Function at 0x413313
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x758
lea ebp, [esp - 4]
mov eax, dword [0x44bd40]
xor eax, ebp
mov dword [ebp + 0x758], eax
push 0x50
mov eax, 0x43a0d2
call fcn.0042501a
mov edi, dword [ebp + 0x764]
test edi, edi
mov eax, dword [ebp + 0x770]
mov esi, dword [ebp + 0x76c]
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], eax
je 0x4133b4
push 0x43d9b0
push edi
call fcn.0042569a
test eax, eax
pop ecx
pop ecx
jne 0x413377
push 0x43c67c
push edi
call fcn.0042569a
test eax, eax
pop ecx
pop ecx
je 0x4133b4
cmp dword [ebx + 0x178], 0
je 0x4133b4
lea eax, [ebx + 0x170]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401950
lea ecx, [ebp - 0x18]
call fcn.00401600
push edi
mov ecx, eax
call fcn.00401aa0
test eax, eax
jne 0x4133b4
mov eax, dword [ebp + 0x768]
cmp eax, dword [ebx + 4]
je 0x413423
test edi, edi
mov eax, dword [ebp + 0x768]
mov dword [ebx + 4], eax
je 0x41344b
push 0x43d9b0
push edi
call fcn.0042569a
test eax, eax
pop ecx
pop ecx
jne 0x4133e7
push 0x43c67c
push edi
call fcn.0042569a
test eax, eax
pop ecx
pop ecx
je 0x41344b
cmp dword [ebx + 0x178], 0
je 0x41344b
lea eax, [ebx + 0x170]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401950
lea ecx, [ebp - 0x18]
call fcn.00401600
push edi
mov ecx, eax
call fcn.00401aa0
test eax, eax
jne 0x41344b
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x758]
xor ecx, ebp
call fcn.00421e14
add ebp, 0x75c
leave
ret 0x10
lea ecx, [ebx + 0x164]
call fcn.00403890
lea ecx, [ebx + 0x170]
call fcn.00403890
lea ecx, [ebx + 0x158]
call fcn.00403890
lea ecx, [ebx + 0x17c]
call fcn.00403890
lea ecx, [ebx + 0x188]
call fcn.00403890
test esi, esi
lea ecx, [ebx + 0x1b0]
je 0x41348f
push esi
jmp 0x413494
push 0x43c600
call fcn.00403400
lea edi, [ebx + 0x14c]
mov eax, dword [edi + 4]
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.00411bb8
jmp 0x413515
lea ecx, [ebp - 0x20]
call fcn.00407685
cmp dword [eax + 0x18], 0x10
jb 0x4134c3
mov esi, dword [eax + 4]
jmp 0x4134c6
lea esi, [eax + 4]
lea ecx, [ebp - 0x20]
call fcn.00407685
mov eax, dword [eax + 0x1c]
add eax, 0x58
cmp dword [eax + 0x18], 0x10
jb 0x4134df
mov eax, dword [eax + 4]
jmp 0x4134e2
add eax, 4
push esi
push eax
push str.Deleting__s_for_key__s_n
push 0x44d160
call fcn.00406f12
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.00407685
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x41350d
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea ecx, [ebp - 0x20]
call fcn.00412a37
mov eax, dword [edi + 4]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.00411bb8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004119f7
test al, al
je 0x4134b0
mov ecx, edi
call fcn.00413243
mov edi, 0x103
push edi
lea eax, [ebp + 0x551]
push 0
push eax
mov byte [ebp + 0x550], 0
call fcn.00421e30
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x10], 0
je 0x413718
push 0x43d9b0
push dword [ebp - 0x10]
call fcn.0042569a
test eax, eax
pop ecx
pop ecx
jne 0x4136e5
push 0x43c67c
push dword [ebp - 0x10]
call fcn.0042569a
test eax, eax
pop ecx
pop ecx
jne 0x4136e5
push edi
push eax
mov byte [ebp + 0x654], al
lea eax, [ebp + 0x655]
push eax
call fcn.00421e30
push edi
lea eax, [ebp + 0x44d]
push 0
push eax
mov byte [ebp + 0x44c], 0
call fcn.00421e30
push esi
lea eax, [ebp + 0x44c]
push eax
push 0
call fcn.0040acb2
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
mov edi, 0x43c910
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00422cc0
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00401000
add esp, 0x40
test eax, eax
je 0x41363c
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.004033c0
xor esi, esi
lea eax, [ebp - 0x40]
inc esi
push eax
lea ecx, [ebx + 0x170]
mov dword [ebp - 4], esi
call fcn.0040be48
push 0
push esi
jmp 0x413707
lea eax, [ebp + 0x44c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00422cc0
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00401000
add esp, 0x1c
test eax, eax
je 0x41369d
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.004033c0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x170]
call fcn.0040be48
jmp 0x413703
push dword [ebp - 0x10]
lea eax, [ebp + 0x550]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00422cc0
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00401000
add esp, 0x1c
test eax, eax
je 0x413811
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.004033c0
mov dword [ebp - 4], 3
jmp 0x41368c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.004033c0
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x170]
call fcn.004046b0
push 0
push 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401ec0
jmp 0x413811
lea eax, [ebp + 0x550]
push eax
push str._shp_ins__.dat
lea eax, [ebp + 0x140]
push esi
push eax
call fcn.00422cc0
add esp, 0x10
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x413811
test byte [ebp], 0x10
jne 0x4137f3
push edi
lea eax, [ebp + 0x349]
push 0
push eax
mov byte [ebp + 0x348], 0
call fcn.00421e30
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x550]
push eax
push 0x43c910
lea eax, [ebp + 0x348]
push esi
push eax
call fcn.00422cc0
push edi
lea eax, [ebp + 0x245]
push 0
push eax
mov byte [ebp + 0x244], 0
call fcn.00421e30
add esp, 0x2c
push 0
lea eax, [ebp + 0x244]
push eax
push esi
lea eax, [ebp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp + 0x244]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004033c0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebx + 0x170]
mov dword [ebp - 4], 4
call fcn.004046b0
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.00401ec0
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413751
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp + 0x768], 1
je 0x413423
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x413426