Function at 0x408f00
Capabilities:
Enumerate files on windows
Get common file path
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c8
mov eax, dword [0x443004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x654]
mov esi, ecx
push eax
mov dword [ebp - 0x8c0], esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x408f5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSystemDirectoryW:__d_n
call fcn.004019e0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040eb7d
mov esp, ebp
pop ebp
ret
push str..dll
lea eax, [ebp - 0x654]
push 0x208
push eax
call fcn.00418440
add esp, 0xc
lea eax, [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x8c4], eax
cmp eax, 0xffffffff
je 0x40914c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x409123
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x409166
push 0x43e078
push 0x208
push esi
call fcn.00418440
add esp, 0xc
lea eax, [ebp - 0x890]
push eax
push 0x208
push esi
call fcn.00418440
add esp, 0xc
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 0x658], edi
movups xmmword [ebp - 0x66c], xmm0
mov dword [ebp - 0x65c], edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x409051
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.CreateFileW_error_:_0x_x
call fcn.004019e0
add esp, 8
jmp 0x40911d
push 0x238
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.004130c0
add esp, 0xc
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x658]
push eax
push 0x238
lea eax, [ebp - 0x244]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jns 0x40909f
push eax
push str.NtReadFile:_0x_x_n
call fcn.004019e0
add esp, 8
push esi
call ebx
jmp 0x409117
mov eax, dword [ebp - 0x208]
cmp eax, 0x100
jg 0x4090d0
mov ecx, 0x5a4d
cmp word [ebp - 0x244], cx
jne 0x40910f
cmp dword [ebp + eax - 0x244], 0x4550
lea eax, [ebp + eax - 0x244]
jne 0x40910f
jmp 0x409101
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x658]
push eax
push 0x238
lea eax, [ebp - 0x244]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
js 0x40908c
lea eax, [ebp - 0x244]
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40910f
mov edi, dword [eax + 0x50]
push esi
call ebx
cmp dword [ebp + 8], edi
jb 0x40915f
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x8c0]
lea eax, [ebp - 0x8bc]
push eax
push dword [ebp - 0x8c4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408fb0
xor ebx, ebx
push dword [ebp - 0x8c4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eb7d
mov esp, ebp
pop ebp
ret
mov ebx, 1
jmp 0x409140
call edi
jmp 0x408f3c