404d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.00404d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00404d60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x4665ba
lea ecx, [ebp - 0x94]
call fcn.004374b0
mov byte [ebp - 4], 9
mov ecx, esi
call fcn.00463a00
mov bl, 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x368]
push ecx
mov ecx, esi
call fcn.004a9640
test al, al
je 0x466399
lea edx, [esi + 0x2d4]
push edx
lea ecx, [ebp - 0x134]
call fcn.00415ff0
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x144]
call fcn.00431360
mov ecx, eax
call fcn.00431470
test al, al
je 0x466399
lea ecx, [esi + 0x2c4]
push ecx
lea ecx, [ebp - 0x114]
call fcn.00415ff0
push eax
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0x12c]
call fcn.00431360
mov ecx, eax
call fcn.00431440
test al, al
je 0x466399
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00431360
fld qword [eax]
fstp qword [ebp - 0xa4]
mov ecx, dword [esi + 0x2a4]
add ecx, 0x10
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.00425d90
mov byte [ebp - 4], 0xa
push 0x59e4c4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00425e40
mov byte [ebp - 4], 0xb
push 0x5a0a88
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.00425e40
mov byte [ebp - 4], 0xc
push 0x59e4c4
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00425e40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x368]
push ecx
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.00425e40
add esp, 0x3c
mov edi, eax
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x94]
call fcn.004367f0
push edi
mov ecx, eax
call fcn.00407d40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.00404d60
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c]
call fcn.00404d60
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x18]
call fcn.00404d60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14]
call fcn.00404d60
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x40]
call fcn.00404d60
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x394]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x466231
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x2bc]
call fcn.0042c7a0
push eax
lea ecx, [ebp - 0x24]
call fcn.00404d10
mov byte [ebp - 4], 0xf
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WFEN
lea ecx, [ebp - 0xc0]
call fcn.0040b4a0
mov byte [ebp - 4], 0x10
push 0
lea edx, [ebp - 0xc0]
push edx
push 1
call fcn.005096c0
mov ecx, eax
call fcn.00509120
test al, al
je 0x46642a
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0x5a0cd4
call fcn.0040bfb0
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x10
call fcn.004ffd90
add esp, 8
mov dword [ebp - 0x1c], eax
jmp 0x466431
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xc0]
call fcn.00405c10
mov eax, dword [ebp - 0x90]
mov edi, dword [eax]
mov dword [ebp - 0x4c], edi
cmp edi, dword [ebp - 0x90]
je 0x46659c
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
lea edx, [ebp - 0x64]
push edx
mov eax, dword [edi + 0x18]
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
call fcn.0040bfb0
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xf
call fcn.00465510
push 0x59d4a4
mov eax, dword [ebp - 0x3c]
add eax, 0x2bc
push eax
call fcn.00442c30
add esp, 0x18
test al, al
je 0x466555
mov esi, dword [ebp - 0x64]
mov ebx, esi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x48], esi
cmp esi, dword [ebp - 0x60]
je 0x466555
lea ecx, [esi + 4]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404d10
mov byte [ebp - 4], 0x13
lea edx, [esi + 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.00404d10
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x18]
call fcn.0042c7a0
lea ecx, [ebp - 0x14]
call fcn.0042c7a0
push 0
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.004177a0
cmp eax, 0xffffffff
jne 0x46654b
push 0
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004177a0
cmp eax, 0xffffffff
jne 0x46654b
push esi
lea ecx, [ebp - 0x64]
cmp esi, dword [ebp - 0x64]
je 0x46651f
lea edx, [ebp - 0x30]
push edx
call fcn.00465f20
mov dword [ebp - 0x48], ebx
lea esi, [ebx + 0x34]
jmp 0x46652b
lea eax, [ebp - 0x40]
push eax
call fcn.00465f20
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x14]
call fcn.00404d60
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x18]
call fcn.00404d60
jmp 0x4664a6
mov ebx, esi
mov dword [ebp - 0x80], ebx
add esi, 0x34
jmp 0x46652b
cmp byte [edi + 0x21], 0
jne 0x46644b
mov eax, dword [edi + 8]
cmp byte [eax + 0x21], 0
jne 0x466580
mov edi, eax
mov dword [ebp - 0x70], edi
mov eax, dword [edi]
cmp byte [eax + 0x21], 0
jne 0x466448
jmp 0x466568
mov eax, dword [edi + 4]
cmp byte [eax + 0x21], 0
jne 0x466595
cmp edi, dword [eax + 8]
jne 0x466595
mov edi, eax
mov dword [ebp - 0x4c], edi
jmp 0x466580
mov edi, eax
jmp 0x466448
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x24]
call fcn.00404d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00437450
mov esi, dword [ebp - 0x3c]
lea ecx, [esi + 4]
call fcn.00431340
lea ecx, [ebp - 0x38]
push ecx
push str.ItemsPerPage
mov edx, dword [ebp - 0x34]
push edx
call fcn.0050a210
add esp, 0xc
test eax, eax
jne 0x4665f3
push 0x1f4
push str.ItemsPerPage
mov eax, dword [ebp - 0x34]
push eax
call fcn.0050a260
add esp, 0xc
jmp 0x4665fa
mov ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x466602
mov ecx, 0x1f4
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x64]
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, ebx
xor edx, edx
div ecx
mov edi, edx
mov eax, ebx
sub eax, edi
xor edx, edx
div ecx
mov dword [ebp - 0x44], eax
test edi, edi
je 0x466633
inc dword [ebp - 0x44]
lea eax, [ebx - 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x44]
lea edi, [eax - 1]
imul edi, ecx
mov dword [ebp - 0x2c], edi
lea ecx, [esi + 0x2e4]
push eax
call fcn.00494860
lea ecx, [esi + 0x2e4]
cmp byte [esi + 0x32c], 0
jne 0x466683
call fcn.004940a0
mov edi, eax
mov eax, dword [ebp - 0x38]
imul edi, eax
mov dword [ebp - 0x2c], edi
lea ecx, [edi + eax - 1]
mov dword [ebp - 0x18], ecx
mov byte [esi + 0x32c], 1
jmp 0x46668c
mov edx, dword [ebp - 0x44]
push edx
call fcn.004949a0
cmp dword [ebp - 0x18], ebx
jl 0x466697
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x50], ebx
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
mov edi, edi
cmp eax, dword [ebp - 0x30]
je 0x46698b
push eax
lea ecx, [ebp - 0x10c]
call fcn.004652f0
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x50]
cmp eax, edi
jl 0x466966
cmp eax, dword [ebp - 0x18]
jg 0x466966
inc eax
mov dword [ebp - 0x50], eax
mov ecx, 0x5f5774
mov edx, dword [0x5f5774]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0x108]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
lea ecx, [esi - 4]
cmp dword [ecx], 0
jl 0x46672a
cmp eax, dword [esi - 0x10]
jne 0x46672a
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x466763
mov edx, dword [eax]
push 2
mov ecx, dword [esi - 0xc]
push ecx
mov ecx, eax
mov edx, dword [edx]
call edx
mov edi, eax
test edi, edi
jne 0x466743
call fcn.004021c0
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
push esi
lea edx, [eax + eax + 2]
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00554d08
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x19
push 7
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041e300
mov byte [ebp - 4], 0x1a
push str.http:__
mov ecx, eax
call fcn.00402160
test eax, eax
sete byte [ebp - 0x25]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x40]
call fcn.00404d60
cmp byte [ebp - 0x25], 0
je 0x4667b3
push 7
push 0
lea ecx, [ebp - 0x14]
call fcn.00418a10
mov edx, dword [ebp - 0x14]
mov eax, dword [edx - 0xc]
push eax
push 0
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.0041dfc0
push eax
lea ecx, [ebp - 0x14]
call fcn.00418a10
mov esi, dword [ebp - 0x3c]
add esi, 4
push 0
push 1
push 0x1002
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xd8], 0
push 0x30
push 0
lea ecx, [ebp - 0xd4]
push ecx
call fcn.00555020
add esp, 0xc
mov dword [ebp - 0xd8], 3
mov dword [ebp - 0xd4], ebx
push 0xe4
mov edx, dword [0x5fd7c0]
push edx
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
push edi
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 0xbc], eax
push edi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0xd4], getsockname
lea ecx, [ebp - 0x100]
call fcn.00404db0
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xd8]
push ecx
push 0
push 0x104d
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0xfc]
call fcn.00404db0
push eax
push 1
push ebx
mov ecx, esi
call fcn.00401a50
lea ecx, [ebp - 0x14]
call fcn.00404db0
push eax
push 2
push ebx
mov ecx, esi
call fcn.00401a50
mov edi, dword [ebp - 0x104]
add edi, 0xfffffff0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
lea edx, [edi + 0xc]
cmp dword [edx], 0
jl 0x4668c9
cmp eax, dword [edi]
jne 0x4668c9
mov eax, 1
lock xadd dword [edx], eax
jmp 0x46690c
mov edx, dword [eax]
push 2
mov ecx, dword [edi + 4]
push ecx
mov ecx, eax
mov edx, dword [edx]
call edx
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4668e3
call fcn.004021c0
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [edi + 4]
lea edx, [eax + eax + 2]
push edx
add edi, 0x10
push edi
lea eax, [eax + eax + 2]
push eax
add ecx, 0x10
push ecx
call fcn.00554d08
add esp, 0x10
mov edi, dword [ebp - 0x1c]
add edi, 0x10
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x24]
push ecx
push 3
push ebx
mov ecx, esi
call fcn.00401a50
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x24]
call fcn.00404d60
mov edx, dword [ebp - 0x108]
push edx
push 4
push ebx
mov ecx, esi
call fcn.00401a50
inc ebx
mov dword [ebp - 0x84], ebx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x14]
call fcn.00404d60
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x68]
call fcn.00404d60
jmp 0x46696a
inc eax
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10c]
call fcn.00463830
add dword [ebp - 0x54], 0x34
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x3c]
jmp 0x4666b0
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
lea ecx, [esi + 0x24]
call fcn.00432140
lea ecx, [esi + 0x2e4]
call fcn.004940c0
lea ecx, [esi + 0x2e4]
call fcn.00494150
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00404d60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00465ee0
mov eax, dword [ebp - 0x78]
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret