Function at 0x43e7b0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff990
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x570], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x43f04f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetDC
mov ebx, eax
push 0xc
push ebx
call sub.gdi32.dll_GetDeviceCaps
mov esi, eax
push 0xe
push ebx
call sub.gdi32.dll_GetDeviceCaps
imul esi, eax
push ebx
push 0
call sub.user32.dll_ReleaseDC
cmp esi, 8
jg 0x43e817
mov eax, dword [0x443b98]
mov byte [eax], 1
lea edx, [ebp - 0x56c]
mov eax, dword [0x444900]
call fcn.00407724
mov edx, dword [ebp - 0x56c]
lea eax, [ebp - 0x568]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f060
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43e86e
mov byte [0x4448fc], 0
jmp 0x43e875
mov byte [0x4448fc], 3
lea edx, [ebp - 0x56c]
mov eax, 1
call fcn.00402778
cmp dword [ebp - 0x56c], 0
je 0x43eb57
lea edx, [ebp - 0x570]
mov eax, 1
call fcn.00402778
mov eax, dword [ebp - 0x570]
call fcn.00403aa0
cmp eax, 2
jl 0x43eb57
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x56c]
mov eax, 1
call fcn.00402778
mov eax, dword [ebp - 0x56c]
mov ecx, 2
mov edx, 1
call fcn.00403ca4
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f068
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
je 0x43e955
lea eax, [ebp - 0x670]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x670]
lea edx, [ebp - 0x568]
call fcn.00410f14
lea eax, [ebp - 0x568]
mov edx, 0x43f06c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43e95c
mov byte [0x4448fc], 2
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f070
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
je 0x43e9d2
lea eax, [ebp - 0x670]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x670]
lea edx, [ebp - 0x568]
call fcn.00410f14
lea eax, [ebp - 0x568]
mov edx, 0x43f074
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43e9d9
mov byte [0x4448fc], 1
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f078
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
je 0x43ea4f
lea eax, [ebp - 0x670]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x670]
lea edx, [ebp - 0x568]
call fcn.00410f14
lea eax, [ebp - 0x568]
mov edx, 0x43f07c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43ea56
mov byte [0x4448fc], 3
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f080
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43ea98
mov byte [0x4448fc], 5
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f084
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
je 0x43eb0e
lea eax, [ebp - 0x670]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x670]
lea edx, [ebp - 0x568]
call fcn.00410f14
lea eax, [ebp - 0x568]
mov edx, 0x43f088
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43eb15
mov byte [0x4448fc], 4
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x568]
lea edx, [ebp - 0x468]
call fcn.00410f14
lea eax, [ebp - 0x468]
mov edx, 0x43f08c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402914
jne 0x43eb57
mov byte [0x4448fc], 6
mov eax, 0x4448bc
xor ecx, ecx
mov edx, 0x28
call fcn.00402984
mov eax, dword [0x443cb4]
mov eax, dword [eax]
mov dword [0x4448cc], eax
mov eax, 0x43f090
mov dword [0x4448e0], eax
push 4
call sub.gdi32.dll_GetStockObject
mov dword [0x4448d8], eax
push 0x43f0a8
mov eax, dword [0x443cb4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov dword [0x4448d0], eax
mov dword [0x4448bc], 0x80b
lea eax, [ebp - 0x225]
push eax
push 0x1f4
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x225]
call fcn.0040791c
cmp dword [ebp - 8], 0
je 0x43ebef
mov eax, dword [ebp - 8]
call fcn.00403aa0
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x43ebef
lea eax, [ebp - 8]
mov edx, 0x43f0bc
call fcn.00403aa8
lea eax, [ebp - 0x10]
mov ecx, 0x43f0c8
mov edx, dword [ebp - 8]
call fcn.00403aec
lea eax, [ebp - 0x368]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403c64
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43ec9b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0xffffffff
je 0x43ec84
jmp 0x43ec70
cmp dword [ebp - 0xc], 0xffffffff
je 0x43ec70
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x33c]
call fcn.0040791c
mov eax, dword [0x443d64]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
call fcn.00403d2c
test eax, eax
je 0x43ec70
lea eax, [ebp - 0x56c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00403aec
mov eax, dword [ebp - 0x56c]
call fcn.00407684
lea eax, [ebp - 0x368]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x43ec2d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43eca2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret