Function at 0x403712
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xba8
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x643]
push ebx
push eax
mov byte [ebp - 0x644], bl
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x644]
push eax
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
je 0x403a2f
push esi
lea eax, [ebp - 0x53b]
push ebx
push eax
mov byte [ebp - 0x53c], bl
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..
lea eax, [ebp - 0x53c]
push eax
call edi
push esi
lea eax, [ebp - 0x11b]
push ebx
push eax
mov byte [ebp - 0x11c], bl
call fcn.0040a870
push esi
lea eax, [ebp - 0x32b]
push ebx
push eax
mov byte [ebp - 0x32c], bl
call fcn.0040a870
push esi
lea eax, [ebp - 0x433]
push ebx
push eax
mov byte [ebp - 0x434], bl
call fcn.0040a870
add esp, 0x24
lea eax, [ebp - 0x32c]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x434]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x4112c8
lea eax, [ebp - 0x11c]
push eax
call edi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov edi, eax
lea eax, [ebp - 0x32c]
sub edi, eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea ecx, [ebp - 0x434]
sub eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 8]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp edi, ebx
jbe 0x403a2f
cmp ecx, ebx
jbe 0x403a2f
push esi
lea eax, [ebp - 0x853]
push ebx
push eax
mov byte [ebp - 0x854], bl
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x403a2b
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push esi
lea eax, [ebp - 0x223]
push ebx
push eax
mov byte [ebp - 0x224], bl
call fcn.0040a870
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x644]
push eax
push 0x4112c0
lea eax, [ebp - 0x224]
push 0x104
push eax
call edi
add esp, 0x20
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x403a09
cmp byte [ebp - 0x968], 0x2e
je 0x403a09
mov eax, dword [ebp - 0x10]
lea eax, [ebp + eax - 0x32c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x411648
lea eax, [ebp - 0xa9c]
push 0x104
push eax
call edi
mov eax, dword [ebp - 0x14]
lea eax, [ebp + eax - 0x434]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x411648
lea eax, [ebp - 0x74c]
push 0x104
push eax
call edi
add esp, 0x28
lea eax, [ebp - 0xa9c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4039a3
cmp byte [ebp + 8], bl
jne 0x4039a3
lea eax, [ebp - 0xa9c]
push eax
call fcn.00401ad2
pop ecx
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403a09
lea eax, [ebp - 0x74c]
push eax
push str._sGoogleChromeUser_DataDefaultPreferences
lea eax, [ebp - 0x854]
push 0x104
push eax
call fcn.004058c6
lea eax, [ebp - 0x74c]
push eax
push str._sGoogleChromeUser_DataDefaultExtensions
lea eax, [ebp - 0xba4]
push 0x104
push eax
call fcn.004058c6
lea eax, [ebp - 0x854]
push eax
call fcn.00402044
lea eax, [ebp - 0xba4]
push eax
call fcn.004021cb
add esp, 0x28
lea eax, [ebp - 0x994]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4038d9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x403a31
xor al, al
pop edi
pop esi
pop ebx
leave
ret