Function at 0x402010
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x760
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x75c], eax
mov eax, dword [esp + 0x764]
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
push 0x104
lea ecx, [esp + 0x15c]
push ecx
mov dword [esp + 0x14], eax
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x158]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, esi
test al, al
jne 0x402058
mov dx, word [0x4254b4]
lea eax, [esp + 0x158]
mov word [edi], dx
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x402075
mov ecx, dword [0x42550c]
mov dl, byte [0x425510]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x158]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4020a0
sub eax, edx
mov dword [esp + 0x14], eax
xor eax, eax
mov cl, byte [esp + eax + 0x158]
mov byte [esp + eax + 0x260], cl
add eax, 1
test cl, cl
jne 0x4020b1
lea eax, [esp + 0x158]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4020d0
mov ecx, dword [str.OEM]
mov dl, byte [0x42564c]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x158]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4020f5
mov ecx, dword [str..INF]
mov dl, byte [0x425508]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402271
mov edi, edi
test esi, esi
je 0x402271
test byte [esp + 0x18], 0x10
jne 0x40225e
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x44]
mov byte [esp + edx + 0x260], 0
mov ecx, eax
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x402155
lea edi, [esp + 0x260]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
lea esp, [esp]
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402170
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x260]
and ecx, 3
push 0x425644
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0040712f
mov esi, eax
add esp, 8
test esi, esi
je 0x40225e
push esi
lea ecx, [esp + 0x36c]
push 0x400
push ecx
xor edi, edi
call fcn.00406ee4
add esp, 0xc
test eax, eax
je 0x4021fd
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x36c]
push eax
call fcn.004063e0
add esp, 8
test eax, eax
jne 0x4021f8
push esi
lea ecx, [esp + 0x36c]
push 0x400
push ecx
call fcn.00406ee4
add esp, 0xc
test eax, eax
jne 0x4021c3
jmp 0x4021fd
mov edi, 1
push esi
call fcn.00406e68
add esp, 4
test edi, edi
je 0x40225e
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x260]
push edx
mov ecx, edi
call fcn.00401fc0
lea eax, [esp + 0x260]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402227
sub eax, edx
lea esi, [esp + eax + 0x25d]
movsx eax, byte [esi]
push eax
call fcn.004068ef
add esp, 4
neg eax
sbb al, al
and al, 0xe0
lea ecx, [esp + 0x260]
add al, 0x70
push ecx
mov ecx, edi
mov byte [esi], al
call fcn.00401fc0
lea edx, [esp + 0x18]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, eax
jmp 0x402130
mov ecx, dword [esp + 0x768]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00405d7a
add esp, 0x760
ret 4