Function at 0x43c2d9
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x758
lea ebp, [esp - 4]
mov eax, dword [0x517774]
xor eax, ebp
mov dword [ebp + 0x758], eax
push 0x50
mov eax, 0x4cbbcd
call fcn.0049aeba
mov edi, dword [ebp + 0x764]
mov eax, dword [ebp + 0x770]
mov esi, dword [ebp + 0x76c]
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], eax
test edi, edi
je 0x43c37e
push 0x4dc298
push edi
call fcn.0049858b
pop ecx
pop ecx
test eax, eax
jne 0x43c33d
push 0x4d7bbc
push edi
call fcn.0049858b
pop ecx
pop ecx
test eax, eax
je 0x43c37e
cmp dword [ebx + 0x1d8], 0
je 0x43c37e
lea eax, [ebx + 0x1c0]
mov ecx, dword [eax + 0x14]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404fb0
lea ecx, [ebp - 0x18]
call fcn.00404fe0
push edi
mov ecx, eax
call fcn.00413600
test eax, eax
jne 0x43c37e
mov eax, dword [ebp + 0x768]
cmp eax, dword [ebx + 4]
je 0x43c7bf
mov eax, dword [ebp + 0x768]
mov dword [ebx + 4], eax
test edi, edi
je 0x43c3ee
push 0x4dc298
push edi
call fcn.0049858b
pop ecx
pop ecx
test eax, eax
jne 0x43c3ad
push 0x4d7bbc
push edi
call fcn.0049858b
pop ecx
pop ecx
test eax, eax
je 0x43c3ee
cmp dword [ebx + 0x1d8], 0
je 0x43c3ee
lea eax, [ebx + 0x1c0]
mov ecx, dword [eax + 0x14]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404fb0
lea ecx, [ebp - 0x18]
call fcn.00404fe0
push edi
mov ecx, eax
call fcn.00413600
test eax, eax
jne 0x43c3ee
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x43c7c2
lea ecx, [ebx + 0x1a4]
call fcn.00405f80
lea ecx, [ebx + 0x1c0]
call fcn.00405f80
lea ecx, [ebx + 0x188]
call fcn.00405f80
lea ecx, [ebx + 0x1dc]
call fcn.00405f80
lea ecx, [ebx + 0x1f8]
call fcn.00405f80
lea ecx, [ebx + 0x230]
test esi, esi
je 0x43c432
push esi
jmp 0x43c437
push 0x4d41fc
call fcn.004022d0
lea edi, [ebx + 0x168]
mov eax, dword [edi + 0x18]
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.0043b647
jmp 0x43c4b8
lea ecx, [ebp - 0x20]
call fcn.0043b507
cmp dword [eax + 0x18], 0x10
jb 0x43c466
mov esi, dword [eax + 4]
jmp 0x43c469
lea esi, [eax + 4]
lea ecx, [ebp - 0x20]
call fcn.0043b507
mov eax, dword [eax + 0x1c]
add eax, 0x58
cmp dword [eax + 0x18], 0x10
jb 0x43c482
mov eax, dword [eax + 4]
jmp 0x43c485
add eax, 4
push esi
push eax
push str.Deleting__s_for_key__s_n
push 0x519518
call fcn.00427473
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.0043b507
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x43c4b0
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea ecx, [ebp - 0x20]
call fcn.0043b569
mov eax, dword [edi + 0x18]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.0043b647
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.0043b388
test al, al
je 0x43c453
mov ecx, edi
call fcn.0043c207
mov edi, 0x103
push edi
lea eax, [ebp + 0x551]
push 0
push eax
mov byte [ebp + 0x550], 0
call fcn.00497680
add esp, 0xc
lea esi, [edi + 1]
push esi
lea eax, [ebp + 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x10], 0
je 0x43c6b9
push 0x4dc298
push dword [ebp - 0x10]
call fcn.0049858b
pop ecx
pop ecx
test eax, eax
jne 0x43c686
push 0x4d7bbc
push dword [ebp - 0x10]
call fcn.0049858b
pop ecx
pop ecx
test eax, eax
jne 0x43c686
push edi
push eax
mov byte [ebp + 0x654], al
lea eax, [ebp + 0x655]
push eax
call fcn.00497680
push edi
lea eax, [ebp + 0x44d]
push 0
push eax
mov byte [ebp + 0x44c], 0
call fcn.00497680
push esi
lea eax, [ebp + 0x44c]
push eax
push 0
call fcn.0042e4d8
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
mov edi, 0x4d91b0
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00497562
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00410b30
add esp, 0x40
test eax, eax
je 0x43c5dd
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402a30
xor esi, esi
lea eax, [ebp - 0x40]
inc esi
push eax
lea ecx, [ebx + 0x1c0]
mov dword [ebp - 4], esi
call fcn.004326a9
push 0
push esi
jmp 0x43c6a8
lea eax, [ebp + 0x44c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00497562
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00410b30
add esp, 0x1c
test eax, eax
je 0x43c63e
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402a30
mov dword [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x1c0]
call fcn.004326a9
jmp 0x43c6a4
push dword [ebp - 0x10]
lea eax, [ebp + 0x550]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00497562
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00410b30
add esp, 0x1c
test eax, eax
je 0x43c7b2
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402a30
mov dword [ebp - 4], 3
jmp 0x43c62d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.00402a30
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x1c0]
call fcn.0041b7a0
push 0
push 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401a30
jmp 0x43c7b2
lea eax, [ebp + 0x550]
push eax
push str._shp_ins__.dat
lea eax, [ebp + 0x140]
push esi
push eax
call fcn.00497562
add esp, 0x10
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x43c7b2
test byte [ebp], 0x10
jne 0x43c794
push edi
lea eax, [ebp + 0x349]
push 0
push eax
mov byte [ebp + 0x348], 0
call fcn.00497680
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x550]
push eax
push 0x4d91b0
lea eax, [ebp + 0x348]
push esi
push eax
call fcn.00497562
push edi
lea eax, [ebp + 0x245]
push 0
push eax
mov byte [ebp + 0x244], 0
call fcn.00497680
add esp, 0x2c
push 0
lea eax, [ebp + 0x244]
push eax
push esi
lea eax, [ebp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp + 0x244]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402a30
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebx + 0x1c0]
mov dword [ebp - 4], 4
call fcn.0041b7a0
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.00401a30
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43c6f2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp + 0x768], 1
jne 0x43c3df
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x758]
xor ecx, ebp
call fcn.004974ba
add ebp, 0x75c
leave
ret 0x10