Function at 0x402df2
Capabilities:
Enumerate files on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0x318
mov eax, 0x417a84
call fcn.004167d4
mov ebx, ecx
mov dword [ebp - 0x2ec], ebx
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [str.end_Mic]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x41a814]
mov dword [ebp - 0x38], eax
mov esi, str.cAfe
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.antec
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.are_D
lea edi, [ebp - 0x6c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.ton_A
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.wil_So
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Lavas
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2e8], 0x475641
mov esi, str.od32
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.eset
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.DrWe
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.asper
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.itDef
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x31c], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x318], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x310], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x304], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x300], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2fc], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 0x94], dl
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x93]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push 0x26
lea eax, [ebp - 0x198]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x402f6a
push 0xa
push 0xa
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.004042ca
add esp, 0x10
push str.:AvT
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
or eax, 0xffffffff
call fcn.00416821
ret
push 0x41a878
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402fa5
push 0x41a87c
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x402f61
xor esi, esi
mov dword [ebp - 0x2e0], esi
cmp esi, 0xd
jae 0x402fd5
push dword [ebp + esi*4 - 0x320]
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x402fd2
mov byte [ebp + esi - 0x94], 1
inc esi
jmp 0x402fa7
lea eax, [ebp - 0x2d8]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x402fa5
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
and dword [ebp - 0x2dc], 0
xor ecx, ecx
mov dword [ebp - 0x2e4], ecx
cmp ecx, 0xd
jae 0x40301a
cmp byte [ebp + ecx - 0x94], 1
jne 0x403017
xor eax, eax
inc eax
shl eax, cl
add dword [ebp - 0x2dc], eax
inc ecx
jmp 0x402ff7
mov eax, dword [ebp - 0x2dc]
jmp 0x402f64