Function at 0x1002481d
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x388
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x384], eax
push ebx
mov ebx, dword [esp + 0x390]
push esi
xor esi, esi
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x1002485d
push sym.CoreFoundation.dll_kCFTypeArrayCallBacks
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFArrayCreateMutable
add esp, 0xc
jmp 0x10024d74
push ebp
mov ebp, 0x10186c68
push ebp
call sym.CoreFoundation.dll___CFSpinLock
xor eax, eax
inc eax
cmp dword [esp + 0x3a0], 2
pop ecx
jne 0x1002487e
mov eax, dword [0x10186c74]
jmp 0x10024891
cmp dword [esp + 0x39c], eax
mov eax, dword [0x10186c70]
je 0x10024891
mov eax, dword [0x10186c6c]
test eax, eax
je 0x100248ab
push ebx
push eax
call sym.CoreFoundation.dll_CFDictionaryGetValue
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100248ab
push esi
call sym.CoreFoundation.dll_CFRetain
pop ecx
push edi
push ebp
call sym.CoreFoundation.dll___CFSpinUnlock
pop ecx
test esi, esi
jne 0x10024d70
mov edi, sym.CoreFoundation.dll_kCFTypeArrayCallBacks
xor eax, eax
push edi
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
inc eax
mov dword [esp + 0x1c], eax
call sym.CoreFoundation.dll_CFArrayCreateMutable
push edi
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [esp + 0x48], eax
call sym.CoreFoundation.dll_CFArrayCreateMutable
push edi
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [esp + 0x44], eax
call sym.CoreFoundation.dll_CFArrayCreateMutable
mov edi, eax
mov byte [esp + 0x2b0], 0
mov ebp, 0x106
mov dword [esp + 0x40], edi
push ebp
lea eax, [esp + 0x2b4]
push eax
push ebx
call sym.CoreFoundation.dll_CFStringGetFileSystemRepresentation
add esp, 0x30
test al, al
je 0x10024bf3
xor eax, eax
inc eax
mov byte [esp + 0x14], al
lea eax, [esp + 0x28c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov ebx, dword [esp + 0x14]
mov edi, eax
pop ecx
mov dword [esp + 0x38], edi
mov edx, edi
mov ecx, edx
dec edx
test ecx, ecx
jle 0x10024968
mov al, byte [esp + edx + 0x28c]
cmp al, 0x5c
jne 0x1002495a
mov esi, edx
jmp 0x10024964
xor ecx, ecx
movzx ebx, bl
cmp al, 0x2e
cmovne ebx, ecx
test esi, esi
je 0x10024944
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x28], esi
test esi, esi
jle 0x10024ab7
lea eax, [esi + 1]
cmp eax, edi
jge 0x10024ab7
cmp byte [esp + 0x10], 0
jne 0x10024ab7
cmp esi, ebp
jae 0x10024d8b
lea eax, [esp + 0x28c]
mov byte [esp + esi + 0x28c], 0
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithFileSystemRepresentation
mov ebp, eax
mov dword [esp + 0x2c], ebp
pop ecx
pop ecx
test ebp, ebp
je 0x10024a9f
lea ecx, [esp + 0x28d]
add ecx, esi
push ecx
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithFileSystemRepresentation
mov dword [esp + 0x34], eax
pop ecx
pop ecx
test eax, eax
je 0x10024a98
push 0x10186c68
call sym.CoreFoundation.dll___CFSpinLock
pop ecx
mov ecx, dword [0x10186c6c]
test ecx, ecx
je 0x10024a83
push ebp
push ecx
call sym.CoreFoundation.dll_CFDictionaryGetValue
mov dword [esp + 0x3c], eax
pop ecx
pop ecx
test eax, eax
je 0x10024a83
push eax
mov byte [esp + 0x14], 0
call sym.CoreFoundation.dll_CFArrayGetCount
mov ebx, dword [esp + 0x38]
mov esi, eax
mov edi, dword [esp + 0x30]
xor eax, eax
pop ecx
mov ecx, dword [esp + 0x10]
xor ebp, ebp
inc eax
cmp ebp, esi
jge 0x10024a61
push eax
push ebp
push ebx
call sym.CoreFoundation.dll_CFArrayGetValueAtIndex
pop ecx
pop ecx
push eax
push edi
call sym.CoreFoundation.dll_CFStringCompare
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
movzx ecx, cl
push 1
pop eax
cmove ecx, eax
inc ebp
mov dword [esp + 0x10], ecx
test cl, cl
je 0x10024a31
mov eax, dword [esp + 0x14]
xor edx, edx
mov esi, dword [esp + 0x28]
test cl, cl
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x24]
movzx eax, al
cmove eax, edx
mov dword [esp + 0x14], eax
push 0x10186c68
call sym.CoreFoundation.dll___CFSpinUnlock
push dword [esp + 0x30]
call sym.CoreFoundation.dll_CFRelease
pop ecx
pop ecx
push ebp
call sym.CoreFoundation.dll_CFRelease
pop ecx
cmp byte [esp + 0x14], 0
mov byte [esp + esi + 0x28c], 0x5c
je 0x10024bef
mov ebp, 0x106
lea eax, [edi + 2]
cmp eax, ebp
jge 0x10024bef
mov word [esp + edi + 0x28c], 0x2a5c
jae 0x10024d8b
mov byte [esp + eax + 0x28c], 0
lea eax, [esp + 0x28c]
push 0x8000100
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCString
mov edi, eax
push edi
call sym.CoreFoundation.dll_CFStringGetLength
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebp, eax
push ebp
push esi
push 0
push edi
mov dword [esp + 0x48], ebp
call sym.CoreFoundation.dll_CFStringGetCharacters
xor eax, eax
push edi
mov word [ebp + esi*2], ax
call sym.CoreFoundation.dll_CFRelease
add esp, 0x28
lea eax, [esp + 0x3c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10024be7
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
push 0x2e
pop esi
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x10024bc4
cmp si, word [esp + 0x68]
jne 0x10024b7e
cmp eax, 1
je 0x10024bc4
cmp eax, 2
jne 0x10024b74
cmp si, word [esp + 0x6a]
je 0x10024bc4
push 0x5f
pop ecx
cmp cx, word [esp + 0x6a]
je 0x10024bc4
push 0
push 0x100
add eax, eax
push eax
lea eax, [esp + 0x74]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithBytes
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10024bc1
push esi
push ebx
call sym.CoreFoundation.dll_CFArrayAppendValue
cmp dword [esp + 0x44], 0x10
pop ecx
pop ecx
jne 0x10024bba
push esi
push ebp
call sym.CoreFoundation.dll_CFArrayAppendValue
pop ecx
pop ecx
push esi
call sym.CoreFoundation.dll_CFRelease
pop ecx
push 0x2e
pop esi
lea eax, [esp + 0x3c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10024b4c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x30]
mov esi, sym.CoreFoundation.dll_CFStringCompare
push 0
push esi
push ebp
call fcn.10001799
push 0
push esi
mov esi, dword [esp + 0x34]
push esi
call fcn.10001799
push 0
push sym.CoreFoundation.dll_CFStringCompare
push edi
call fcn.10001799
push 0x10186c68
call sym.CoreFoundation.dll___CFSpinLock
mov eax, dword [0x10186c6c]
add esp, 0x28
test eax, eax
jne 0x10024c57
push sym.CoreFoundation.dll_kCFTypeDictionaryValueCallBacks
push sym.CoreFoundation.dll_kCFCopyStringDictionaryKeyCallBacks
push 0x80
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFDictionaryCreateMutable
add esp, 0x10
mov dword [0x10186c6c], eax
push eax
call sym.CoreFoundation.dll_CFDictionaryGetCount
pop ecx
cmp eax, 0x80
jl 0x10024c71
push dword [0x10186c6c]
call sym.CoreFoundation.dll_CFDictionaryRemoveAllValues
pop ecx
push ebp
push ebx
push dword [0x10186c6c]
call sym.CoreFoundation.dll_CFDictionaryAddValue
mov eax, dword [0x10186c70]
add esp, 0xc
test eax, eax
jne 0x10024cac
push sym.CoreFoundation.dll_kCFTypeDictionaryValueCallBacks
push sym.CoreFoundation.dll_kCFCopyStringDictionaryKeyCallBacks
push 0x80
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFDictionaryCreateMutable
add esp, 0x10
mov dword [0x10186c70], eax
push eax
call sym.CoreFoundation.dll_CFDictionaryGetCount
pop ecx
cmp eax, 0x80
jl 0x10024cc6
push dword [0x10186c70]
call sym.CoreFoundation.dll_CFDictionaryRemoveAllValues
pop ecx
push esi
push ebx
push dword [0x10186c70]
call sym.CoreFoundation.dll_CFDictionaryAddValue
mov eax, dword [0x10186c74]
add esp, 0xc
test eax, eax
jne 0x10024d01
push sym.CoreFoundation.dll_kCFTypeDictionaryValueCallBacks
push sym.CoreFoundation.dll_kCFCopyStringDictionaryKeyCallBacks
push 0x80
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFDictionaryCreateMutable
add esp, 0x10
mov dword [0x10186c74], eax
push eax
call sym.CoreFoundation.dll_CFDictionaryGetCount
pop ecx
cmp eax, 0x80
jl 0x10024d1b
push dword [0x10186c74]
call sym.CoreFoundation.dll_CFDictionaryRemoveAllValues
pop ecx
push edi
push ebx
push dword [0x10186c74]
call sym.CoreFoundation.dll_CFDictionaryAddValue
add esp, 0xc
cmp dword [esp + 0x3a0], 2
jne 0x10024d39
mov eax, edi
jmp 0x10024d46
cmp dword [esp + 0x3a0], 1
mov eax, ebp
cmove eax, esi
push eax
call sym.CoreFoundation.dll_CFRetain
push ebp
mov esi, eax
call sym.CoreFoundation.dll_CFRelease
push dword [esp + 0x28]
call sym.CoreFoundation.dll_CFRelease
push edi
call sym.CoreFoundation.dll_CFRelease
push 0x10186c68
call sym.CoreFoundation.dll___CFSpinUnlock
add esp, 0x14
pop edi
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x38c]
pop esi
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x388
ret
call fcn.10001e29
int3