Function at 0x42d520
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5cae3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebp
push edi
lea eax, [esp + 0x14c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x14c]
push ecx
lea ecx, [esp + 0xc]
call fcn.005980a0
xor edi, edi
push str._twain.dll
lea ecx, [esp + 0xc]
mov dword [esp + 0x26c], edi
call fcn.0059840e
mov edx, dword [esp + 8]
push edi
push edx
call fcn.004f6fcf
add esp, 8
test eax, eax
jge 0x42d5b7
lea ecx, [esp + 8]
mov dword [esp + 0x268], 0xffffffff
call fcn.00598032
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
add esp, 0x264
ret
lea eax, [esp + 0x14c]
lea ecx, [esp + 8]
push eax
call fcn.005981bb
push str._twain_32_
lea ecx, [esp + 0xc]
call fcn.0059840e
mov ecx, dword [esp + 8]
push edi
push ecx
call fcn.004f6fcf
add esp, 8
test eax, eax
jge 0x42d615
lea ecx, [esp + 8]
mov dword [esp + 0x268], 0xffffffff
call fcn.00598032
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
add esp, 0x264
ret
mov edx, dword [esp + 8]
push edx
call fcn.0042d7c0
add esp, 4
test eax, eax
je 0x42d656
lea ecx, [esp + 8]
mov dword [esp + 0x268], 0xffffffff
call fcn.00598032
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
add esp, 0x264
ret
push 0x620b58
lea ecx, [esp + 0xc]
call fcn.0059840e
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x42d6a4
lea ecx, [esp + 8]
mov dword [esp + 0x268], eax
call fcn.00598032
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
add esp, 0x264
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42d776
mov esi, 0x61ea1c
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42d6e5
test cl, cl
je 0x42d6e1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42d6e5
add eax, 2
add esi, 2
test cl, cl
jne 0x42d6c1
xor eax, eax
jmp 0x42d6ea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42d776
mov esi, 0x620b54
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42d71f
test cl, cl
je 0x42d71b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42d71f
add eax, 2
add esi, 2
test cl, cl
jne 0x42d6fb
xor eax, eax
jmp 0x42d724
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42d776
lea eax, [esp + 0x154]
lea ecx, [esp + 0x10]
push eax
call fcn.005981bb
push str._twain_32_
lea ecx, [esp + 0x14]
call fcn.0059840e
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x14]
call fcn.0059840e
push 0x61e354
lea ecx, [esp + 0x14]
call fcn.0059840e
mov edx, dword [esp + 0x10]
push edx
call fcn.0042d7c0
mov edi, eax
add esp, 4
test edi, edi
jne 0x42d786
lea eax, [esp + 0x14]
push eax
push ebp
call ebx
test eax, eax
jne 0x42d6ac
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov dword [esp + 0x270], 0xffffffff
call fcn.00598032
mov ecx, dword [esp + 0x268]
pop esi
mov eax, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x264
ret