Function at 0x427db0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x758
lea ebp, [esp - 4]
mov eax, dword [0x484c64]
xor eax, ebp
mov dword [ebp + 0x758], eax
push 0x50
mov eax, 0x4636ef
call fcn.0044ba5a
mov edi, dword [ebp + 0x764]
test edi, edi
mov eax, dword [ebp + 0x770]
mov esi, dword [ebp + 0x76c]
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], eax
je 0x427e51
push 0x46c8dc
push edi
call fcn.0044803e
test eax, eax
pop ecx
pop ecx
jne 0x427e14
push 0x469944
push edi
call fcn.0044803e
test eax, eax
pop ecx
pop ecx
je 0x427e51
cmp dword [ebx + 0x178], 0
je 0x427e51
lea eax, [ebx + 0x170]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040b6c0
lea ecx, [ebp - 0x18]
call fcn.004064c0
push edi
mov ecx, eax
call fcn.0040b780
test eax, eax
jne 0x427e51
mov eax, dword [ebp + 0x768]
cmp eax, dword [ebx + 4]
je 0x427ec0
test edi, edi
mov eax, dword [ebp + 0x768]
mov dword [ebx + 4], eax
je 0x427ee8
push 0x46c8dc
push edi
call fcn.0044803e
test eax, eax
pop ecx
pop ecx
jne 0x427e84
push 0x469944
push edi
call fcn.0044803e
test eax, eax
pop ecx
pop ecx
je 0x427ee8
cmp dword [ebx + 0x178], 0
je 0x427ee8
lea eax, [ebx + 0x170]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040b6c0
lea ecx, [ebp - 0x18]
call fcn.004064c0
push edi
mov ecx, eax
call fcn.0040b780
test eax, eax
jne 0x427ee8
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x758]
xor ecx, ebp
call fcn.00447b4c
add ebp, 0x75c
leave
ret 0x10
lea ecx, [ebx + 0x164]
call fcn.00407190
lea ecx, [ebx + 0x170]
call fcn.00407190
lea ecx, [ebx + 0x158]
call fcn.00407190
lea ecx, [ebx + 0x17c]
call fcn.00407190
lea ecx, [ebx + 0x188]
call fcn.00407190
test esi, esi
lea ecx, [ebx + 0x1b0]
je 0x427f2c
push esi
jmp 0x427f31
push 0x46853b
call fcn.004049f0
lea edi, [ebx + 0x14c]
mov eax, dword [edi + 4]
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.00421bb0
jmp 0x427fb2
lea ecx, [ebp - 0x20]
call fcn.0041d3b5
cmp dword [eax + 0x18], 0x10
jb 0x427f60
mov esi, dword [eax + 4]
jmp 0x427f63
lea esi, [eax + 4]
lea ecx, [ebp - 0x20]
call fcn.0041d3b5
mov eax, dword [eax + 0x1c]
add eax, 0x58
cmp dword [eax + 0x18], 0x10
jb 0x427f7c
mov eax, dword [eax + 4]
jmp 0x427f7f
add eax, 4
push esi
push eax
push str.Deleting__s_for_key__s_n
push 0x4866f8
call fcn.0041a1b0
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.0041d3b5
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x427faa
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea ecx, [ebp - 0x20]
call fcn.004274d4
mov eax, dword [edi + 4]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.00421bb0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.00421b45
test al, al
je 0x427f4d
mov ecx, edi
call fcn.00427ce0
mov edi, 0x103
push edi
lea eax, [ebp + 0x551]
push 0
push eax
mov byte [ebp + 0x550], 0
call fcn.00447ba0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x10], 0
je 0x4281b5
push 0x46c8dc
push dword [ebp - 0x10]
call fcn.0044803e
test eax, eax
pop ecx
pop ecx
jne 0x428182
push 0x469944
push dword [ebp - 0x10]
call fcn.0044803e
test eax, eax
pop ecx
pop ecx
jne 0x428182
push edi
push eax
mov byte [ebp + 0x654], al
lea eax, [ebp + 0x655]
push eax
call fcn.00447ba0
push edi
lea eax, [ebp + 0x44d]
push 0
push eax
mov byte [ebp + 0x44c], 0
call fcn.00447ba0
push esi
lea eax, [ebp + 0x44c]
push eax
push 0
call fcn.004219be
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
mov edi, 0x46a180
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00447cf1
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.0040a950
add esp, 0x40
test eax, eax
je 0x4280d9
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402f00
xor esi, esi
lea eax, [ebp - 0x40]
inc esi
push eax
lea ecx, [ebx + 0x170]
mov dword [ebp - 4], esi
call fcn.00422ac1
push 0
push esi
jmp 0x4281a4
lea eax, [ebp + 0x44c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00447cf1
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.0040a950
add esp, 0x1c
test eax, eax
je 0x42813a
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402f00
mov dword [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x170]
call fcn.00422ac1
jmp 0x4281a0
push dword [ebp - 0x10]
lea eax, [ebp + 0x550]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00447cf1
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.0040a950
add esp, 0x1c
test eax, eax
je 0x4282ae
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402f00
mov dword [ebp - 4], 3
jmp 0x428129
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.00402f00
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x170]
call fcn.004073b0
push 0
push 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401c10
jmp 0x4282ae
lea eax, [ebp + 0x550]
push eax
push str._shp_ins__.dat
lea eax, [ebp + 0x140]
push esi
push eax
call fcn.00447cf1
add esp, 0x10
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4282ae
test byte [ebp], 0x10
jne 0x428290
push edi
lea eax, [ebp + 0x349]
push 0
push eax
mov byte [ebp + 0x348], 0
call fcn.00447ba0
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x550]
push eax
push 0x46a180
lea eax, [ebp + 0x348]
push esi
push eax
call fcn.00447cf1
push edi
lea eax, [ebp + 0x245]
push 0
push eax
mov byte [ebp + 0x244], 0
call fcn.00447ba0
add esp, 0x2c
push 0
lea eax, [ebp + 0x244]
push eax
push esi
lea eax, [ebp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp + 0x244]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402f00
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebx + 0x170]
mov dword [ebp - 4], 4
call fcn.004073b0
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.00401c10
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4281ee
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp + 0x768], 1
je 0x427ec0
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x427ec3