Function at 0x41aa96
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x44351c
call fcn.0042a13c
sub esp, 0x77c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
mov esi, ecx
je 0x41ab09
push 0x4528dc
push ebx
call fcn.0042b2c8
pop ecx
test eax, eax
pop ecx
jne 0x41aad4
push 0x44f7bc
push ebx
call fcn.0042b2c8
pop ecx
test eax, eax
pop ecx
je 0x41ab09
cmp dword [esi + 0x100], 0
je 0x41ab09
mov eax, dword [esi + 0xfc]
push ebx
mov eax, dword [eax]
lea edi, [eax + 8]
call fcn.0042a0c0
pop ecx
push eax
push ebx
push dword [edi + 8]
mov ecx, edi
push 0
call fcn.00403c10
test eax, eax
jne 0x41ab09
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 4]
je 0x41ab6c
mov eax, dword [ebp + 0xc]
test ebx, ebx
mov dword [esi + 4], eax
je 0x41ab80
push 0x4528dc
push ebx
call fcn.0042b2c8
pop ecx
test eax, eax
pop ecx
jne 0x41ab35
push 0x44f7bc
push ebx
call fcn.0042b2c8
pop ecx
test eax, eax
pop ecx
je 0x41ab80
cmp dword [esi + 0x100], 0
je 0x41ab80
mov eax, dword [esi + 0xfc]
push ebx
mov eax, dword [eax]
lea edi, [eax + 8]
call fcn.0042a0c0
pop ecx
push eax
push ebx
push dword [edi + 8]
mov ecx, edi
push 0
call fcn.00403c10
test eax, eax
jne 0x41ab80
mov eax, dword [esi]
push dword [ebp + 0x14]
mov ecx, esi
call dword [eax + 8]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
lea ecx, [esi + 0xec]
call fcn.0041be5b
lea ecx, [esi + 0xf8]
call fcn.0041be5b
lea ecx, [esi + 0xe0]
call fcn.0041be5b
lea ecx, [esi + 0x104]
call fcn.0041be5b
lea ecx, [esi + 0x110]
call fcn.0041be5b
cmp dword [ebp + 0x10], 0
je 0x41abcc
push dword [ebp + 0x10]
call fcn.0042a0c0
pop ecx
push eax
push dword [ebp + 0x10]
jmp 0x41abda
mov edi, 0x469cb0
push edi
call fcn.0042a0c0
pop ecx
push eax
push edi
lea ecx, [esi + 0x12c]
call fcn.00403ab0
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [ebp - 0x20], ecx
je 0x41ac4c
mov edi, 0x445318
mov eax, dword [ecx + 0x10]
mov edx, edi
test eax, eax
je 0x41ac04
mov edx, eax
mov eax, dword [ecx + 0x1c]
add eax, 0x34
mov eax, dword [eax + 4]
test eax, eax
jne 0x41ac13
mov eax, edi
push edx
push eax
push str.Deleting__s_for_key__s_n
push 0x45a150
call fcn.00419ffb
mov eax, dword [ebp - 0x20]
add esp, 0x10
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x41ac37
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x20]
call fcn.0041c14a
mov eax, dword [esi + 0xd4]
mov ecx, dword [ebp - 0x20]
cmp ecx, eax
jne 0x41abf9
lea ecx, [esi + 0xd0]
call fcn.0041c0f5
mov al, byte [0x469cb0]
push 0x40
mov byte [ebp - 0x33c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x33b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x104
lea eax, [ebp - 0x33c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [ebp + 8]
test edi, edi
je 0x41aef8
push 0x4528dc
push edi
call fcn.0042b2c8
pop ecx
test eax, eax
pop ecx
jne 0x41aeae
push 0x44f7bc
push edi
call fcn.0042b2c8
pop ecx
test eax, eax
pop ecx
jne 0x41aeae
mov dl, byte [0x469cb0]
push 0x40
pop ecx
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x237]
mov byte [ebp - 0x238], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x238]
push ebx
push eax
push 0
call fcn.00424958
add esp, 0xc
lea eax, [ebp - 0x238]
mov edi, 0x44f768
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x134]
push edi
push eax
call fcn.00428fc1
lea eax, [ebp - 0x134]
push eax
call fcn.0041b045
add esp, 0x14
test eax, eax
je 0x41ad87
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.00403f10
lea eax, [ebp - 0x134]
push eax
call fcn.0042a0c0
pop ecx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403ab0
mov eax, dword [esi + 0xfc]
lea ecx, [esi + 0xf8]
push 1
lea edx, [ebp - 0x1c]
mov eax, dword [eax]
pop edi
push edx
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], edi
push eax
call fcn.00403f60
or dword [ebp - 4], 0xffffffff
push edi
lea ecx, [ebp - 0x1c]
jmp 0x41aea4
lea eax, [ebp - 0x238]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x134]
push edi
push eax
call fcn.00428fc1
lea eax, [ebp - 0x134]
push eax
call fcn.0041b045
add esp, 0x14
test eax, eax
je 0x41ae1d
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.00403f10
lea eax, [ebp - 0x134]
push eax
call fcn.0042a0c0
pop ecx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403ab0
mov eax, dword [esi + 0xfc]
lea ecx, [esi + 0xf8]
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], 2
mov eax, dword [eax]
push edx
push eax
lea eax, [ebp + 8]
push eax
call fcn.00403f60
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
jmp 0x41aea4
push dword [ebp + 8]
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x134]
push edi
push eax
call fcn.00428fc1
lea eax, [ebp - 0x134]
push eax
call fcn.0041b045
add esp, 0x14
test eax, eax
je 0x41b02c
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.00403f10
lea eax, [ebp - 0x134]
push eax
call fcn.0042a0c0
pop ecx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403ab0
mov eax, dword [esi + 0xfc]
lea ecx, [esi + 0xf8]
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], 3
mov eax, dword [eax]
push edx
push eax
lea eax, [ebp + 8]
push eax
call fcn.00403f60
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call fcn.00403f10
jmp 0x41b02c
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.00403f10
push edi
call fcn.0042a0c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.00403ab0
mov eax, dword [esi + 0xfc]
lea ecx, [esi + 0xf8]
and dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
push edx
push eax
lea eax, [ebp + 8]
push eax
call fcn.00403f60
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
jmp 0x41aea4
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x788]
push str._shp_ins__.dat
push eax
call fcn.00428fc1
add esp, 0xc
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x788]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x41b02c
test byte [ebp - 0x684], 0x10
jne 0x41b00b
mov al, byte [0x469cb0]
push 0x40
mov byte [ebp - 0x544], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x543]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x544]
push 0x44f768
push eax
call fcn.00428fc1
mov al, byte [0x469cb0]
add esp, 0x10
mov byte [ebp - 0x440], al
xor eax, eax
push 0x40
lea edi, [ebp - 0x43f]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x440]
push 0
push eax
lea eax, [ebp - 0x544]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], al
call fcn.00403f10
lea eax, [ebp - 0x440]
push eax
call fcn.0042a0c0
pop ecx
push eax
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403ab0
mov eax, dword [esi + 0xfc]
lea ecx, [esi + 0xf8]
lea edx, [ebp - 0x30]
mov dword [ebp - 4], 4
push edx
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00403f60
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x30]
call fcn.00403f10
lea eax, [ebp - 0x684]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41af33
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp + 0xc], 1
je 0x41ab6c
mov eax, dword [esi]
push dword [ebp + 0x14]
mov ecx, esi
call dword [eax + 8]
jmp 0x41ab6f