Function at 0x4044b0
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaac
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x250
lea eax, [ebp - 0xa98]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0xaa8], ebx
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x348]
push 0x200
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x648]
push 0x200
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x848]
push 0x200
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x108]
push pe_nt_image_headers32
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x448]
push pe_nt_image_headers32
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x348]
push 0xff
push ebx
push eax
call fcn.0040e084
add esp, 0xc
xor eax, eax
mov word [ebp - 0x14a], ax
lea eax, [ebp - 0x348]
push 0xff
push str..item
push eax
call fcn.0040de40
add esp, 0xc
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0xaa0], esi
cmp esi, 0xffffffff
jne 0x4045bd
or eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov esi, 0xfffffffe
mov edi, eax
mov dword [ebp - 0xaa4], esi
nop word [eax + eax]
test dword [ebp - 0xa98], 0x10
jne 0x40490b
push 0xff
lea eax, [ebp - 0x348]
push ebx
push eax
call fcn.0040e084
add esp, 0xc
xor eax, eax
mov word [ebp - 0x14a], ax
lea eax, [ebp - 0x348]
push 0xff
push 0x42dce8
push eax
call fcn.0040de40
add esp, 0xc
lea eax, [ebp - 0xa6c]
push 0xff
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.0040de40
xor eax, eax
lea ecx, [ebp - 0x108]
add esp, 0xc
mov word [ebp - 0x14a], ax
lea eax, [ebp - 0x348]
mov edx, 0xff
push eax
call fcn.00408670
add esp, 4
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x108]
call fcn.004089e0
mov edi, eax
test edi, edi
je 0x404905
mov dword [ebp - 0xa9c], edi
cmp byte [edi], 0xef
jne 0x40468e
cmp byte [edi + 1], 0xbb
jne 0x40468e
cmp byte [edi + 2], 0xbf
jne 0x40468e
lea eax, [edi + 3]
mov dword [ebp - 0xa9c], eax
xor edx, edx
lea ecx, [ebp - 0xa9c]
call fcn.00408f30
push edi
mov esi, eax
call fcn.0041501c
add esp, 4
test esi, esi
je 0x4048ff
cmp dword [esi + 4], 4
jne 0x404760
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4046ec
push 0x10
mov edx, str.ManifestLocation
call fcn.00408b60
add esp, 4
test eax, eax
je 0x4046ec
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x4046ec
mov ecx, dword [ecx]
test ecx, ecx
je 0x4046ec
mov al, byte [ebx]
mov byte [ecx], al
cmp dword [esi + 4], 4
jne 0x404760
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x404726
push 0xf
mov edx, str.InstallLocation
call fcn.00408b60
add esp, 4
test eax, eax
je 0x404726
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x404726
mov ecx, dword [ecx]
test ecx, ecx
je 0x404726
mov al, byte [ebx]
mov byte [ecx], al
cmp dword [esi + 4], 4
jne 0x404760
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x404760
push 0xf
mov edx, str.StagingLocation
call fcn.00408b60
add esp, 4
test eax, eax
je 0x404760
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x404760
mov ecx, dword [ecx]
test ecx, ecx
je 0x404760
mov al, byte [ebx]
mov byte [ecx], al
push 0xff
lea eax, [ebp - 0x108]
push str..local
push eax
call fcn.0040e200
add esp, 0xc
mov byte [ebp - 9], 0
lea eax, [ebp - 0x148]
xor edx, edx
push eax
push ecx
push 0
mov ecx, esi
call fcn.00409830
xor ebx, ebx
add esp, 0xc
test eax, eax
lea ecx, [eax + 1]
cmovns ebx, ecx
test ebx, ebx
je 0x404820
push ebx
call fcn.004152ca
mov edi, eax
add esp, 4
test edi, edi
je 0x404820
lea eax, [ebp - 0x148]
xor edx, edx
push eax
push ecx
push 0
mov ecx, esi
call fcn.00409830
xor edx, edx
add esp, 0xc
test eax, eax
lea ecx, [eax + 1]
cmovns edx, ecx
test edx, edx
je 0x404817
cmp ebx, edx
jb 0x404817
push 0
push ecx
push 0
mov edx, edi
mov ecx, esi
call fcn.00409830
add esp, 0xc
test eax, eax
js 0x404817
lea eax, [ebp - 0x108]
push 0x43cf10
push eax
call fcn.0040ed51
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x404817
push ebx
push edi
call fcn.00416cb7
push ebx
call fcn.0040ea39
add esp, 0xc
push edi
call fcn.0041501c
add esp, 4
mov ecx, esi
call fcn.0040a700
push 0xff
lea eax, [ebp - 0x648]
push str._ProgramData_EpicEpicGamesLauncherDataManifests_
push eax
call fcn.0040e084
add esp, 0xc
xor eax, eax
mov word [ebp - 0x44a], ax
lea eax, [ebp - 0xa6c]
push 0xff
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.0040de40
add esp, 0xc
xor eax, eax
mov word [ebp - 0x44a], ax
lea eax, [ebp - 0x848]
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea ecx, [ebp - 0x648]
mov word [ebp - 0x64a], ax
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x848]
push eax
call fcn.004075c0
add esp, 4
lea eax, [ebp - 0x648]
mov edx, 0xff
lea ecx, [ebp - 0x448]
push eax
call fcn.00408670
add esp, 4
mov byte [ebp - 0x349], 0
lea edx, [ebp - 0x108]
lea ecx, [ebp - 0x448]
push 0
call fcn.00406f70
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.0040e7c3
mov ebx, dword [ebp - 0xaa8]
add esp, 4
xor esi, esi
mov dword [ebp - 0xaa4], esi
jmp 0x404905
mov esi, dword [ebp - 0xaa4]
mov edi, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa98]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4045d0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a851
mov esp, ebp
pop ebp
ret