Function at 0x564660
Capabilities:
Enumerate files on windows
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb16b
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a4], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push 0
push 0
push 0x104
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x14], 0x104
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
xor ebx, ebx
lea ecx, [ebp - 0x2c]
push ebx
push ebx
push 0x104
mov dword [ebp - 0x2a0], ebx
call fcn.005db9a0
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
je 0x5649ea
sub esp, 0xc
lea ecx, [ebp - 0x38]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.TEMP.
call fcn.005da510
lea ecx, [ebx + 1]
call fcn.0059e240
mov esi, eax
mov dword [ebp - 0x29c], esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x6249f8
push ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.005da0a0
mov ecx, eax
call fcn.005da780
push 0x260
lea eax, [ebp - 0x298]
push ebx
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push 0x250
mov edi, eax
lea eax, [ebp - 0x298]
push ebx
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x298]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, eax
mov dword [ebp - 0x48], edx
cmp edx, 0xffffffff
je 0x564858
mov ecx, 5
mov dword [ebp - 0x44], ecx
cmp word [ebp - 0x26c], 0x2e
jne 0x564808
mov ax, word [ebp - 0x26a]
test ax, ax
je 0x564832
cmp ax, 0x2e
jne 0x564808
cmp word [ebp - 0x268], 0
je 0x564832
test ecx, ecx
je 0x564858
mov eax, dword [ebp - 0x298]
test cl, 1
je 0x56481e
test eax, 0x400
jne 0x564832
test cl, 2
je 0x564829
test al, 0x10
je 0x564858
jmp 0x564832
test cl, 4
je 0x564858
test al, 0x10
jne 0x564858
lea eax, [ebp - 0x298]
push eax
push edx
call edi
test eax, eax
je 0x564848
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
jmp 0x5647e2
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x48], 0xffffffff
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005dadc0
cmp dword [ebp - 0x48], 0xffffffff
je 0x564955
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc510
push str.TEMP
lea ecx, [ebp - 0x20]
call fcn.005dc480
test al, al
je 0x5648b2
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005daa70
cmp eax, 1
jne 0x56492c
sub esp, 0xc
lea ecx, [ebp - 0x2c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
ret
js 0x5648d3
add byte [eax - 0x73], dl
dec ebp
loopne 0x5648ba
cmp bl, byte [edi + eax]
xor edi, edi
cmp dword [esi], edi
jbe 0x564900
xor ebx, ebx
nop
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x20]
add ecx, ebx
push eax
call fcn.005dc4a0
test al, al
jne 0x564920
inc edi
add ebx, 0xc
cmp edi, dword [esi]
jb 0x5648e0
mov ebx, dword [ebp - 0x2a0]
push 3
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.005771e0
neg eax
sbb eax, eax
neg eax
add ebx, eax
mov dword [ebp - 0x2a0], ebx
jmp 0x564926
mov ebx, dword [ebp - 0x2a0]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
je 0x564955
lea ecx, [ebp - 0x298]
push ecx
push eax
call edi
test eax, eax
je 0x56498d
lea ecx, [ebp - 0x298]
call fcn.004011a0
test al, al
jne 0x564870
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x2a4]
push 0
push 1
call fcn.005494d0
test eax, eax
mov eax, dword [ebp - 0x48]
je 0x5649a1
cmp eax, 0xffffffff
je 0x564979
push eax
call edi
test esi, esi
je 0x564985
push ecx
mov ecx, esi
call fcn.00402a20
or ebx, 0xffffffff
jmp 0x564a04
push dword [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
call edi
mov dword [ebp - 0x48], 0xffffffff
jmp 0x56495b
cmp eax, 0xffffffff
je 0x5649a9
push eax
call edi
mov byte [ebp - 4], 2
test esi, esi
je 0x5649b9
push ecx
mov ecx, esi
call fcn.00402a20
test ebx, ebx
je 0x5649ea
push ebx
lea ecx, [ebp - 0x20]
call fcn.005db320
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov esi, 0x648020
cmp ebx, 1
mov ecx, 0x62439c
mov edx, str._temporary_folder
cmovne ecx, esi
mov esi, str._successfully_deleted.
jmp 0x5649f5
xor edx, edx
xor ecx, ecx
mov eax, str.No_temporary_profile_folders_were_found_to_delete.
xor esi, esi
push esi
push ecx
mov ecx, dword [ebp - 0x2a4]
push edx
push eax
call fcn.0057b7e0
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret