Function at 0x4010d0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480867
mov eax, dword fs:[0]
push eax
sub esp, 0x4ec
mov eax, dword [0x70107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, ecx
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x4ec], esi
mov dword [ebp - 0x4e8], esi
mov dword [ebp - 4], esi
cmp dword [0x701c08], esi
jne 0x4011cf
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x401165
lea ecx, [ebp - 0x4f0]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
cmp ebx, ecx
je 0x401417
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
jmp 0x401417
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x401170
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x220]
call fcn.00479e20
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x401195
sub eax, edx
sar eax, 1
movzx edx, word [ebp + eax*2 - 0x222]
push edx
push 0x483068
call fcn.0047af7b
add esp, 8
test eax, eax
jne 0x4011cf
push 1
mov eax, 0x483068
mov ecx, 0x701bf8
call fcn.00479800
mov dword [ebp - 0x18], 0x7dad205f
mov word [ebp - 0x14], 0x5af
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x18]
sub cl, al
ror cl, 1
neg cl
ror cl, 3
mov byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 6
jb 0x4011e0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x244], 0xf
mov dword [ebp - 0x248], esi
mov byte [ebp - 0x258], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401214
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x18]
lea esi, [ebp - 0x258]
call fcn.00479c10
mov eax, esi
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 1
call fcn.00401050
mov esi, 8
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], esi
jb 0x40124e
mov eax, dword [eax]
push eax
lea edx, [ebp - 0x23c]
push edx
call fcn.0047a6d0
add esp, 8
cmp dword [ebp - 0x260], esi
jb 0x401275
mov eax, dword [ebp - 0x274]
push eax
call fcn.0047afdc
add esp, 4
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x260], 7
mov dword [ebp - 0x264], edi
mov word [ebp - 0x274], cx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x244], 0x10
jb 0x4012ac
mov edx, dword [ebp - 0x258]
push edx
call fcn.0047afdc
add esp, 4
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x244], 0xf
mov dword [ebp - 0x248], edi
mov byte [ebp - 0x258], 0
cmp dword [ebp - 0x228], esi
jae 0x4012d7
lea eax, [ebp - 0x23c]
lea ecx, [ebp - 0x4e0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4013e5
cmp esi, edi
je 0x4013e5
jmp 0x401300
test byte [ebp - 0x4e0], 0x10
jne 0x401354
lea edx, [ebp - 0x4b4]
push edx
lea eax, [ebp - 0x290]
push eax
call fcn.0047a6d0
add esp, 8
mov ecx, eax
lea ebx, [ebp - 0x4f0]
mov byte [ebp - 4], 6
call fcn.00479510
mov byte [ebp - 4], 5
cmp dword [ebp - 0x27c], 8
jb 0x40134c
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.0047afdc
add esp, 4
mov ebx, dword [ebp - 0x4f4]
xor edi, edi
lea edx, [ebp - 0x4e0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401300
lea eax, [ebp - 0x4f0]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x401396
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x4e8]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
xor esi, esi
jmp 0x4013a2
mov edi, dword [ebp - 0x4ec]
mov esi, dword [ebp - 0x4f0]
cmp dword [ebp - 0x228], 8
jb 0x4013ba
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0047afdc
add esp, 4
xor edx, edx
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], dx
test esi, esi
je 0x401417
mov eax, esi
call fcn.0047a160
push esi
jmp 0x40140f
lea eax, [ebp - 0x4f0]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x4013ff
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp dword [ebp - 0x228], 8
jb 0x401417
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0047afdc
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047a996
mov esp, ebp
pop ebp
ret