Function at 0x4bf290
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x554
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x364]
mov dword [esp + 0x1d0], 0x94
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x1d4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1d0]
xor ebp, ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x150]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x150]
push str.Program_FilesCommon_FilesMicrosoft_SharedMSINFO
push edx
lea eax, [esp + 0x26c]
push 0x50e0ec
push eax
mov byte [esp + 0x163], 0
call fcn.004f175f
lea ecx, [esp + 0x274]
push ecx
call fcn.004f2beb
lea edx, [esp + 0x278]
lea eax, [esp + 0x378]
push edx
push str._s.
push eax
call fcn.004f175f
add esp, 0x20
lea ecx, [esp + 0x10]
lea edx, [esp + 0x364]
xor esi, esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4bf543
mov edi, dword [esp + 0x568]
test byte [esp + 0x10], 0x10
jne 0x4bf525
cmp byte [esp + 0x3c], 0x2e
je 0x4bf525
lea eax, [esp + 0x3c]
push str.IEFILES5.INF
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf38f
mov esi, 1
lea ecx, [esp + 0x3c]
push str.IEINFO5.OCX
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf3aa
mov esi, 1
lea edx, [esp + 0x3c]
push str.MSINFO32.HLP
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf3c5
mov esi, 1
lea eax, [esp + 0x3c]
push str.MsInfo.rx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf3e0
mov esi, 1
lea ecx, [esp + 0x3c]
push str.MSIOFF9.MOF
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf3fb
mov esi, 1
lea edx, [esp + 0x3c]
push str.MSIOFF9.OCX
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf416
mov esi, 1
lea eax, [esp + 0x3c]
push str.MsInfo.rx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf431
mov esi, 1
lea ecx, [esp + 0x3c]
push str.OFFPROV.EXE
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf44c
mov esi, 1
lea edx, [esp + 0x3c]
push str.MSINFO32.GID
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bf467
mov esi, 1
lea eax, [esp + 0x3c]
push str..txt
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4bf498
lea ecx, [esp + 0x3c]
push str..txt.
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4bf498
mov esi, 1
lea edx, [esp + 0x3c]
push str..inf
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4bf4cb
lea eax, [esp + 0x3c]
push str..inf.
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4bf4cb
mov esi, 1
jmp 0x4bf525
test esi, esi
jne 0x4bf525
lea ecx, [esp + 0x3c]
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [esp + 0x264]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [esp + 0x46c]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [esp + 0x474]
push 0xff
push ecx
push edi
call fcn.004f27c0
add esp, 0x1c
inc ebp
add edi, 0x100
cmp ebp, 0xf8
je 0x4bf543
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4bf35e
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or ebx, 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x56c]
push str.c:endpcache
mov dword [eax], ebp
call fcn.004f2beb
add esp, 4
mov ax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret