Function at 0x1001f980
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002409f
mov eax, dword fs:[0]
push eax
add esp, 0xfffffab0
mov eax, dword [0x1002b134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.1000c060
add esp, 0xc
push 1
push 0x23
lea ecx, [ebp - 0x224]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x504]
call fcn.10003420
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x524], eax
mov dword [ebp - 4], 0
push str.TencentQQPCMgr_
mov ecx, dword [ebp - 0x524]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.10005d30
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x504]
call fcn.10005cb0
push str.QQPCUninst_.log
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x228]
push ecx
call fcn.10005d30
sub esp, 0xfffffff4
mov byte [ebp - 4], 3
lea edx, [ebp - 0x484]
push edx
lea ecx, [ebp - 0x228]
call fcn.100061c0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0xffffffff
je 0x1001fc73
mov dword [ebp - 0x4b4], 0
lea ecx, [ebp - 0x22c]
lea edx, [ebp - 0x50c]
lea eax, [ebp - 0x458]
mov dword [ebp - 0x4b0], 0
push eax
push ecx
push edx
call fcn.10005d30
mov dword [ebp - 0x528], eax
sub esp, 0xfffffff4
lea eax, [ebp - 0x4ac]
push eax
push 0
mov ecx, dword [ebp - 0x528]
call fcn.100061c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea ecx, [ebp - 0x50c]
mov dword [ebp - 0x508], eax
call fcn.10005cb0
cmp dword [ebp - 0x508], 0
je 0x1001fb1c
lea ecx, [ebp - 0x4b4]
push ecx
mov edx, dword [ebp - 0x494]
push edx
mov eax, dword [ebp - 0x498]
push eax
call fcn.1001f140
sub esp, 0xfffffff4
lea ecx, [ebp - 0x484]
push ecx
mov edx, dword [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1001fbe8
lea eax, [ebp - 0x458]
lea ecx, [ebp - 0x22c]
push eax
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.10005d30
add esp, 0xc
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x4ac]
push eax
push 0
mov ecx, dword [ebp - 0x52c]
call fcn.100061c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea ecx, [ebp - 0x514]
mov dword [ebp - 0x510], eax
call fcn.10005cb0
cmp dword [ebp - 0x510], 0
je 0x1001fbe3
lea ecx, [ebp - 0x4bc]
push ecx
mov edx, dword [ebp - 0x494]
push edx
mov eax, dword [ebp - 0x498]
push eax
call fcn.1001f140
mov edx, dword [ebp - 0x4b8]
sub esp, 0xfffffff4
cmp edx, dword [ebp - 0x4b0]
jl 0x1001fbe3
jg 0x1001fbcb
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0x4b4]
jbe 0x1001fbe3
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4b0], ecx
jmp 0x1001fb1c
cmp dword [ebp - 0x4b0], 0
jl 0x1001fc64
jg 0x1001fbfc
cmp dword [ebp - 0x4b4], 0
jbe 0x1001fc64
mov eax, dword [ebp + 8]
imul eax, eax, 0x18
imul eax, eax, 0xe10
cdq
mov esi, eax
add esi, dword [ebp - 0x4b4]
mov edi, dword [ebp - 0x4b0]
push 0
adc edi, edx
call fcn.1000c961
sub esp, 0xfffffffc
cdq
mov dword [ebp - 0x534], esi
mov dword [ebp - 0x530], edi
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x538], edx
mov edx, dword [ebp - 0x530]
cmp edx, dword [ebp - 0x538]
jg 0x1001fc64
jl 0x1001fc5a
mov eax, dword [ebp - 0x534]
cmp eax, dword [ebp - 0x53c]
ja 0x1001fc64
mov dword [ebp - 0x234], 1
mov ecx, dword [ebp - 0x488]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1001fc82
mov edx, dword [ebp - 0x230]
or edx, 1
mov dword [ebp - 0x230], edx
cmp dword [ebp - 0x234], 0
jne 0x1001fddf
lea eax, [ebp - 0x4dc]
push eax
call fcn.1001efa0
mov byte [ebp - 4], 4
add esp, 4
push str.TencentUninstTime.dat
lea ecx, [ebp - 0x4dc]
call fcn.1001e8f0
lea ecx, [ebp - 0x4c0]
call fcn.100013c0
lea ecx, [ebp - 0x4dc]
mov byte [ebp - 4], 5
call fcn.1001e690
push eax
call fcn.1001ec50
lea ecx, [ebp - 0x4c0]
add esp, 4
mov dword [ebp - 0x4e0], eax
mov edi, dword [ebp - 0x4e0]
push edi
call fcn.10005cd0
cmp dword [ebp - 0x4e0], 0
je 0x1001fd11
mov edx, dword [ebp - 0x4e0]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
push eax
call fcn.1000c535
add esp, 4
lea ecx, [ebp - 0x4c0]
call fcn.10005cf0
movzx ebx, al
test ebx, ebx
jne 0x1001fdb2
lea ecx, [ebp - 0x4c0]
call fcn.100061c0
push eax
call fcn.1000c99a
sub esp, 0xfffffffc
cdq
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4e8], edx
mov eax, dword [ebp + 8]
imul eax, eax, 0x18
imul eax, eax, 0xe10
cdq
mov edi, dword [ebp - 0x4e8]
mov ebx, eax
add ebx, dword [ebp - 0x4ec]
push 0
adc edi, edx
call fcn.1000c961
add esp, 4
cdq
mov dword [ebp - 0x544], ebx
mov dword [ebp - 0x540], edi
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x548], edx
mov edx, dword [ebp - 0x540]
cmp edx, dword [ebp - 0x548]
jg 0x1001fdb0
jl 0x1001fda6
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0x54c]
ja 0x1001fdb0
mov dword [ebp - 0x234], 1
jmp 0x1001fdc1
mov ebx, dword [ebp - 0x230]
or ebx, 2
mov dword [ebp - 0x230], ebx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4c0]
call fcn.10005cb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4dc]
call fcn.10005b20
cmp dword [ebp - 0x234], 0
jne 0x1001ff23
lea ecx, [ebp - 0x4f0]
call fcn.10005b40
push 1
push str.SoftwareTencentReport
lea ecx, [ebp - 0x4f0]
push 0x80000002
call fcn.10005b80
or eax, eax
je 0x1001ff09
mov dword [ebp - 0x4f4], 0
lea edx, [ebp - 0x4f4]
push edx
push str.LastQMUninstTime
lea ecx, [ebp - 0x4f0]
call fcn.10005c30
cmp dword [ebp - 0x4f4], 0
je 0x1001fef8
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x4fc], eax
xor ecx, ecx
mov dword [ebp - 0x4f8], ecx
push 0
call fcn.1000c961
add esp, 4
cdq
sub eax, dword [ebp - 0x4fc]
sbb edx, dword [ebp - 0x4f8]
mov ecx, 0xe10
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
xor edx, edx
div ecx
mov dword [ebp - 0x500], eax
mov edx, dword [ebp - 0x4f4]
mov ebx, dword [ebp - 0x4f8]
imul edx, edx, 0x18
imul edx, edx, 0xe10
mov esi, edx
xor eax, eax
add esi, dword [ebp - 0x4fc]
adc ebx, eax
push 0
call fcn.1000c961
add esp, 4
cdq
mov dword [ebp - 0x554], esi
mov dword [ebp - 0x550], ebx
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x558], edx
mov esi, dword [ebp - 0x550]
cmp esi, dword [ebp - 0x558]
jg 0x1001fef6
jl 0x1001feec
mov edx, dword [ebp - 0x554]
cmp edx, dword [ebp - 0x55c]
ja 0x1001fef6
mov dword [ebp - 0x234], 1
jmp 0x1001ff07
mov eax, dword [ebp - 0x230]
or eax, 4
mov dword [ebp - 0x230], eax
jmp 0x1001ff18
mov edi, dword [ebp - 0x230]
or edi, 4
mov dword [ebp - 0x230], edi
lea ecx, [ebp - 0x4f0]
call fcn.10005b60
cmp dword [ebp - 0x234], 0
jne 0x1001ff3f
cmp dword [ebp - 0x230], 7
jne 0x1001ff3f
mov dword [ebp - 0x234], 1
lea ecx, [ebp - 0x228]
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x51c], edx
mov byte [ebp - 4], 2
call fcn.10005cb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.10005cb0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x51c]
mov dword fs:[0], ebx
mov ecx, dword [ebp - 0x10]
pop ebx
pop edi
pop esi
xor ecx, ebp
call fcn.1000bda4
mov esp, ebp
pop ebp
ret