Function at 0x43e150
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464e54
mov eax, dword fs:[0]
push eax
sub esp, 0xac0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov word [ebp - 0xaac], 0
push 0x206
push 0
lea eax, [ebp - 0xaaa]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x484], 0
push 0x24c
push 0
lea ecx, [ebp - 0x480]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x89c], 0
push 0x206
push 0
lea edx, [ebp - 0x89a]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x230], 0
push 0x104
lea eax, [ebp - 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov cx, word [ebp - 0x89c]
mov word [ebp - 0xaac], cx
lea ecx, [ebp - 0x22c]
call fcn.004113f0
mov dword [ebp - 4], 0
push str.:Recovery
push 0x104
lea edx, [ebp - 0xaac]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x11
call fcn.0043c190
add esp, 4
mov dword [ebp - 0x8a0], 1
mov dword [ebp - 0x694], 0
push 0x208
push 0
lea eax, [ebp - 0x690]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x484]
push edx
lea eax, [ebp - 0xaac]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0xffffffff
jne 0x43e2cc
mov dword [ebp - 0xab8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00411420
mov eax, dword [ebp - 0xab8]
jmp 0x43e59b
lea ecx, [ebp - 0xaac]
push ecx
push 0x104
lea edx, [ebp - 0x690]
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov word [ebp + eax*2 - 0x692], 0
lea ecx, [ebp - 0x694]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.004114c0
lea ecx, [ebp - 0x22c]
call fcn.00411440
cmp dword [ebp - 0x230], eax
jae 0x43e502
cmp dword [ebp - 0x8a0], 0
je 0x43e502
mov edx, dword [ebp - 0x230]
push edx
lea ecx, [ebp - 0x22c]
call fcn.00411480
mov eax, dword [eax]
mov dword [ebp - 0x8a4], eax
lea ecx, [ebp - 0x484]
push ecx
mov edx, dword [ebp - 0x8a4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x43e4ee
push 0x4695c4
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43e3a0
push 0x4695c8
lea ecx, [ebp - 0x458]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x43e3a7
jmp 0x43e352
push 0x4695d0
lea edx, [ebp - 0x458]
push edx
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x43e433
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00411480
add eax, 4
push eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push str.Winre.wim
push 0x104
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
push 0xc9b030
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
mov dword [ebp - 0x8a0], 0
jmp 0x43e4ee
mov ecx, dword [ebp - 0x484]
and ecx, 0x10
je 0x43e4e9
mov edx, dword [ebp - 0x230]
push edx
lea ecx, [ebp - 0x22c]
call fcn.00411480
add eax, 4
push eax
push 0x104
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea ecx, [ebp - 0x458]
push ecx
push 0x104
lea edx, [ebp - 0x690]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x4695f8
push 0x104
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea ecx, [ebp - 0x484]
push ecx
lea edx, [ebp - 0x690]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x694], eax
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov word [ebp + eax*2 - 0x692], 0
lea ecx, [ebp - 0x694]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.004114c0
jmp 0x43e352
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
jmp 0x43e314
lea eax, [ebp - 0xab4]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00404020
jmp 0x43e52a
push 0
lea ecx, [ebp - 0xac0]
push ecx
lea ecx, [ebp - 0xab4]
call fcn.00411550
lea edx, [ebp - 0xac8]
push edx
lea ecx, [ebp - 0x22c]
call fcn.00404c20
push eax
lea ecx, [ebp - 0xab4]
call fcn.00404ac0
movzx eax, al
test eax, eax
je 0x43e571
lea ecx, [ebp - 0xab4]
call fcn.00411530
mov ecx, dword [eax]
mov dword [ebp - 0x8a4], ecx
mov edx, dword [ebp - 0x8a4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x43e516
xor eax, eax
cmp dword [ebp - 0x8a0], 0
sete al
mov dword [ebp - 0xacc], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00411420
mov eax, dword [ebp - 0xacc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret