Function at 0x4e483a
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x7c0
mov eax, 0x5564c3
call fcn.00514880
push 0x59
pop ecx
mov esi, str.s6iHzVQuDO6OpzBqDqKwduyvKeXMXEueqMUSlWbykJSmaFBm9iedrVt1JyE8LWE5Z6mcO83CRY8XBVNat2ckZt5WFgAXpJkptZbtLGE0QJYSzhSZpj1xnJyDqhpLNgNnHM1qooS46coaFd5hnAk8VSrf6ZftXUJzbyzgZxisVOLVgIcXpwXwRaqbxn7GwsSKQX6XJKCV7h14FWbUyCoZYHzcrQF12FzkkRP0IcXIjykSyjhIcuEywLrmFHBt5haDyKwm43AddSioZLsUolvhVI1gdzNzDZ6mNQ305Sgktibli8iQrMl8zGTLjQRsz2z6iGcvncJvOEm3MkhswPgpnmyRIoSiv0NTr9EyT7
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x380]
mov dword [ebp - 0x7c0], eax
rep movsd dword es:[edi], dword [esi]
push 0x6f
xor ebx, ebx
pop ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x7cc], ebx
mov dword [ebp - 0x7c8], ebx
mov dword [ebp - 0x7c4], ebx
movsb byte es:[edi], byte [esi]
mov esi, str.xAgdHQZVIrXG9gUBrCQkcscDwCjzJxXKL5OQqL7dp4RQ0TEdSTd6ljXoMRI6q0bO7V544BxVWfXqviPhHKKofZSwyz84qodEIohy8VZRE6sWTY1wNkpbkKLLSPDUe7fM37qbP04gAUEjFjKqC1F2bk7XkplRDfwS5zQ8Y452p535E5EA90tUvGrlM9nOSQTR8tBgIhaNdjLMQyyOVeuVxhoVUat9iZTLHAEMPeihqVEKcnSdMthpqn37LOIQhilA7Qf0uv4syn0un5vob4OwQ2sI2EOkMybivNWiYu2L25I0dLosvzsSMggQL8gDWmOF4TodRIT6Q3Bi1nYXyOW1dm0hu7STOYn2YVhBmDz5BRZ0U6NZemfqUBmY2P47iH3XTojg8N6DtKfcJYNACJczPDtlvVzf5HLGAvGg8qGMfA8baRLwz8tQn6GltWf
lea edi, [ebp - 0x53c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x380]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x554]
call fcn.004057d0
lea eax, [ebp - 0x554]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x7cc]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], bl
call fcn.00479e2e
lea eax, [ebp - 0x53c]
push eax
lea ecx, [ebp - 0x554]
call fcn.004057d0
lea eax, [ebp - 0x554]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x7cc]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], bl
call fcn.00479e2e
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004f14e0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x19
push eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x642824
test eax, eax
je 0x4e4ae4
lea eax, [ebp - 0x218]
push 0x6578fc
push eax
call fcn.00501716
and dword [ebp - 0x55c], 0
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x558], 7
mov word [ebp - 0x56c], ax
cmp word [ebp - 0x218], ax
je 0x4e497c
lea eax, [ebp - 0x218]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x56c]
call fcn.00402650
push esi
mov byte [ebp - 4], 3
call fcn.005017a9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x56c]
call fcn.00404240
cmp dword [ebp - 0x558], 8
lea ecx, [ebp - 0x7bc]
lea eax, [ebp - 0x56c]
cmovae eax, dword [ebp - 0x56c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e4ac9
mov ebx, dword [ebp - 0x7c0]
push 0x2e
pop edi
lea eax, [ebp - 0x7bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4e4abd
cmp word [ebp - 0x790], di
je 0x4e49dd
cmp word [ebp - 0x78e], 0
je 0x4e49dd
cmp word [ebp - 0x78e], di
jne 0x4e4a19
cmp word [ebp - 0x78c], 0
je 0x4e49dd
test byte [ebp - 0x7bc], 0x10
jne 0x4e49dd
and dword [ebp - 0x544], 0
xor eax, eax
mov dword [ebp - 0x540], 7
mov word [ebp - 0x554], ax
cmp word [ebp - 0x218], ax
je 0x4e4a52
lea eax, [ebp - 0x218]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x554]
call fcn.00402650
cmp word [ebp - 0x790], 0
mov byte [ebp - 4], 4
jne 0x4e4a77
xor eax, eax
jmp 0x4e4a84
lea eax, [ebp - 0x790]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x554]
call fcn.00404240
lea eax, [ebp - 0x554]
mov ecx, ebx
push eax
call fcn.00465570
push 0
push 1
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 3
call fcn.00402590
jmp 0x4e49dd
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0
call fcn.00402590
mov esi, 0x642824
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call ebx
test eax, eax
je 0x4e4c99
lea eax, [ebp - 0x218]
push 0x6578fc
push eax
call fcn.00501716
xor eax, eax
mov dword [ebp - 0x558], 7
xor ebx, ebx
mov word [ebp - 0x56c], ax
pop ecx
pop ecx
mov dword [ebp - 0x55c], ebx
cmp word [ebp - 0x218], ax
je 0x4e4b3f
lea eax, [ebp - 0x218]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x56c]
call fcn.00402650
push esi
mov byte [ebp - 4], 5
call fcn.005017a9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x56c]
call fcn.00404240
cmp dword [ebp - 0x558], 8
lea ecx, [ebp - 0x7bc]
lea eax, [ebp - 0x56c]
cmovae eax, dword [ebp - 0x56c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e4c88
mov edi, dword [ebp - 0x7c0]
lea eax, [ebp - 0x7bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4e4c82
push 0x2e
pop eax
cmp word [ebp - 0x790], ax
je 0x4e4b9d
cmp word [ebp - 0x78e], 0
je 0x4e4b9d
cmp word [ebp - 0x78e], ax
jne 0x4e4bdc
cmp word [ebp - 0x78c], 0
je 0x4e4b9d
test byte [ebp - 0x7bc], 0x10
jne 0x4e4b9d
xor eax, eax
mov dword [ebp - 0x540], 7
mov dword [ebp - 0x544], ebx
mov word [ebp - 0x554], ax
cmp word [ebp - 0x218], ax
jne 0x4e4c0b
mov eax, ebx
jmp 0x4e4c18
lea eax, [ebp - 0x218]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x554]
call fcn.00402650
cmp word [ebp - 0x790], 0
mov byte [ebp - 4], 6
jne 0x4e4c3d
mov eax, ebx
jmp 0x4e4c4a
lea eax, [ebp - 0x790]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x554]
call fcn.00404240
lea eax, [ebp - 0x554]
mov ecx, edi
push eax
call fcn.00465570
push ebx
push 1
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 5
call fcn.00402590
jmp 0x4e4b9d
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call edi
push ebx
push 1
lea ecx, [ebp - 0x56c]
call fcn.00402590
lea ecx, [ebp - 0x7cc]
call fcn.00479e80
call fcn.0051483b
ret