Function at 0x4013d5
Capabilities:
Enumerate files on windows
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
push 0x140
xor edi, edi
push edi
push dword [0x40c800]
mov dword [ebp - 0x1c], edi
call esi
mov ebx, eax
cmp ebx, edi
je 0x40165b
push 0x104
push edi
push dword [0x40c800]
call esi
cmp eax, edi
mov dword [ebp - 8], eax
je 0x40164d
push 0xd
push edi
push dword [0x40c800]
call esi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x40163a
mov esi, dword [ebp - 8]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xfd
push esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x401629
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
or dword [ebp - 0x24], 0xffffffff
or dword [ebp - 0x20], 0xffffffff
push str.c_1252.nls
push esi
call edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x4014af
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
add dword [ebp - 0x24], 0x2a69c000
push dword [ebp - 0x18]
adc dword [ebp - 0x20], 0xc9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
and dword [ebp - 0xc], 0
mov byte [esi + eax], 0
call sub.ntdll.dll_RtlRandom
push dword [ebp + 8]
mov esi, 0xff
and eax, esi
mov dword [ebp - 0x14], eax
call sub.ntdll.dll_RtlRandom
push str..dll
push dword [ebp - 8]
and eax, esi
mov dword [ebp - 0x18], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push ebx
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4015fa
lea esi, [ebx + 0x14]
jmp 0x40152b
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40152b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push dword [ebp - 8]
call edi
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x401500
xor eax, eax
cmp eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jbe 0x401550
cmp eax, dword [ebp - 0x18]
ja 0x4015d8
cmp eax, dword [ebp - 0x14]
je 0x401557
cmp eax, dword [ebp - 0x18]
jne 0x40159d
lea eax, [ebx + 0x2c]
push 0x2e
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov esi, eax
push 0xffffffffffffffd4
pop eax
sub eax, ebx
add esi, eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
test eax, eax
je 0x40157e
lea ecx, [esi - 4]
cmp ecx, esi
jbe 0x40157e
xor ecx, ecx
cmp esi, 4
jbe 0x401586
push 4
pop esi
lea ecx, [ebx + ecx + 0x2c]
push esi
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, eax
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
add dword [ebp - 0xc], esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4015bd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push dword [ebp - 8]
call edi
mov dword [ebp + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x40159d
mov eax, dword [ebp - 0x1c]
inc eax
jmp 0x40153c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40163a
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 8]
mov esi, eax
push str.ISFB:_System_file_not_found:___s__n
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x10]
push 0
push dword [0x40c800]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
push 0
push dword [0x40c800]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
push ebx
push edi
push dword [0x40c800]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0xc