Function at 0x10001340
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1000c3ae
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x10011d50]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push esi
push edi
mov eax, dword [0x10011d50]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
xor bl, bl
call fcn.10003e10
push 0x104
lea eax, [esp + 0x16c]
push eax
mov dword [esp + 0x280], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 6
lea ecx, [esp + 0x14]
call fcn.10003730
push eax
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100013ee
lea ecx, [esp + 0x10]
mov dword [esp + 0x278], eax
call fcn.10003e00
xor al, al
jmp 0x10001556
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x28]
push ecx
push esi
call edi
test eax, eax
je 0x10001539
push 7
lea ecx, [esp + 0x14]
call fcn.10003730
mov cl, byte [esp + 0x54]
lea edx, [esp + 0x54]
cmp cl, byte [eax]
jne 0x1000142d
jmp 0x10001420
test cl, cl
je 0x1000142d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001420
movsx edx, byte [edx]
movsx eax, byte [eax]
sub edx, eax
jne 0x10001439
mov bl, 1
push 8
lea ecx, [esp + 0x14]
call fcn.10003730
mov cl, byte [esp + 0x54]
lea edx, [esp + 0x54]
cmp cl, byte [eax]
jne 0x1000145d
test cl, cl
je 0x1000145d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001450
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001469
mov bl, 1
push 9
lea ecx, [esp + 0x14]
call fcn.10003730
mov cl, byte [esp + 0x54]
lea edx, [esp + 0x54]
cmp cl, byte [eax]
jne 0x1000148d
test cl, cl
je 0x1000148d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001480
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001499
mov bl, 1
push 0xa
lea ecx, [esp + 0x14]
call fcn.10003730
mov cl, byte [esp + 0x54]
lea edx, [esp + 0x54]
cmp cl, byte [eax]
jne 0x100014bd
test cl, cl
je 0x100014bd
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100014b0
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x100014c9
mov bl, 1
push 0xb
lea ecx, [esp + 0x14]
call fcn.10003730
mov cl, byte [esp + 0x54]
lea edx, [esp + 0x54]
cmp cl, byte [eax]
jne 0x100014ed
test cl, cl
je 0x100014ed
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100014e0
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x100014f9
mov bl, 1
push 0xc
lea ecx, [esp + 0x14]
call fcn.10003730
mov cl, byte [esp + 0x54]
lea edx, [esp + 0x54]
cmp cl, byte [eax]
jne 0x1000151d
test cl, cl
je 0x1000151d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001510
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001529
mov bl, 1
lea eax, [esp + 0x28]
push eax
push esi
call edi
test eax, eax
jne 0x10001404
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov dword [esp + 0x278], 0xffffffff
call fcn.10003e00
mov al, bl
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.100051e2
add esp, 0x26c
ret