Function at 0x4d1a5d
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x7a0
mov eax, 0x545ca7
call fcn.00506b61
push 0x64
pop ecx
mov esi, str.2GelReicuamuBJnsklCBDLxAKmzzy6PvV29lWuWRjzJYgSRFzPoVxpt8ReVjoUOD4I3Jq0pk5n9JjJ5czuNluhGUiKKvKyNVpT1L58aX0tujMYP3ConFXpksesmmhKHVNZ05hDgE9v9YIpDarIfXBPukm7auI5GSZQ4nWhCIipQMyJ9ieLwDVjrlERPwS1wmRWIOzfQyyq5adKEXapanyPS1T8vq9Ng9kqtejfrlXlCcusy1kmWWmCUgaadgUWyUdWwD4BsLr5PiszmZQzPbP2VH1vakmOI6lg20V9tL6OIoUAojvvAQWjrKZmAo4nArBNBMODQjL0Y1CAUrGxIgi8f1nEM5WxfsD6zfIKNh8LwhOgdPgxr1APXk2ibIJAY0KFALvi6TOxi61mqP5
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x51c]
mov dword [ebp - 0x7a0], eax
rep movsd dword es:[edi], dword [esi]
push 0x5b
pop ecx
xor ebx, ebx
movsw word es:[edi], word [esi]
mov esi, str.Ypd4o9VcEkUe8P1qPQD93teDFxN9dyKZuWNiM7Ihi9ksqkG38LZZj25luCGvpEW6SbNsVOiVB8XH0qGBiVUPeYkdg5oWTRROFJMaI2kOGrIetSmBtM452fFgj4BxDhHNlLMRMOdrsuIBawPZamUbw6rGmfaIe2Wlmchcq6L4dGbP3uzyxEnYEltZzqxTpR8ofwQlx0hpq9fKGstso2QegE3DUQuIVh1d4WVC6aw7itkFPadQPSXDqBiau8OxjqW8bf8xNagzAalkxzhFISxT4LlVjb5vbDd5JRUzIF6kTkx0NtTp2T7YjkWzuxL4qnnybTCCPBrd7UGWFhgpHBFdJIsR3xeifUTAdz3jL6sDxOtrw
mov dword [ebp - 0x7ac], ebx
lea edi, [ebp - 0x388]
mov dword [ebp - 0x7a8], ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7a4], ebx
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x51c]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x534]
call fcn.00405820
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x7ac]
call fcn.00407e30
push ebx
push 1
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], bl
call fcn.0046d37e
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x534]
call fcn.00405820
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x7ac]
call fcn.00407e30
push ebx
push 1
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], bl
call fcn.0046d37e
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x19
push eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x6293b0
test eax, eax
je 0x4d1d08
lea eax, [ebp - 0x218]
push 0x63d88c
push eax
call fcn.004f39c6
and dword [ebp - 0x53c], 0
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x538], 7
mov word [ebp - 0x54c], ax
cmp word [ebp - 0x218], ax
je 0x4d1ba0
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x54c]
call fcn.00402650
push esi
mov byte [ebp - 4], 3
call fcn.004f3a59
pop ecx
push eax
push esi
lea ecx, [ebp - 0x54c]
call fcn.00404290
cmp dword [ebp - 0x538], 8
lea ecx, [ebp - 0x79c]
lea eax, [ebp - 0x54c]
cmovae eax, dword [ebp - 0x54c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d1ced
mov ebx, dword [ebp - 0x7a0]
push 0x2e
pop edi
lea eax, [ebp - 0x79c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4d1ce1
cmp word [ebp - 0x770], di
je 0x4d1c01
cmp word [ebp - 0x76e], 0
je 0x4d1c01
cmp word [ebp - 0x76e], di
jne 0x4d1c3d
cmp word [ebp - 0x76c], 0
je 0x4d1c01
test byte [ebp - 0x79c], 0x10
jne 0x4d1c01
and dword [ebp - 0x524], 0
xor eax, eax
mov dword [ebp - 0x520], 7
mov word [ebp - 0x534], ax
cmp word [ebp - 0x218], ax
je 0x4d1c76
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x534]
call fcn.00402650
cmp word [ebp - 0x770], 0
mov byte [ebp - 4], 4
jne 0x4d1c9b
xor eax, eax
jmp 0x4d1ca8
lea eax, [ebp - 0x770]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x770]
push eax
lea ecx, [ebp - 0x534]
call fcn.00404290
lea eax, [ebp - 0x534]
mov ecx, ebx
push eax
call fcn.00459750
push 0
push 1
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 3
call fcn.00402590
jmp 0x4d1c01
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 0
call fcn.00402590
mov esi, 0x6293b0
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call ebx
test eax, eax
je 0x4d1ebd
lea eax, [ebp - 0x218]
push 0x63d88c
push eax
call fcn.004f39c6
xor eax, eax
mov dword [ebp - 0x538], 7
xor ebx, ebx
mov word [ebp - 0x54c], ax
pop ecx
pop ecx
mov dword [ebp - 0x53c], ebx
cmp word [ebp - 0x218], ax
je 0x4d1d63
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x54c]
call fcn.00402650
push esi
mov byte [ebp - 4], 5
call fcn.004f3a59
pop ecx
push eax
push esi
lea ecx, [ebp - 0x54c]
call fcn.00404290
cmp dword [ebp - 0x538], 8
lea ecx, [ebp - 0x79c]
lea eax, [ebp - 0x54c]
cmovae eax, dword [ebp - 0x54c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d1eac
mov edi, dword [ebp - 0x7a0]
lea eax, [ebp - 0x79c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4d1ea6
push 0x2e
pop eax
cmp word [ebp - 0x770], ax
je 0x4d1dc1
cmp word [ebp - 0x76e], 0
je 0x4d1dc1
cmp word [ebp - 0x76e], ax
jne 0x4d1e00
cmp word [ebp - 0x76c], 0
je 0x4d1dc1
test byte [ebp - 0x79c], 0x10
jne 0x4d1dc1
xor eax, eax
mov dword [ebp - 0x520], 7
mov dword [ebp - 0x524], ebx
mov word [ebp - 0x534], ax
cmp word [ebp - 0x218], ax
jne 0x4d1e2f
mov eax, ebx
jmp 0x4d1e3c
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x534]
call fcn.00402650
cmp word [ebp - 0x770], 0
mov byte [ebp - 4], 6
jne 0x4d1e61
mov eax, ebx
jmp 0x4d1e6e
lea eax, [ebp - 0x770]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x770]
push eax
lea ecx, [ebp - 0x534]
call fcn.00404290
lea eax, [ebp - 0x534]
mov ecx, edi
push eax
call fcn.00459750
push ebx
push 1
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 5
call fcn.00402590
jmp 0x4d1dc1
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call edi
push ebx
push 1
lea ecx, [ebp - 0x54c]
call fcn.00402590
lea ecx, [ebp - 0x7ac]
call fcn.0046d3d0
call fcn.00506b0b
ret