Function at 0x42be14
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x758
lea ebp, [esp - 4]
mov eax, dword [0x491d88]
xor eax, ebp
mov dword [ebp + 0x758], eax
push 0x50
mov eax, 0x46e2dc
call fcn.0045736a
mov edi, dword [ebp + 0x764]
test edi, edi
mov eax, dword [ebp + 0x770]
mov esi, dword [ebp + 0x76c]
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], eax
je 0x42beb5
push 0x475a9c
push edi
call fcn.004538a0
test eax, eax
pop ecx
pop ecx
jne 0x42be78
push 0x4730f4
push edi
call fcn.004538a0
test eax, eax
pop ecx
pop ecx
je 0x42beb5
cmp dword [ebx + 0x178], 0
je 0x42beb5
lea eax, [ebx + 0x170]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00405a60
lea ecx, [ebp - 0x18]
call fcn.0040aa30
push edi
mov ecx, eax
call fcn.00405b20
test eax, eax
jne 0x42beb5
mov eax, dword [ebp + 0x768]
cmp eax, dword [ebx + 4]
je 0x42bf24
test edi, edi
mov eax, dword [ebp + 0x768]
mov dword [ebx + 4], eax
je 0x42bf4c
push 0x475a9c
push edi
call fcn.004538a0
test eax, eax
pop ecx
pop ecx
jne 0x42bee8
push 0x4730f4
push edi
call fcn.004538a0
test eax, eax
pop ecx
pop ecx
je 0x42bf4c
cmp dword [ebx + 0x178], 0
je 0x42bf4c
lea eax, [ebx + 0x170]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00405a60
lea ecx, [ebp - 0x18]
call fcn.0040aa30
push edi
mov ecx, eax
call fcn.00405b20
test eax, eax
jne 0x42bf4c
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x758]
xor ecx, ebp
call fcn.0045309e
add ebp, 0x75c
leave
ret 0x10
lea ecx, [ebx + 0x164]
call fcn.00407100
lea ecx, [ebx + 0x170]
call fcn.00407100
lea ecx, [ebx + 0x158]
call fcn.00407100
lea ecx, [ebx + 0x17c]
call fcn.00407100
lea ecx, [ebx + 0x188]
call fcn.00407100
test esi, esi
lea ecx, [ebx + 0x1b0]
je 0x42bf90
push esi
jmp 0x42bf95
push 0x473048
call fcn.00404200
lea edi, [ebx + 0x14c]
mov eax, dword [edi + 4]
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.0042b4b1
jmp 0x42c016
lea ecx, [ebp - 0x20]
call fcn.00421972
cmp dword [eax + 0x18], 0x10
jb 0x42bfc4
mov esi, dword [eax + 4]
jmp 0x42bfc7
lea esi, [eax + 4]
lea ecx, [ebp - 0x20]
call fcn.00421972
mov eax, dword [eax + 0x1c]
add eax, 0x58
cmp dword [eax + 0x18], 0x10
jb 0x42bfe0
mov eax, dword [eax + 4]
jmp 0x42bfe3
add eax, 4
push esi
push eax
push str.Deleting__s_for_key__s_n
push 0x4932a8
call fcn.0041ffa2
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.00421972
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x42c00e
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea ecx, [ebp - 0x20]
call fcn.0042b522
mov eax, dword [edi + 4]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.0042b4b1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.0042525e
test al, al
je 0x42bfb1
mov ecx, edi
call fcn.0042bd44
mov edi, 0x103
push edi
lea eax, [ebp + 0x551]
push 0
push eax
mov byte [ebp + 0x550], 0
call fcn.004530b0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x10], 0
je 0x42c219
push 0x475a9c
push dword [ebp - 0x10]
call fcn.004538a0
test eax, eax
pop ecx
pop ecx
jne 0x42c1e6
push 0x4730f4
push dword [ebp - 0x10]
call fcn.004538a0
test eax, eax
pop ecx
pop ecx
jne 0x42c1e6
push edi
push eax
mov byte [ebp + 0x654], al
lea eax, [ebp + 0x655]
push eax
call fcn.004530b0
push edi
lea eax, [ebp + 0x44d]
push 0
push eax
mov byte [ebp + 0x44c], 0
call fcn.004530b0
push esi
lea eax, [ebp + 0x44c]
push eax
push 0
call fcn.004250d7
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
mov edi, 0x47345c
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.004543d1
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00405020
add esp, 0x40
test eax, eax
je 0x42c13d
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.004043b0
xor esi, esi
lea eax, [ebp - 0x40]
inc esi
push eax
lea ecx, [ebx + 0x170]
mov dword [ebp - 4], esi
call fcn.00425909
push 0
push esi
jmp 0x42c208
lea eax, [ebp + 0x44c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp - 0x10]
lea eax, [ebp + 0x44c]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.004543d1
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00405020
add esp, 0x1c
test eax, eax
je 0x42c19e
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.004043b0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x170]
call fcn.00425909
jmp 0x42c204
push dword [ebp - 0x10]
lea eax, [ebp + 0x550]
push eax
push edi
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.004543d1
lea eax, [ebp + 0x654]
push esi
push eax
call fcn.00405020
add esp, 0x1c
test eax, eax
je 0x42c312
lea eax, [ebp + 0x654]
push eax
lea ecx, [ebp - 0x40]
call fcn.004043b0
mov dword [ebp - 4], 3
jmp 0x42c18d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.004043b0
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x170]
call fcn.004080a0
push 0
push 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402f50
jmp 0x42c312
lea eax, [ebp + 0x550]
push eax
push str._shp_ins__.dat
lea eax, [ebp + 0x140]
push esi
push eax
call fcn.004543d1
add esp, 0x10
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x42c312
test byte [ebp], 0x10
jne 0x42c2f4
push edi
lea eax, [ebp + 0x349]
push 0
push eax
mov byte [ebp + 0x348], 0
call fcn.004530b0
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x550]
push eax
push 0x47345c
lea eax, [ebp + 0x348]
push esi
push eax
call fcn.004543d1
push edi
lea eax, [ebp + 0x245]
push 0
push eax
mov byte [ebp + 0x244], 0
call fcn.004530b0
add esp, 0x2c
push 0
lea eax, [ebp + 0x244]
push eax
push esi
lea eax, [ebp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp + 0x244]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004043b0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebx + 0x170]
mov dword [ebp - 4], 4
call fcn.004080a0
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.00402f50
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42c252
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp + 0x768], 1
je 0x42bf24
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x42bf27