Function at 0x408310
Capabilities:
Enumerate files on windows
Get common file path
Query environment variable
Read .ini file

Disassembly:
mov eax, 0x160c
call fcn.0040a710
mov eax, dword [0x423640]
xor eax, esp
mov dword [esp + 0x1608], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebp, 0x423134
jmp 0x408340
mov ecx, dword [ebp]
push 0x400
lea eax, [esp + 0xa1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0xa18]
push edx
lea eax, [esp + 0xe1c]
push str._s.
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xe1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40846c
mov ecx, 0x41cae4
lea eax, [esp + 0x40]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4083c0
test dl, dl
je 0x4083bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4083c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4083a0
xor eax, eax
jmp 0x4083c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408451
mov ecx, 0x41cd3c
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4083f6
test dl, dl
je 0x4083f2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4083f6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4083d6
xor eax, eax
jmp 0x4083fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408451
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0xa1c]
push ecx
lea edx, [esp + 0x220]
push str._s_s
push edx
call esi
lea eax, [esp + 0x1228]
push eax
lea ecx, [esp + 0x22c]
call fcn.00407060
add esp, 0x14
test eax, eax
je 0x408451
push 3
lea esi, [esp + 0x121c]
call fcn.00407460
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408395
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
add ebp, 4
cmp ebp, 0x423150
jl 0x408340
mov ebp, 0x423630
mov edx, dword [ebp]
push 0
push edx
lea eax, [esp + 0xa20]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0xa18]
push ecx
lea edx, [esp + 0xe1c]
push str._s.
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xe1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4085ac
mov edi, edi
mov ecx, 0x41cae4
lea eax, [esp + 0x40]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408500
test dl, dl
je 0x4084fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408500
add eax, 2
add ecx, 2
test dl, dl
jne 0x4084e0
xor eax, eax
jmp 0x408505
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408591
mov ecx, 0x41cd3c
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408536
test dl, dl
je 0x408532
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408536
add eax, 2
add ecx, 2
test dl, dl
jne 0x408516
xor eax, eax
jmp 0x40853b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408591
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0xa1c]
push eax
lea ecx, [esp + 0x220]
push str._s_s
push ecx
call esi
lea edx, [esp + 0x1228]
push edx
lea ecx, [esp + 0x22c]
call fcn.00407060
add esp, 0x14
test eax, eax
je 0x408591
push 3
lea esi, [esp + 0x121c]
call fcn.00407460
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [esp + 0x14]
add esp, 4
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4084d0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
add ebp, 4
cmp ebp, str.___t_n
jl 0x408480
mov ecx, dword [str.c:explorer.exe]
mov eax, dword [0x41cd34]
mov edx, dword [0x41cd30]
mov dword [esp + 0x174], ecx
mov ecx, dword [0x41cd38]
mov dword [esp + 0x17c], eax
lea eax, [esp + 0x174]
mov dword [esp + 0x178], edx
mov dword [esp + 0x180], ecx
call fcn.00406800
test eax, eax
je 0x408613
push 3
lea esi, [esp + 0x178]
call fcn.00407460
mov edi, dword [esp + 0x14]
add esp, 4
mov edx, dword [str.c:_autoexec.bat]
mov eax, dword [0x41cd20]
mov ecx, dword [0x41cd24]
mov dword [esp + 0x164], edx
mov edx, dword [0x41cd28]
mov dword [esp + 0x168], eax
lea eax, [esp + 0x164]
mov dword [esp + 0x16c], ecx
mov dword [esp + 0x170], edx
call fcn.00406800
test eax, eax
je 0x40866b
push 3
lea esi, [esp + 0x168]
call fcn.00407460
mov edi, dword [esp + 0x14]
add esp, 4
mov eax, dword [str.c:config.sys]
mov ecx, dword [0x41cd10]
mov edx, dword [0x41cd14]
mov dword [esp + 0x154], eax
mov ax, word [0x41cd18]
mov word [esp + 0x160], ax
lea eax, [esp + 0x154]
mov dword [esp + 0x158], ecx
mov dword [esp + 0x15c], edx
call fcn.00406800
test eax, eax
je 0x4086c4
push 3
lea esi, [esp + 0x158]
call fcn.00407460
mov edi, dword [esp + 0x14]
add esp, 4
mov ecx, dword [str._WINDIR_winstart.bat]
mov edx, dword [0x41ccf8]
mov eax, dword [0x41ccfc]
mov dword [esp + 0x1b0], ecx
mov ecx, dword [0x41cd00]
mov dword [esp + 0x1bc], ecx
lea ecx, [esp + 0x218]
mov dword [esp + 0x1b4], edx
mov edx, dword [0x41cd04]
mov dword [esp + 0x1b8], eax
mov ax, word [0x41cd08]
push ecx
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x1c4], edx
mov word [esp + 0x1c8], ax
call fcn.00407060
add esp, 4
test eax, eax
je 0x408742
push 3
lea esi, [esp + 0x21c]
call fcn.00407460
mov edi, dword [esp + 0x14]
add esp, 4
mov edx, dword [str._WINDIR_dostart.bat]
mov ecx, dword [0x41cce4]
mov eax, dword [0x41cce0]
mov dword [esp + 0x198], edx
mov edx, dword [0x41cce8]
mov dword [esp + 0x1a0], ecx
mov cl, byte [0x41ccf0]
mov dword [esp + 0x1a4], edx
mov dword [esp + 0x19c], eax
mov eax, dword [0x41ccec]
lea edx, [esp + 0x218]
mov byte [esp + 0x1ac], cl
push edx
lea ecx, [esp + 0x19c]
mov dword [esp + 0x1ac], eax
call fcn.00407060
add esp, 4
test eax, eax
je 0x4087ba
push 3
lea esi, [esp + 0x21c]
call fcn.00407460
add esp, 4
mov ecx, 7
mov esi, str._WINDIR__system32_autoexec.nt
lea edi, [esp + 0x1f8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x1fc]
movsw word es:[edi], word [esi]
call fcn.00407060
mov ebp, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x408801
push 3
lea esi, [esp + 0x21c]
mov edi, ebp
call fcn.00407460
add esp, 4
mov ecx, 7
mov esi, str._WINDIR__system32config.nt
lea edi, [esp + 0x1dc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x1e0]
call fcn.00407060
add esp, 4
test eax, eax
je 0x408842
push 3
lea esi, [esp + 0x21c]
mov edi, ebp
call fcn.00407460
add esp, 4
mov ecx, dword [0x41cc94]
mov edx, dword [str._WINDIR_win.ini]
mov eax, dword [0x41cc90]
mov dword [esp + 0x18c], ecx
lea ecx, [esp + 0x218]
mov dword [esp + 0x184], edx
mov edx, dword [0x41cc98]
mov dword [esp + 0x188], eax
mov al, byte [0x41cc9c]
push ecx
lea ecx, [esp + 0x188]
mov dword [esp + 0x194], edx
mov byte [esp + 0x198], al
call fcn.00407060
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
test eax, eax
je 0x408956
lea edx, [esp + 0x218]
push edx
push 0x400
lea eax, [esp + 0x620]
push eax
push 0x421364
push str.load
push str.windows
call ebx
test eax, eax
je 0x4088fe
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x61c]
call fcn.00407060
add esp, 4
test eax, eax
je 0x4088fe
push 3
lea esi, [esp + 0x21c]
mov edi, ebp
call fcn.00407460
add esp, 4
lea edx, [esp + 0x218]
push edx
push 0x400
lea eax, [esp + 0x620]
push eax
push 0x421364
push 0x41cc78
push str.windows
call ebx
test eax, eax
je 0x408956
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x61c]
call fcn.00407060
add esp, 4
test eax, eax
je 0x408956
push 3
lea esi, [esp + 0x21c]
mov edi, ebp
call fcn.00407460
add esp, 4
mov ecx, dword [0x41cc6c]
mov edx, dword [str._WINDIR__system.ini]
mov eax, dword [0x41cc68]
mov dword [esp + 0x1d0], ecx
lea ecx, [esp + 0x218]
mov dword [esp + 0x1c8], edx
mov edx, dword [0x41cc70]
mov dword [esp + 0x1cc], eax
mov eax, dword [0x41cc74]
push ecx
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x1d8], edx
mov dword [esp + 0x1dc], eax
call fcn.00407060
add esp, 4
test eax, eax
je 0x408a64
lea edx, [esp + 0x218]
push edx
push 0x400
lea eax, [esp + 0x620]
push eax
push 0x421364
push str.shell
push str.boot
call ebx
test eax, eax
je 0x408a0c
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x61c]
call fcn.00407060
add esp, 4
test eax, eax
je 0x408a0c
push 3
lea esi, [esp + 0x21c]
mov edi, ebp
call fcn.00407460
add esp, 4
lea edx, [esp + 0x218]
push edx
push 0x400
lea eax, [esp + 0x620]
push eax
push 0x421364
push str.scrnsave.exe
push str.boot
call ebx
test eax, eax
je 0x408a64
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x61c]
call fcn.00407060
add esp, 4
test eax, eax
je 0x408a64
push 3
lea esi, [esp + 0x21c]
mov edi, ebp
call fcn.00407460
add esp, 4
mov ecx, dword [esp + 0x1618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00409279
add esp, 0x160c
ret