Function at 0x410f20
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45113b
push eax
mov dword fs:[0], esp
sub esp, 0xca0
push ebx
push ebp
push esi
push edi
push 0xffffffffffffffff
xor ebp, ebp
push 0xffffffffffffffff
push ebp
push ebp
mov esi, ecx
push 1
call fcn.00410240
mov ecx, esi
call fcn.004101f0
lea ebx, [esi + 0x13ec]
mov ecx, ebx
call fcn.0040d0c0
or eax, edx
jne 0x410f9b
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
push ebp
push 0xffff
mov ecx, esi
mov word [esi + 0x142a], 2
call fcn.00410240
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
push ebp
push 2
mov ecx, esi
call fcn.00410240
xor eax, eax
xor edx, edx
jmp 0x41140c
push 0x1000
lea ecx, [esp + 0x20]
call fcn.0040d320
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x4b2]
mov word [esp + 0x4b0], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x8b2]
mov word [esp + 0x8b0], bp
rep stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0xcb8], ebp
stosw word es:[edi], ax
call fcn.0040d0c0
sub eax, 1
sbb edx, ebp
mov edi, eax
mov ebp, edx
js 0x411094
jg 0x411004
test edi, edi
jb 0x411094
push ebp
push edi
mov ecx, ebx
call fcn.0040df60
push eax
lea eax, [esp + 0x4b4]
push eax
call fcn.004330d3
add esp, 8
lea ecx, [esp + 0x4b0]
push 0x200
push ecx
push ebp
push edi
mov ecx, ebx
call fcn.0040df60
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x411059
push ebp
push edi
mov ecx, ebx
call fcn.0040df60
lea edx, [esp + 0x4b0]
push eax
push edx
call fcn.004330d3
add esp, 8
lea eax, [esp + 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x41107c
lea ecx, [esp + 0x4b0]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040d340
add edi, 0xffffffff
adc ebp, 0xffffffff
test ebp, ebp
jg 0x411004
jl 0x411094
test edi, edi
jae 0x411004
lea ecx, [esp + 0x1c]
call fcn.0040d0c0
or eax, edx
jne 0x4110ec
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 0xffff
mov ecx, esi
mov word [esi + 0x142a], 2
call fcn.00410240
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 2
mov ecx, esi
call fcn.00410240
lea ecx, [esp + 0x1c]
mov dword [esp + 0xcb8], 0xffffffff
call fcn.0040cf90
xor eax, eax
xor edx, edx
jmp 0x41140c
lea edi, [esi + 0x13f8]
mov ecx, edi
call fcn.0040d0c0
or eax, edx
jne 0x411109
push 0x46215c
mov ecx, edi
call fcn.0040d340
xor ebp, ebp
mov ecx, 0x11f
xor eax, eax
lea edi, [esp + 0x34]
mov dword [esp + 0x30], ebp
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.0040d0c0
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x18]
push edx
mov ecx, 0x46a500
mov ebx, eax
mov dword [esp + 0x1c], ebp
call fcn.0040cc50
mov byte [esp + 0x13], al
lea ecx, [esp + 0x1c]
call fcn.0040d0c0
mov ecx, eax
or ecx, edx
je 0x4113b6
mov cl, byte [esi + 0x1429]
test cl, cl
jne 0x411399
sub eax, 1
lea ecx, [esp + 0x1c]
sbb edx, 0
mov edi, eax
mov ebp, edx
push ebp
push edi
call fcn.0040df60
lea edx, [esp + 0x4b0]
push eax
push edx
call fcn.004330d3
lea eax, [esp + 0x4b8]
lea ecx, [esp + 0x8b8]
push eax
push ecx
call fcn.004330d3
add esp, 0x10
lea ecx, [esp + 0x1c]
push ebp
push edi
call fcn.0040d230
lea edx, [esp + 0x4b0]
push 0x4631ac
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x4b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x411140
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x8b0]
cdq
push edx
push eax
push ebp
push ebx
push 4
mov ecx, esi
call fcn.00410240
mov al, byte [esi + 0x1429]
test al, al
jne 0x411354
lea edx, [esp + 0x5c]
push 0x4631a8
push edx
call fcn.00433074
add esp, 8
test eax, eax
je 0x41131e
lea eax, [esp + 0x5c]
push 0x4631a0
push eax
call fcn.00433074
add esp, 8
test eax, eax
je 0x41131e
lea ecx, [esp + 0x8b0]
lea edx, [esp + 0x4b0]
push ecx
push edx
call fcn.004330d3
add esp, 8
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x4b0]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [esp + 0x30], 0x10
je 0x411282
mov al, byte [esi + 0xc68]
test al, al
je 0x411282
lea edx, [esp + 0x4b0]
lea ecx, [esp + 0x1c]
push edx
call fcn.0040d340
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004109b0
test al, al
je 0x41131e
lea ecx, [esp + 0x8b0]
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, esi
call fcn.00410ad0
test al, al
je 0x41131e
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00410c40
test al, al
je 0x41131e
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.00410c70
test al, al
je 0x41131e
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.00410d80
test al, al
je 0x41131e
lea eax, [esp + 0x8b0]
lea ecx, [esp + 0x280]
push eax
push ecx
call fcn.004330d3
add esp, 8
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.00411b30
add ebx, 1
push edx
adc ebp, 0
push eax
push ebp
push ebx
push 3
mov ecx, esi
mov word [esi + 0x142a], 0
call fcn.00410240
mov ecx, 0x120
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41134a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x411385
call fcn.0040bfc0
jmp 0x4111f3
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 0xffff
mov ecx, esi
mov dword [esp + 0x40], ebp
mov word [esi + 0x142a], 3
call fcn.00410240
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x411140
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], ebp
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x411140
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 0xffff
mov ecx, esi
mov word [esi + 0x142a], 3
call fcn.00410240
mov al, byte [esp + 0x13]
test al, al
je 0x4113cd
mov eax, dword [esp + 0x18]
mov ecx, 0x46a500
push eax
call fcn.0040cc50
lea ecx, [esi + 0xcc8]
call fcn.0040f780
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 2
mov ecx, esi
call fcn.00410240
mov ecx, esi
call fcn.0040d0c0
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
mov dword [esp + 0xcb8], 0xffffffff
call fcn.0040cf90
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0xcb0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xcac
ret