Function at 0x401851
Capabilities:
Enumerate files on windows
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da42c
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x984
mov eax, dword [0x524330]
xor eax, ebp
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x938], ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareAVAST_SoftwareAvast
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], 0
sete al
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x402080
lea eax, [ebp - 0x811]
mov dword [ebp - 0x810], eax
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00404010
mov byte [ebp - 4], 1
push 0x4ee160
lea ecx, [ebp - 0x7a0]
call fcn.00403a33
mov dword [ebp - 0x93c], eax
mov byte [ebp - 4], 2
push str.SetupFolder
lea ecx, [ebp - 0x7bc]
call fcn.00403a33
mov dword [ebp - 0x940], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7bc]
push eax
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x938]
call fcn.004030ef
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x7bc]
call fcn.00404010
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x7a0]
call fcn.00404010
cmp dword [ebp - 0x1c], 0
jne 0x402070
cmp dword [ebp - 0x28], 8
jb 0x401983
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x948], eax
jmp 0x40198c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x948], eax
push dword [ebp - 0x948]
lea ecx, [ebp - 0x14c]
call fcn.004032ef
mov dword [ebp - 0x94c], eax
mov byte [ebp - 4], 4
or dword [ebp - 0x294], 0xffffffff
push 0x5c
lea ecx, [ebp - 0x14c]
call fcn.004035d0
push eax
push 0
lea eax, [ebp - 0x7c0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.004036cc
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x83c], eax
mov byte [ebp - 4], 5
push dword [ebp - 0x83c]
lea ecx, [ebp - 0x14c]
call fcn.00403d36
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x7c0]
sub eax, 0x10
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x840]
call fcn.0040110c
push str.defs
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x7c4]
push eax
call fcn.004038b5
add esp, 0xc
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x844], eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x844]
mov eax, dword [eax]
mov dword [ebp - 0x848], eax
push dword [ebp - 0x848]
push 0x104
lea eax, [ebp - 0x148]
push eax
call fcn.004020aa
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x7c4]
sub eax, 0x10
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
call fcn.0040110c
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffff
je 0x401fdf
mov byte [ebp - 0x299], 1
mov eax, dword [ebp - 0x290]
and eax, 0x10
je 0x401b41
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x3e4]
call fcn.00403241
push 0
push str._stream
lea ecx, [ebp - 0x3e4]
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x401b04
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x401b0f
movzx eax, byte [ebp - 0x299]
test eax, eax
je 0x401b27
mov byte [ebp - 0x299], 0
push 0x50
pop ecx
lea esi, [ebp - 0x290]
lea edi, [ebp - 0x3e0]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3e4]
sub eax, 0x10
mov dword [ebp - 0x868], eax
mov ecx, dword [ebp - 0x868]
call fcn.0040110c
lea eax, [ebp - 0x290]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401ab7
lea eax, [ebp - 0x3b4]
push eax
lea ecx, [ebp - 0x298]
call fcn.00403241
mov dword [ebp - 0x958], eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x298]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x874], eax
xor eax, eax
cmp dword [ebp - 0x874], 0
sete al
movzx eax, al
test eax, eax
jne 0x401f4c
lea eax, [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x938]
call fcn.00403d36
push ecx
mov ecx, esp
mov dword [ebp - 0x7c8], esp
push 0
call fcn.00403241
mov dword [ebp - 0x95c], eax
mov byte [ebp - 4], 8
push ecx
mov eax, esp
mov dword [ebp - 0x7cc], esp
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x298]
sub eax, 0x10
mov dword [ebp - 0x880], eax
push dword [ebp - 0x880]
call fcn.004042f4
pop ecx
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x960]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
add eax, 0x10
mov ecx, dword [ebp - 0x888]
mov dword [ecx], eax
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x7d0], esp
push 0x4ee19c
call fcn.00403241
mov dword [ebp - 0x964], eax
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x7d4], esp
push 0x4ee1a0
call fcn.00403241
mov byte [ebp - 4], 7
call fcn.00459e6b
add esp, 0x10
lea eax, [ebp - 0x4f0]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x5fc]
call fcn.00403241
mov dword [ebp - 0x968], eax
mov byte [ebp - 4], 0xb
or dword [ebp - 0x744], 0xffffffff
push str.AVAST_SoftwareAvastlog
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x7d8]
push eax
call fcn.004038b5
add esp, 0xc
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x8a4], eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x8a4]
mov eax, dword [eax]
mov dword [ebp - 0x8a8], eax
push dword [ebp - 0x8a8]
push 0x104
lea eax, [ebp - 0x5f8]
push eax
call fcn.004020aa
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x7d8]
sub eax, 0x10
mov dword [ebp - 0x8b0], eax
mov ecx, dword [ebp - 0x8b0]
call fcn.0040110c
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x5f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0xffffffff
je 0x401f2c
call fcn.00498191
mov dword [ebp - 0x970], eax
push dword [ebp - 0x970]
lea ecx, [ebp - 0x748]
call fcn.00403ced
mov byte [ebp - 4], 0xd
push 0x4ee1c4
lea ecx, [ebp - 0x74c]
call fcn.00403241
mov dword [ebp - 0x974], eax
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x740]
and eax, 0x10
je 0x401d74
jmp 0x401e4f
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x784]
call fcn.00403241
mov dword [ebp - 0x978], eax
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x780]
push eax
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push str.usntr
lea ecx, [ebp - 0x784]
call fcn.0040355e
cmp eax, 0xffffffff
je 0x401e31
movzx eax, word [ebp - 0x776]
movzx ecx, word [ebp - 0x766]
sub ecx, eax
cmp ecx, 0xa
jge 0x401e31
movzx eax, word [ebp - 0x77a]
movzx ecx, word [ebp - 0x76a]
sub ecx, eax
jne 0x401e31
movzx eax, word [ebp - 0x77e]
movzx ecx, word [ebp - 0x76e]
sub ecx, eax
jne 0x401e31
push 0x4ee1d0
lea ecx, [ebp - 0x74c]
call fcn.00403dc5
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x784]
sub eax, 0x10
mov dword [ebp - 0x8d4], eax
mov ecx, dword [ebp - 0x8d4]
call fcn.0040110c
jmp 0x401e6a
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x784]
sub eax, 0x10
mov dword [ebp - 0x8d8], eax
mov ecx, dword [ebp - 0x8d8]
call fcn.0040110c
lea eax, [ebp - 0x740]
push eax
push dword [ebp - 0x744]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401d64
push ecx
mov eax, esp
mov dword [ebp - 0x7dc], esp
mov dword [ebp - 0x8dc], eax
lea eax, [ebp - 0x74c]
push eax
mov ecx, dword [ebp - 0x8dc]
call fcn.00448edc
mov byte [ebp - 4], 0x10
push ecx
mov eax, esp
mov dword [ebp - 0x7e0], esp
mov dword [ebp - 0x8e0], eax
lea eax, [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x8e0]
call fcn.00448edc
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x7e4], esp
push 0x4ee1d4
call fcn.00403241
mov dword [ebp - 0x97c], eax
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x7e8], esp
push 0x4ee1d8
call fcn.00403241
mov byte [ebp - 4], 0xe
call fcn.00459e6b
add esp, 0x10
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x74c]
sub eax, 0x10
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0x8f4]
call fcn.0040110c
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x748]
sub eax, 0x10
mov dword [ebp - 0x8f8], eax
mov ecx, dword [ebp - 0x8f8]
call fcn.0040110c
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x5fc]
sub eax, 0x10
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
call fcn.0040110c
jmp 0x401fbf
push ecx
mov ecx, esp
mov dword [ebp - 0x7ec], esp
push 0
call fcn.00403241
mov dword [ebp - 0x980], eax
mov byte [ebp - 4], 0x13
push ecx
mov ecx, esp
mov dword [ebp - 0x7f0], esp
push 0x4ee1e0
call fcn.00403241
mov dword [ebp - 0x984], eax
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x7f4], esp
push 0x4ee1f8
call fcn.00403241
mov dword [ebp - 0x988], eax
mov byte [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0x7f8], esp
push 0x4ee1fc
call fcn.00403241
mov byte [ebp - 4], 7
call fcn.00459e6b
add esp, 0x10
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x298]
sub eax, 0x10
mov dword [ebp - 0x920], eax
mov ecx, dword [ebp - 0x920]
call fcn.0040110c
jmp 0x402052
push ecx
mov ecx, esp
mov dword [ebp - 0x7fc], esp
push 0
call fcn.00403241
mov dword [ebp - 0x98c], eax
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x800], esp
push 0x4ee204
call fcn.00403241
mov dword [ebp - 0x990], eax
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x804], esp
push 0x4ee220
call fcn.00403241
mov dword [ebp - 0x994], eax
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x808], esp
push 0x4ee224
call fcn.00403241
mov byte [ebp - 4], 4
call fcn.00459e6b
add esp, 0x10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14c]
sub eax, 0x10
mov dword [ebp - 0x934], eax
mov ecx, dword [ebp - 0x934]
call fcn.0040110c
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00404010
jmp 0x40208c
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004bc439
leave
ret