Function at 0x100093a0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa0
mov eax, dword [0x10038654]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 0x13
lea ecx, [ebp - 0x224]
push ecx
push 0
mov dword [ebp - 0xa98], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x224]
mov edi, 0x2800
push edx
mov dword [ebp - 0xa94], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x226], 0x5c
mov esi, 0x10033c94
jne 0x100093ff
mov esi, 0x10033c00
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push esi
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x83c]
push 0x10033ce4
push eax
mov dword [ebp - 0x18], 0x730025
mov dword [ebp - 0x14], 0x730025
mov dword [ebp - 0x10], 0x2e002a
mov dword [ebp - 0xc], 0x2a
call ebx
push esi
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x42c]
push eax
call ebx
add esp, 0x20
lea ecx, [ebp - 0xa8c]
push ecx
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa9c], eax
cmp eax, 0xffffffff
je 0x10009619
push 0x2800
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xa90], eax
mov byte [eax], 0x35
mov ebx, 1
jmp 0x1000949c
mov edi, dword [ebp - 0xa94]
mov eax, dword [ebp - 0xa90]
lea ecx, [edi - 0x208]
cmp ebx, ecx
jbe 0x100094c2
add edi, 0x208
push 0x42
push edi
push eax
mov dword [ebp - 0xa94], edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0xa90], eax
mov ecx, 0x10033ca4
lea eax, [ebp - 0xa60]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100094f6
test dx, dx
je 0x100094f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100094f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100094d0
xor eax, eax
jmp 0x100094fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100095cd
mov ecx, 0x10033ca8
lea eax, [ebp - 0xa60]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10009536
test dx, dx
je 0x10009532
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10009536
add eax, 4
add ecx, 4
test dx, dx
jne 0x10009510
xor eax, eax
jmp 0x1000953b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100095cd
lea edx, [ebp - 0xa60]
push edx
push 0x10033cf0
call fcn.100190a6
lea eax, [ebp - 0xa60]
push eax
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x634]
push 0x10033ce4
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
call fcn.1001721c
mov esi, eax
add esp, 0x1c
lea eax, [ebp - 0x634]
push eax
mov dword [esi], 0
call fcn.10009300
test al, al
je 0x100095cd
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, dword [ebp - 0xa90]
push edi
lea ecx, [eax + ebx + 4]
push esi
push ecx
mov dword [eax + ebx], edi
call fcn.1001add0
add esp, 0xc
lea ebx, [ebx + edi + 4]
test esi, esi
je 0x100095cd
push esi
call fcn.10018bf7
add esp, 4
mov eax, dword [ebp - 0xa9c]
lea edx, [ebp - 0xa8c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10009490
cmp ebx, 1
je 0x10009619
mov eax, dword [ebp - 0xa98]
cmp dword [eax + 8], 0
jne 0x1000960c
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xa90]
mov edx, dword [edx + 8]
push ebx
push eax
call edx
mov eax, dword [ebp - 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100180fb
mov esp, ebp
pop ebp
ret 4