Function at 0x42cae0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x1aa4
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1a9c], eax
mov eax, dword [esp + 0x1aac]
push ebx
push ebp
push esi
push edi
push 0x2808
push dword [0x4def88]
mov dword [esp + 0x1c], edx
mov esi, ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x12b0], ax
lea eax, [esp + 0x12b2]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1abc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x12a8]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push esi
lea eax, [esp + 0x12ac]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x12a8]
push eax
call fcn.00492383
add esp, 4
cmp eax, 0xffffffff
jne 0x42cb91
xor eax, eax
jmp 0x42cf02
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xab0], ax
lea eax, [esp + 0xab2]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x58]
push eax
push 0x4ad34c
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42cefd
lea eax, [esp + 0x58]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42cef6
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax]
lea eax, [esp + 0x58]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42cef6
push str.desktop.ini
lea eax, [esp + 0x88]
push eax
call esi
test eax, eax
jne 0x42cbf0
push str..lnk
lea eax, [esp + 0x88]
push eax
call esi
push 0
test eax, eax
lea eax, [esp + 0xaac]
push eax
push 0x400
lea eax, [esp + 0x90]
push eax
je 0x42cdb9
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0x1004
push ebx
mov dword [0x4d0c20], 0
call edi
mov dword [0x4d0c08], eax
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x2b0], ax
lea eax, [esp + 0x2b2]
push eax
mov dword [0x4d0c0c], 0
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0xaa8]
lea esi, [esp + 0x2a8]
push 0x5c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x42ccd6
movzx ecx, word [eax]
test cx, cx
je 0x42cccf
mov edx, esi
sub eax, edx
nop dword [eax]
mov word [esi], cx
add esi, 2
movzx ecx, word [eax + esi]
test cx, cx
jne 0x42ccc0
xor eax, eax
mov word [esi], ax
jmp 0x42ccec
lea eax, [esp + 0xaa8]
push eax
lea eax, [esp + 0x2ae]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4d0c04
push 0
push 0x104d
lea eax, [esp + 0x2b6]
push ebx
mov dword [0x4d0c18], eax
call edi
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
lea eax, [esp + 0x2a8]
push eax
lea edx, [esp + 0xaac]
call fcn.00476140
add esp, 4
mov dword [esp + 0x24], 1
lea eax, [esp + 0x2a8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d0c08]
push 0x1074
push ebx
call edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d0c08]
mov dword [esp + 0x2c], 2
push 0x1074
push ebx
call edi
cmp dword [esp + 0x14], 0
mov ecx, 0x2000
mov eax, 0x1000
mov dword [esp + 0x2c], 0xf000
cmovne eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d0c08]
push 0x102b
push ebx
call edi
push 0
call esi
call dword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x42cbe6
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0x1004
push ebx
mov dword [0x4d0c20], 0
call edi
mov dword [0x4d0c08], eax
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x2b0], ax
lea eax, [esp + 0x2b2]
push eax
mov dword [0x4d0c0c], 0
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0xaa8]
lea esi, [esp + 0x2a8]
push 0x5c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x42ce46
movzx ecx, word [eax]
test cx, cx
je 0x42ce3f
mov edx, esi
sub eax, edx
nop dword [eax]
mov word [esi], cx
add esi, 2
movzx ecx, word [eax + esi]
test cx, cx
jne 0x42ce30
xor eax, eax
mov word [esi], ax
jmp 0x42ce5c
lea eax, [esp + 0xaa8]
push eax
lea eax, [esp + 0x2ae]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4d0c04
push 0
push 0x104d
lea eax, [esp + 0x2b6]
push ebx
mov dword [0x4d0c18], eax
call edi
lea eax, [esp + 0x2aa]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d0c08]
push 0x1074
push ebx
call edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d0c08]
mov dword [esp + 0x2c], 2
push 0x1074
push ebx
call edi
cmp dword [esp + 0x14], 0
mov ecx, 0x2000
mov eax, 0x1000
mov dword [esp + 0x2c], 0xf000
cmovne eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d0c08]
push 0x102b
push ebx
call edi
jmp 0x42cbe6
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [esp + 0x1aac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x1aa4
ret