Function at 0x41d7ec
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0xcdc
mov eax, 0x43176e
call fcn.0042f358
mov ebx, ecx
mov dword [ebp - 0xcb4], ebx
and dword [ebx + 4], 0
lea edi, [ebx + 0xc]
and dword [ebx + 8], 0
mov esi, 0x403870
mov ecx, esi
mov dword [ebp - 0xcbc], edi
call fcn.0040a8cc
push eax
push esi
mov ecx, edi
call fcn.0040a852
lea ecx, [ebx + 0x54]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0xcb8], ecx
cmp esi, ebx
je 0x41d857
push 0x28
pop edi
mov ecx, esi
call fcn.0041debd
add esi, edi
cmp esi, ebx
jne 0x41d83e
mov edi, dword [ebp - 0xcbc]
mov ecx, dword [ebp - 0xcb8]
mov eax, dword [ecx]
mov esi, 0x104
push 0xffffffffffffffff
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 8]
pop edx
movzx eax, cx
push 0x50
pop ebx
sub eax, 0x404
je 0x41da5a
sub eax, 0xd
je 0x41da52
sub eax, 1
je 0x41da4a
sub eax, 0x3f2
lea eax, [ebp - 0x218]
je 0x41da27
push ecx
push 0x4050e0
push esi
push eax
call fcn.00419392
add esp, 0x10
test eax, eax
js 0x41da40
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x41d8fb
push ebx
push 0x405068
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.00419392
add esp, 0x10
test eax, eax
js 0x41da40
push 0xffffffffffffffff
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41da40
lea eax, [ebp - 0x218]
push eax
push 0x405070
lea eax, [ebp - 0xa38]
push esi
push eax
call fcn.00419392
add esp, 0x10
test eax, eax
js 0x41da40
lea eax, [ebp - 0x420]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41da40
push 0xffffffffffffffff
push 0x403874
lea eax, [ebp - 0x420]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41da40
push 0xffffffffffffffff
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x420]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41da40
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x420]
mov dword [eax + 8], ebx
call fcn.0040a8cc
push eax
lea eax, [ebp - 0x420]
mov ecx, edi
push eax
call fcn.0040a852
mov ebx, dword [ebp - 0xcb4]
lea ecx, [ebx + 0x3c]
cmp dword [ecx + 0x14], 8
jb 0x41d9b9
mov ecx, dword [ecx]
lea eax, [ebx + 0x24]
cmp dword [eax + 0x14], 8
jb 0x41d9c4
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x41d9cc
mov edi, dword [edi]
push ecx
push eax
push edi
push 0x4050ac
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.00419392
add esp, 0x18
test eax, eax
js 0x41db1c
and dword [ebp - 0xcb0], 0
lea eax, [ebp - 0xcac]
push 0x24c
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindFirstFileW]
mov esi, eax
lea edi, [ebx + 0x54]
jmp 0x41db11
push edx
push 0x405050
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
cmp eax, ebx
jne 0x41d8b3
mov eax, 0x80004005
jmp 0x41db6c
push edx
push 0x403a34
jmp 0x41da60
push edx
push 0x403a28
jmp 0x41da60
push edx
push 0x40505c
lea eax, [ebp - 0x218]
jmp 0x41da2d
xor ecx, ecx
mov dword [ebp - 0xa4c], 7
xor eax, eax
mov dword [ebp - 0xa50], ecx
mov word [ebp - 0xa60], ax
mov dword [ebp - 0xa40], 0x402f44
mov dword [ebp - 0xa3c], ecx
mov dword [ebp - 0xa44], ecx
mov dword [ebp - 0xa48], ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xc84]
call fcn.0040a8cc
push eax
lea eax, [ebp - 0xc84]
push eax
lea ecx, [ebp - 0xa60]
call fcn.0040a852
mov eax, dword [ebp - 0xcac]
mov ecx, edi
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa60]
push eax
call fcn.0041df63
lea eax, [ebp - 0xcb0]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindNextFileW]
test eax, eax
jne 0x41db02
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindClose]
or esi, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.0041debd
cmp esi, 0xffffffff
jne 0x41da68
jmp 0x41db1f
lea edi, [ebx + 0x54]
lea ecx, [ebp - 0xce8]
call fcn.0041de94
mov esi, dword [ebx + 0x58]
mov edi, dword [edi]
sub esp, 0x28
mov dword [ebp - 4], 1
lea eax, [ebp - 0xce8]
mov ecx, esp
push eax
call fcn.0041e18c
mov eax, esi
sub eax, edi
push 0x28
pop ecx
cdq
idiv ecx
mov edx, esi
mov ecx, edi
push eax
call fcn.0041e1d6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce8]
call fcn.0041debd
xor eax, eax
call fcn.0042f2f8
ret 8