Function at 0x4f63fc
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x26c], edi
mov ecx, 0x502528
call fcn.004f6839
push 0x414
xor ebx, ebx
push ebx
push edi
test al, al
je 0x4f650a
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x264], ebx
lea ecx, [ebp - 0x264]
call fcn.004f6799
push eax
push 1
push 0x41ca58
push 0x41c9f8
push esi
call dword [sym.imp.DismApi.DLL_DismGetFeatureInfo]
mov esi, eax
test esi, esi
jns 0x4f6482
push 0x41ca3c
push esi
push 0x41ca98
push 0x1c
jmp 0x4f64dc
mov eax, dword [ebp - 0x264]
cmp dword [eax + 4], 4
jne 0x4f64f3
push 0x41ca58
mov edx, 0x105
mov ecx, edi
call fcn.0041f6cc
mov esi, eax
test esi, esi
jns 0x4f64b4
push 0x41ca70
push esi
push 0x41ca98
push 0x20
jmp 0x4f64dc
push 0x41c9f8
lea ecx, [edi + 0x20a]
mov edx, 0x105
call fcn.0041f6cc
mov esi, eax
test esi, esi
jns 0x4f64e9
push 0x41cb88
push esi
push 0x41ca98
push 0x21
push dword [ebp + 4]
call fcn.004f639b
add esp, 0x14
jmp 0x4f64eb
mov esi, ebx
mov eax, dword [ebp - 0x264]
jmp 0x4f64f8
mov esi, 0x80070002
test eax, eax
je 0x4f6503
push eax
call dword [sym.imp.DismApi.DLL_DismDelete]
mov eax, esi
jmp 0x4f6782
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x264], ebx
lea eax, [ebp - 0x264]
push eax
push ebx
push ebx
push 0x40e16c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edi, eax
test edi, edi
jns 0x4f654f
push 0x41cbd8
push edi
push 0x41ca98
push 0x33
push dword [ebp + 4]
call fcn.004f639b
add esp, 0x14
jmp 0x4f676c
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], ebx
push eax
push ebx
push 0x41caf0
push dword [ebp - 0x264]
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCombine]
mov edi, eax
test edi, edi
jns 0x4f6591
push 0x41cbac
push edi
push 0x41ca98
push 0x36
push dword [ebp + 4]
call fcn.004f639b
add esp, 0x14
jmp 0x4f6758
push 0x250
lea eax, [ebp - 0x25c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f672f
test esi, esi
je 0x4f672f
mov edi, dword [ebp - 0x260]
push 0x41cc08
push 0x104
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveExtension]
push eax
push 0x41ca98
push 0x3e
push dword [ebp + 4]
call fcn.004f63c7
add esp, 0x14
test eax, eax
js 0x4f6666
push 0x41ca3c
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x260], ebx
call fcn.004f6799
push eax
push 1
lea eax, [ebp - 0x230]
push eax
push 0x41c9f8
push edi
call dword [sym.imp.DismApi.DLL_DismGetFeatureInfo]
push eax
push 0x41ca98
push 0x44
push dword [ebp + 4]
call fcn.004f63c7
add esp, 0x14
test eax, eax
jns 0x4f6653
cmp dword [ebp - 0x260], ebx
je 0x4f6666
push dword [ebp - 0x260]
jmp 0x4f6660
mov eax, dword [ebp - 0x260]
cmp dword [eax + 4], 4
je 0x4f66a9
push eax
call dword [sym.imp.DismApi.DLL_DismDelete]
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4f65d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x4f6728
push 0x41cc40
push 0x41ca98
push 0x52
push dword [ebp + 4]
call fcn.004f61fa
add esp, 0x10
mov edi, eax
jmp 0x4f6751
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x230]
push eax
mov edx, 0x105
call fcn.0041f6cc
mov edi, eax
test edi, edi
jns 0x4f66d5
push 0x41ca70
push edi
push 0x41ca98
push 0x4b
jmp 0x4f6703
mov ecx, dword [ebp - 0x26c]
mov edx, 0x105
push 0x41c9f8
lea ecx, [ecx + 0x20a]
call fcn.0041f6cc
mov edi, eax
test edi, edi
jns 0x4f6710
push 0x41cb88
push edi
push 0x41ca98
push 0x4c
push dword [ebp + 4]
call fcn.004f639b
add esp, 0x14
jmp 0x4f6712
mov edi, ebx
cmp dword [ebp - 0x260], ebx
je 0x4f6751
push dword [ebp - 0x260]
call dword [sym.imp.DismApi.DLL_DismDelete]
jmp 0x4f6751
mov edi, 0x80070002
jmp 0x4f6751
push 0x41cc28
push 0x41ca98
push 0x3a
push dword [ebp + 4]
call fcn.004f61fa
add esp, 0x10
mov edi, eax
cmp esi, 0xffffffff
je 0x4f6758
test esi, esi
je 0x4f6758
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x268], ebx
je 0x4f676c
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x264], ebx
je 0x4f6780
push dword [ebp - 0x264]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret 4