Function at 0x41133c
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x634
mov eax, 0x478e2b
call fcn.00450887
mov dword [ebp - 0x594], ecx
push 0x208
xor ebx, ebx
push ebx
lea eax, [ebp - 0x220]
push eax
call fcn.00452e20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41189f
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.0040724b
mov dword [ebp - 4], ebx
mov esi, str.PerformanceWinSATDataStore_
push esi
call fcn.00459e88
pop ecx
push eax
push esi
lea ecx, [ebp - 0x250]
call fcn.0040751f
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x280]
call fcn.00407283
mov byte [ebp - 4], 1
mov esi, 0x49397c
push esi
call fcn.00459e88
pop ecx
push eax
push esi
lea ecx, [ebp - 0x280]
call fcn.0040751f
push 0x250
push ebx
lea eax, [ebp - 0x570]
push eax
call fcn.00452e20
add esp, 0xc
lea eax, [ebp - 0x570]
push eax
lea ecx, [ebp - 0x280]
call fcn.004071ba
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41141c
mov byte [ebp - 4], bl
jmp 0x411885
lea ecx, [ebp - 0x298]
call fcn.00407270
mov byte [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x5a0], xmm0
mov edi, dword [ebp - 0x59c]
mov ebx, dword [ebp - 0x5a0]
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x268]
call fcn.00407283
mov byte [ebp - 4], 3
cmp word [ebp - 0x544], 0
jne 0x411466
xor eax, eax
jmp 0x411473
lea eax, [ebp - 0x544]
push eax
call fcn.00459e88
pop ecx
push eax
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x268]
call fcn.0040751f
test byte [ebp - 0x570], 0x10
jne 0x411505
push str.Formal
call fcn.00459e88
pop ecx
push eax
push 0
push str.Formal
lea ecx, [ebp - 0x268]
call fcn.0040e455
cmp eax, 0xffffffff
je 0x411505
lea eax, [ebp - 0x2bc]
push eax
push 0
lea ecx, [ebp - 0x268]
call fcn.004071ba
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x411505
cmp dword [ebp - 0x2ac], edi
jl 0x411505
jg 0x4114e3
cmp dword [ebp - 0x2b0], ebx
jbe 0x411505
mov ebx, dword [ebp - 0x2b0]
mov edi, dword [ebp - 0x2ac]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x298]
call fcn.0040748a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x268]
call fcn.00407241
lea eax, [ebp - 0x570]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411442
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x298]
call fcn.0043c27a
mov dword [ebp - 0x580], eax
mov byte [ebp - 4], 5
and dword [ebp - 0x22c], 0
and dword [ebp - 0x228], 0
and dword [ebp - 0x224], 0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x580]
call fcn.0043c84d
xor esi, esi
mov dword [ebp - 0x57c], esi
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
sub eax, ecx
sar eax, 2
cmp esi, eax
jae 0x41179b
mov edi, dword [ecx + esi*4]
lea eax, [ebp - 0x2d4]
push eax
mov ecx, edi
call fcn.0043ca14
mov byte [ebp - 4], 7
mov edx, str.WinSPR
mov ecx, eax
call fcn.0040dfb7
mov bl, al
neg bl
sbb bl, bl
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2d4]
call fcn.00407241
add bl, 1
jne 0x411795
and dword [ebp - 0x58c], 0
and dword [ebp - 0x588], 0
and dword [ebp - 0x584], 0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x58c]
push eax
mov ecx, edi
call fcn.0043c84d
xor edi, edi
mov dword [ebp - 0x598], edi
mov eax, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x58c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x411780
mov eax, dword [ecx + edi*4]
mov dword [ebp - 0x590], eax
lea ecx, [ebp - 0x2ec]
push ecx
mov ecx, eax
call fcn.0043ca4c
mov byte [ebp - 4], 9
mov ecx, eax
call fcn.00408dcd
mov bl, al
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2ec]
call fcn.00407241
test bl, bl
jne 0x41177a
push 0x30
call fcn.0045029a
pop ecx
mov esi, eax
mov dword [ebp - 0x59c], esi
mov ecx, esi
call fcn.00407270
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x18]
call fcn.00407270
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 8
mov dword [ebp - 0x574], esi
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp - 0x590]
call fcn.0043ca14
mov byte [ebp - 4], 0xd
push eax
mov ecx, dword [ebp - 0x574]
call fcn.0041508c
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x304]
call fcn.00407241
lea eax, [ebp - 0x31c]
push eax
mov ecx, dword [ebp - 0x590]
call fcn.0043ca4c
mov byte [ebp - 4], 0xe
push eax
mov ecx, dword [ebp - 0x574]
lea ecx, [ecx + 0x18]
call fcn.0041508c
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x31c]
call fcn.00407241
mov ecx, dword [ebp - 0x574]
mov dword [ebp - 0x578], ecx
mov esi, dword [ebp - 0x594]
add esi, 0x19f4
mov eax, dword [esi + 4]
lea edx, [ebp - 0x578]
cmp edx, eax
jae 0x41173f
cmp dword [esi], edx
ja 0x41173f
mov ebx, edx
sub ebx, dword [esi]
sar ebx, 2
cmp eax, dword [esi + 8]
jne 0x41172f
push ecx
mov ecx, esi
call fcn.004167ec
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
je 0x41175b
mov eax, dword [eax + ebx*4]
mov dword [ecx], eax
jmp 0x41175b
cmp eax, dword [esi + 8]
jne 0x411752
push ecx
mov ecx, esi
call fcn.004167ec
mov ecx, dword [ebp - 0x578]
mov eax, dword [esi + 4]
test eax, eax
je 0x41175b
mov dword [eax], ecx
add dword [esi + 4], 4
and dword [ebp - 0x574], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x574]
test ecx, ecx
je 0x41177a
push ecx
call fcn.00416c7f
inc edi
jmp 0x4115fe
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58c]
call fcn.0040ed12
mov esi, dword [ebp - 0x57c]
inc esi
jmp 0x411577
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x22c]
call fcn.0040ed12
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x580]
test ecx, ecx
je 0x4117be
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x298]
call fcn.00407241
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x280]
call fcn.00407241
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00407241
mov al, 1
jmp 0x4118a1
lea ecx, [ebp - 0x280]
call fcn.00407241
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00407241
xor al, al
call fcn.004507d4
ret