Function at 0x419cdf
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x768
mov eax, 0x46baf1
call fcn.0042dc0b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x76c]
mov dword [ebp - 0x774], eax
mov bl, 1
call fcn.0040699e
and dword [ebp - 4], 0
mov esi, 0x493f4c
push str.IN_Operations::_RemoveUserProfilePaths_:_Entering__RemoveUserProfilePaths__
mov ecx, esi
xor edi, edi
call fcn.0040c5a7
call fcn.00421b6a
test al, al
jne 0x419d43
push str.IN_Operations::_RemoveUserProfilePaths_:_This_is_not_NT_based_Windows__this_operation_is_unsupported
mov ecx, esi
call fcn.0040c5a7
push 2
push str.Operation_skipped
mov ecx, esi
call fcn.0040c5b8
jmp 0x41a0bd
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x419d6b
push 1
push 0x4701b4
mov esi, 0x104
lea eax, [ebp - 0x524]
push esi
push eax
call fcn.00438a3c
add esp, 0x10
jmp 0x419ed4
cmp eax, 1
jne 0x41a07d
push 0
push 0x23
lea eax, [ebp - 0x31c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x419da3
push str.IN_Operations::_RemoveUserProfilePaths_:_Unable_to_interpret_CSIDL_COMMON_APPDATA
mov ecx, esi
call fcn.0040c5a7
push 3
push 0x475634
jmp 0x41a0b4
lea eax, [ebp - 0x770]
mov esi, 0x104
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x770], esi
push eax
call dword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryA]
test eax, eax
jne 0x419e11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetAllUsersProfileDirectory___failed._Error:__d
lea eax, [ebp - 0x76c]
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x76c]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x419dfb
push dword [eax - 0xc]
lea ecx, [ebp - 0x76c]
call fcn.00406aae
push 7
push dword [ebp - 0x76c]
mov esi, 0x493f4c
mov ecx, esi
call fcn.0040c5b8
jmp 0x419d97
lea eax, [ebp - 0x218]
push eax
call fcn.00436130
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.004362e1
add esp, 0x10
test eax, eax
je 0x419e92
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x76c]
push str.IN_Operations::_RemoveUserProfilePaths_:_All_Users_profile_directory___s__is_not_a_prefix_of_CSIDL_COMMON_APPDATA___s_
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x76c]
add esp, 0x10
cmp dword [eax - 4], 1
jle 0x419e74
push dword [eax - 0xc]
lea ecx, [ebp - 0x76c]
call fcn.00406aae
push dword [ebp - 0x76c]
mov esi, 0x493f4c
mov ecx, esi
call fcn.0040c5a7
push 3
push str.Unable_to_retrieve_correct_folder
jmp 0x41a0b4
lea eax, [ebp - 0x218]
push eax
call fcn.00436130
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.00438c40
add esp, 0xc
test eax, eax
jne 0x419ec3
push 5
push str.IN_Operations::_RemoveUserProfilePaths_:_Unable_to_increment_pointer_to_get_relative_base_path
mov esi, 0x493f4c
jmp 0x41a0b4
push eax
lea eax, [ebp - 0x524]
push esi
push eax
call fcn.004360d6
add esp, 0xc
lea eax, [ebp - 0x770]
mov dword [ebp - 0x770], esi
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
jne 0x419f03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProfilesDirectory___failed._Error:__d
jmp 0x419dd2
push str..
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push 0x471a0c
push eax
call fcn.00412f5b
add esp, 0x10
lea eax, [ebp - 0x768]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41a006
mov bh, byte [ebp + 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
cmp byte [ebp - 0x73c], 0x2e
je 0x419fef
lea eax, [ebp - 0x73c]
push eax
push 0x46f9b8
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x114]
push 0x473288
push eax
call fcn.00412f5b
add esp, 0x14
test byte [ebp - 0x768], 0x10
je 0x419fef
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x114]
push eax
call esi
push dword [ebp - 0x774]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x114]
push eax
test bh, bh
je 0x419fda
call fcn.004182aa
pop ecx
test al, al
jne 0x419fe6
xor bl, bl
jmp 0x419fe6
call fcn.0041891a
neg al
pop ecx
sbb al, al
and bl, al
call fcn.00413e75
test al, al
jne 0x41a06a
lea eax, [ebp - 0x768]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x419f4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x41a071
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x76c]
push str.IN_Operations::_RemoveUserProfilePaths_:_Unexpected_error__not_all_specified_files_are_removed_under_directory__s
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x76c]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41a046
push dword [eax - 0xc]
lea ecx, [ebp - 0x76c]
call fcn.00406aae
push dword [ebp - 0x76c]
mov esi, 0x493f4c
mov ecx, esi
call fcn.0040c5a7
push 3
push str.Unable_to_iterate_through_all_users_profile_directories
mov ecx, esi
call fcn.0040c5b8
xor bl, bl
jmp 0x41a076
mov esi, 0x493f4c
jmp 0x41a0bb
mov esi, 0x493f4c
cmp edi, 0xffffffff
je 0x41a0c4
jmp 0x41a0bd
push eax
lea eax, [ebp - 0x76c]
push str.IN_Operations::_RemoveUserProfilePaths_:_Unsupported_user_profile_base_folder__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x76c]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41a0ac
push dword [eax - 0xc]
lea ecx, [ebp - 0x76c]
call fcn.00406aae
push 5
push dword [ebp - 0x76c]
mov ecx, esi
call fcn.0040c5b8
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00413e75
test al, al
je 0x41a0dd
push 3
push str.Error:_Insufficient_Memory
mov ecx, esi
call fcn.0040c5b8
xor bl, bl
mov ecx, dword [ebp - 0x76c]
add ecx, 0xfffffff0
call fcn.00406c57
mov al, bl
call fcn.0042dbb5
ret