Function at 0x1000a322
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x7b0
push ebx
push ebp
push esi
push edi
push 0x140
xor ebp, ebp
mov dword [esp + 0x18], edx
lea eax, [esp + 0x124]
mov ebx, ecx
push ebp
push eax
call fcn.10026030
push 0x250
lea eax, [esp + 0x270]
push ebp
push eax
call fcn.10026030
mov eax, dword [ebx]
add esp, 0x18
mov eax, dword [eax + 0x328]
test eax, eax
je 0x1000a386
push ebx
call eax
pop ecx
cmp eax, 1
je 0x1000a386
mov ecx, ebx
call fcn.1000f51d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7b0
ret
mov ecx, dword [esp + 0x7c4]
lea edx, [esp + 0x18]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1000a393
lea edx, [esp + 0x18]
mov esi, str.My_Documents
mov ecx, ebp
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x1000a3bb
inc ecx
cmp ecx, 3
jne 0x1000a3a8
push 5
pop esi
jmp 0x1000a3be
or esi, 0xffffffff
push 7
lea eax, [esp + 0x1c]
push str.Desktop
push eax
call sub.ntdll.dll_memcmp
xor ecx, ecx
test eax, eax
push 0x11
lea eax, [esp + 0x28]
cmove esi, ecx
push str.Network_Favorites
push eax
call sub.ntdll.dll_memcmp
add esp, 0x18
test eax, eax
jne 0x1000a3f3
push 0x13
pop esi
jmp 0x1000a3f8
cmp esi, 0xffffffff
je 0x1000a45f
push ebp
push esi
lea eax, [esp + 0x4b8]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x18]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_strchr]
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x1000a44d
cmp byte [edx + 1], 0
je 0x1000a44d
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a426
lea edi, [esp + 0x4b0]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000a437
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
mov al, byte [esp + ecx + 0x4b0]
mov byte [esp + ecx + 0x18], al
inc ecx
test al, al
jne 0x1000a44f
lea ecx, [esp + 0x18]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a466
sub ecx, edx
mov eax, 0x10045bb4
mov edx, 0x10045bb0
cmp byte [esp + ecx + 0x17], 0x5c
cmove edx, eax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a483
lea edi, [esp + 0x18]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000a491
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a4ae
sub ecx, edx
xor edi, edi
lea eax, [ecx + 1]
push eax
lea ecx, [esp + 0x5bc]
push ecx
push eax
lea eax, [esp + 0x24]
push eax
push edi
push 0x4e3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0x5bc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
mov dl, 2
mov ecx, ebx
cmp ebp, 0xffffffff
jne 0x1000a50a
push edi
push edi
push edi
push 1
call fcn.1000a2a3
add esp, 0x10
jmp 0x1000a37b
push dword [esp + 0x7c4]
push dword [esp + 0x18]
push edi
push 1
call fcn.1000a2a3
add esp, 0x10
test eax, eax
je 0x1000a379
mov ecx, 0x10045bac
lea eax, [esp + 0x28c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a55a
test dx, dx
je 0x1000a556
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a55a
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a534
mov eax, edi
jmp 0x1000a55f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000a619
push 0xb
pop ecx
lea esi, [esp + 0x260]
lea edi, [esp + 0x120]
lea eax, [esp + 0x28c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
xor edi, edi
lea ecx, [esp + 0x14c]
push edi
push edi
inc eax
push eax
push ecx
push eax
lea eax, [esp + 0x2a0]
push eax
push 0x200
push 0x4e3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x494]
push eax
call esi
test eax, eax
je 0x1000a5e3
push edi
push edi
push eax
lea ecx, [esp + 0x25c]
push ecx
push eax
lea eax, [esp + 0x4a8]
push eax
push 0x200
push 0x4e3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x14c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a5ed
sub ecx, edx
lea eax, [esp + 0x120]
push eax
mov dl, 2
lea eax, [ecx + 0x2e]
mov ecx, ebx
push eax
push edi
push 1
call fcn.1000a2a3
add esp, 0x10
test eax, eax
je 0x1000a379
lea eax, [esp + 0x260]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000a528
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push edi
push edi
push edi
mov dl, 2
mov ecx, ebx
jmp 0x1000a4fd