Function at 0x4e3dd8
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x780
mov eax, 0x555a8e
call fcn.00513ea1
push 0x59
pop ecx
mov esi, str.dbU58DTIbn4CXZ3QC7RDb6UxUd6uJ2yznnQkfACNU0OzAzTStAfg8BNz2LXu6xsyNlzAz9ByzTtCWchEkOWxks5OP6R4BHIfm2V1q46EdXZcbSR6q0EvrFMHl2B4AJbZt9vcp22HpZjET2NJiKIpX9frgeGip9XF1kI8bGfV1b9casIKoi3o67yLffzoY2TEcmo4bKnjFuwetyQrWHk2QgVRzX9fMLNfJIpVpyyadPd57B9qURtzQ3ZtZctYDPhFkbzrfwjS7XxZWhpN00lFaz8bkZuB7nSNWlvR9EdkBZOQq35aoWOlbG0xkIldrZ6fBp4ILbrfSXzyIrXFyvRN9Sugn98hBSJBbuc
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x37c]
mov dword [ebp - 0x780], eax
rep movsd dword es:[edi], dword [esi]
push 0x5f
pop ecx
mov esi, str.OsB0uSNssoP59xuUdu8s5vJayhH78oVSka6eNTfNahnKcj19A3k0f5hzrAcku3DUbNzVKSo8Yxhfji4yf1QFPEMIvUd621QkwH28lYRFIyeFGc9ksIaNxZ6NHwM4G2ymJNaOaGQXvyumtKD5jeXtJUrSWlF3aiIHqTfJ1vZE1smTQJqTqq34Nk7xXCBtFoTUjhAkqUXmeTeTdS6IDy2Uvarf9vatjzeCqoWOMbKq7TCG9e3JEM0W2DD7zh0QGPTUGyvePl4A0Lq1pjkDo2i90GydNVtTusnrD7b3ttVolN4Iku1fUKeQ5yKx6Z5rPD2RlJYXBHooO7RVa2AtJ2oi2yu8YsymupCCFqAUr0fmTGLIq1kudMRTlJrghFlf9t
lea edi, [ebp - 0x4fc]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 0x78c], ebx
mov dword [ebp - 0x788], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x784], ebx
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x37c]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x514]
call fcn.004057d0
lea eax, [ebp - 0x514]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78c]
call fcn.00408170
push ebx
push 1
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], bl
call fcn.004096c0
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x514]
call fcn.004057d0
lea eax, [ebp - 0x514]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x78c]
call fcn.00408170
push ebx
push 1
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], bl
call fcn.004096c0
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004f0ae0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x19
push eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x641aec
test eax, eax
je 0x4e4082
lea eax, [ebp - 0x218]
push 0x656b9c
push eax
call fcn.00500c96
and dword [ebp - 0x51c], 0
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x518], 7
mov word [ebp - 0x52c], ax
cmp word [ebp - 0x218], ax
je 0x4e3f1a
lea eax, [ebp - 0x218]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x52c]
call fcn.00402650
push esi
mov byte [ebp - 4], 3
call fcn.00500d29
pop ecx
push eax
push esi
lea ecx, [ebp - 0x52c]
call fcn.00404240
cmp dword [ebp - 0x518], 8
lea ecx, [ebp - 0x77c]
lea eax, [ebp - 0x52c]
cmovae eax, dword [ebp - 0x52c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e4067
mov ebx, dword [ebp - 0x780]
push 0x2e
pop edi
lea eax, [ebp - 0x77c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4e405b
cmp word [ebp - 0x750], di
je 0x4e3f7b
cmp word [ebp - 0x74e], 0
je 0x4e3f7b
cmp word [ebp - 0x74e], di
jne 0x4e3fb7
cmp word [ebp - 0x74c], 0
je 0x4e3f7b
test byte [ebp - 0x77c], 0x10
jne 0x4e3f7b
and dword [ebp - 0x504], 0
xor eax, eax
mov dword [ebp - 0x500], 7
mov word [ebp - 0x514], ax
cmp word [ebp - 0x218], ax
je 0x4e3ff0
lea eax, [ebp - 0x218]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x514]
call fcn.00402650
cmp word [ebp - 0x750], 0
mov byte [ebp - 4], 4
jne 0x4e4015
xor eax, eax
jmp 0x4e4022
lea eax, [ebp - 0x750]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x514]
call fcn.00404240
lea eax, [ebp - 0x514]
mov ecx, ebx
push eax
call fcn.00464c10
push 0
push 1
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 3
call fcn.00402590
jmp 0x4e3f7b
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0
call fcn.00402590
mov esi, 0x641aec
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call ebx
test eax, eax
je 0x4e4237
lea eax, [ebp - 0x218]
push 0x656b9c
push eax
call fcn.00500c96
xor eax, eax
mov dword [ebp - 0x518], 7
xor ebx, ebx
mov word [ebp - 0x52c], ax
pop ecx
pop ecx
mov dword [ebp - 0x51c], ebx
cmp word [ebp - 0x218], ax
je 0x4e40dd
lea eax, [ebp - 0x218]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x52c]
call fcn.00402650
push esi
mov byte [ebp - 4], 5
call fcn.00500d29
pop ecx
push eax
push esi
lea ecx, [ebp - 0x52c]
call fcn.00404240
cmp dword [ebp - 0x518], 8
lea ecx, [ebp - 0x77c]
lea eax, [ebp - 0x52c]
cmovae eax, dword [ebp - 0x52c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e4226
mov edi, dword [ebp - 0x780]
lea eax, [ebp - 0x77c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4e4220
push 0x2e
pop eax
cmp word [ebp - 0x750], ax
je 0x4e413b
cmp word [ebp - 0x74e], 0
je 0x4e413b
cmp word [ebp - 0x74e], ax
jne 0x4e417a
cmp word [ebp - 0x74c], 0
je 0x4e413b
test byte [ebp - 0x77c], 0x10
jne 0x4e413b
xor eax, eax
mov dword [ebp - 0x500], 7
mov dword [ebp - 0x504], ebx
mov word [ebp - 0x514], ax
cmp word [ebp - 0x218], ax
jne 0x4e41a9
mov eax, ebx
jmp 0x4e41b6
lea eax, [ebp - 0x218]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x514]
call fcn.00402650
cmp word [ebp - 0x750], 0
mov byte [ebp - 4], 6
jne 0x4e41db
mov eax, ebx
jmp 0x4e41e8
lea eax, [ebp - 0x750]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x514]
call fcn.00404240
lea eax, [ebp - 0x514]
mov ecx, edi
push eax
call fcn.00464c10
push ebx
push 1
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 5
call fcn.00402590
jmp 0x4e413b
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call edi
push ebx
push 1
lea ecx, [ebp - 0x52c]
call fcn.00402590
lea ecx, [ebp - 0x78c]
call fcn.0047920e
call fcn.00513e4b
ret