Function at 0x10025cf0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10ac
call fcn.1003dcd0
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x10a8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push 0x206
lea ecx, [esp + 0x486]
push ebx
push ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ebx
mov word [esp + 0x48c], bx
call fcn.1003d360
push 0x206
lea edx, [esp + 0x69a]
push ebx
push edx
mov word [esp + 0x6a0], bx
call fcn.1003d360
push 0x206
lea eax, [esp + 0x296]
push ebx
push eax
mov word [esp + 0x29c], bx
call fcn.1003d360
push 0x206
lea ecx, [esp + 0xac2]
push ebx
push ecx
mov word [esp + 0xac8], bx
call fcn.1003d360
push 0x206
lea edx, [esp + 0xede]
push ebx
push edx
mov word [esp + 0xee4], bx
call fcn.1003d360
push 0x206
lea eax, [esp + 0x8d2]
push ebx
push eax
mov word [esp + 0x8d8], bx
call fcn.1003d360
add esp, 0x48
push 0x206
lea ecx, [esp + 0xca6]
push ebx
push ecx
mov word [esp + 0xcac], bx
call fcn.1003d360
push 0x24c
lea edx, [esp + 0x3c]
push ebx
push edx
mov dword [esp + 0x40], ebx
call fcn.1003d360
add esp, 0x18
cmp dword [esi + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
je 0x10025e1b
cmp dword [esi + 0x1c], 8
jb 0x10025e16
mov edi, dword [esi + 8]
jmp 0x10025e97
lea edi, [esi + 8]
jmp 0x10025e97
cmp dword [esi + 0x34], ebx
je 0x10025e30
cmp dword [esi + 0x38], 8
jb 0x10025e2b
mov edi, dword [esi + 0x24]
jmp 0x10025e97
lea edi, [esi + 0x24]
jmp 0x10025e97
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x40]
push eax
push ecx
call fcn.10024f60
movzx eax, ax
cmp ax, 0x2e
mov dword [esp + 0x18], eax
jne 0x10025e6a
mov dword [esi + 0x50], 0x10000101
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10a8]
xor ecx, esp
call fcn.1003c13d
mov esp, ebp
pop ebp
ret 4
movzx edx, ax
push edx
push str._c:_
lea eax, [esp + 0x488]
push 0x104
push eax
mov dword [esp + 0x24], 1
call fcn.1003cd26
add esp, 0x10
lea edi, [esp + 0x480]
push edi
lea ecx, [esp + 0x68c]
push 0x104
push ecx
call fcn.1003e374
add esp, 0xc
lea edx, [esp + 0x688]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x1005877c
lea eax, [esp + 0x68c]
push 0x104
push eax
call fcn.10040110
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x68c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x10026110
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x10025f00
push edi
lea eax, [esp + 0x27c]
push 0x104
push eax
call fcn.1003e374
add esp, 0xc
lea ecx, [esp + 0x278]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x27c]
push 0x104
push eax
call fcn.10040110
lea ecx, [esp + 0x60]
push 0x10058784
push ecx
call fcn.1003c8ff
add esp, 0x14
test eax, eax
je 0x1002607c
lea edx, [esp + 0x54]
push 0x10058788
push edx
call fcn.1003c8ff
add esp, 8
test eax, eax
je 0x1002607c
test byte [esp + 0x28], 0x10
je 0x1002607c
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0xa9c]
push 0x104
push ecx
call fcn.1003e374
push str.EXPLORER.EXE
lea edx, [esp + 0xaa8]
push 0x104
push edx
call fcn.10040110
lea eax, [esp + 0x290]
push eax
lea ecx, [esp + 0xcbc]
push 0x104
push ecx
call fcn.1003e374
push str.WIN.INI
lea edx, [esp + 0xcc8]
push 0x104
push edx
call fcn.10040110
lea eax, [esp + 0x2a8]
push eax
lea ecx, [esp + 0xedc]
push 0x104
push ecx
call fcn.1003e374
push str.SYSTEM32CONFIG
lea edx, [esp + 0xee8]
push 0x104
push edx
call fcn.10040110
add esp, 0x48
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0x894]
push 0x104
push ecx
call fcn.1003e374
push str.SYSTEM32WINPESHL.EXE
lea edx, [esp + 0x8a0]
push 0x104
push edx
call fcn.10040110
add esp, 0x18
lea eax, [esp + 0xa98]
push eax
call esi
test eax, eax
je 0x10026060
lea ecx, [esp + 0x890]
push ecx
call esi
test eax, eax
je 0x10026096
lea edx, [esp + 0xca0]
push edx
call esi
test eax, eax
je 0x1002607c
lea eax, [esp + 0x890]
push eax
call esi
test eax, eax
je 0x100260ca
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10025f00
jmp 0x10026101
lea eax, [esp + 0x278]
mov dword [esp + 0x10], 1
lea edx, [eax + 2]
jmp 0x100260b0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100260b0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x27c]
push eax
jmp 0x100260f8
lea eax, [esp + 0x278]
mov dword [esp + 0x10], 1
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100260e0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x27c]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.10001bf0
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x14], ebx
je 0x10026147
movzx eax, word [esp + 0x18]
push eax
push 0x10058458
lea ecx, [esp + 0x488]
push 0x104
push ecx
call fcn.1003cd26
add esp, 0x10
push ebx
lea edx, [esp + 0x484]
push edx
push 3
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov ecx, dword [esp + 0x10b4]
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi + 0x50], ebx
pop esi
pop ebx
xor ecx, esp
call fcn.1003c13d
mov esp, ebp
pop ebp
ret 4