Function at 0x40c5d2
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x52ec
call fcn.00571a00
mov eax, dword [0x601ff0]
xor eax, esp
mov dword [esp + 0x52e8], eax
push ebx
push esi
push edi
mov esi, 0x5d277c
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x20]
xor ebx, ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x24]
push ebx
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x40c8d3
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x4d0]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40c631
lea edi, [esp + 0x4d0]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40c64a
push 0x14
pop ecx
mov esi, str.MicrosoftWindowsApplication_Shortcuts
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movsw word es:[edi], word [esi]
movzx eax, word [esp + ecx + 0x4d0]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x33ae], ax
test ax, ax
jne 0x40c664
lea edi, [esp + 0x33b0]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40c686
mov esi, str..
lea eax, [esp + 0x280]
push eax
lea eax, [esp + 0x33b4]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x40c8c9
push 0x2e
pop eax
test byte [esp + 0x280], 0x10
je 0x40c89c
cmp word [esp + 0x2ac], ax
je 0x40c89c
xor ebx, ebx
mov ecx, ebx
movzx eax, word [esp + ecx + 0x4d0]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x146e], ax
test ax, ax
jne 0x40c6e3
lea edi, [esp + 0x1470]
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x40c705
mov eax, dword [0x5d8e78]
lea edx, [esp + 0x2ac]
mov dword [edi], eax
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x40c721
lea edi, [esp + 0x1470]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40c738
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
movzx eax, word [esp + ecx + 0x1470]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x434e], ax
test ax, ax
jne 0x40c754
lea edi, [esp + 0x4350]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40c776
mov esi, str..
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x4354]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c898
test byte [esp + 0x30], 0x10
jne 0x40c875
push 0x2e
pop eax
cmp word [esp + 0x5c], ax
je 0x40c875
xor ecx, ecx
movzx eax, word [esp + ecx + 0x1470]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x240e], ax
test ax, ax
jne 0x40c7c4
lea edi, [esp + 0x2410]
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, cx
jne 0x40c7e8
mov eax, dword [0x5d8e78]
lea edx, [esp + 0x5c]
mov dword [edi], eax
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x40c801
lea edi, [esp + 0x2410]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x40c818
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xca0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
push ecx
lea ecx, [esp + 0x2418]
call fcn.0040c526
cmp word [esp + 0xca8], 0
pop ecx
pop ecx
je 0x40c875
sub esp, 0xc
lea eax, [esp + 0xcac]
push 0x3e7
push ecx
mov ecx, esp
push eax
call fcn.00403242
mov ecx, dword [esp + 0x2c]
call fcn.0041e961
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c7a0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or ebx, 0xffffffff
jmp 0x40c7a0
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x280]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c8bd
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
push 0x2e
pop eax
cmp ebx, 0xffffffff
jne 0x40c6c3
push dword [esp + 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x52f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00570fd6
mov esp, ebp
pop ebp
ret