Function at 0x10003201
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x100511e9
sub esp, 0x698
mov eax, dword [0x10184508]
xor eax, esp
mov dword [esp + 0x694], eax
mov eax, dword [esp + 0x69c]
push ebx
push ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x6b0]
push esi
mov esi, dword [esp + 0x6ac]
mov dword [esp + 0x14], eax
xor al, al
mov byte [esp + 0xf], al
push edi
mov edi, dword [esp + 0x6bc]
test esi, esi
je 0x1005123a
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
mov ebp, eax
jmp 0x1005123c
xor ebp, ebp
test edi, edi
je 0x1005124f
push edi
call sym.CoreFoundation.dll__CFCopyExtensionForAbstractType
pop ecx
mov ebx, eax
mov dword [esp + 0x30], eax
jmp 0x10051255
xor ebx, ebx
mov dword [esp + 0x30], ebx
test ebx, ebx
je 0x10051262
push ebx
call sym.CoreFoundation.dll_CFStringGetLength
pop ecx
jmp 0x10051264
xor eax, eax
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
test eax, eax
jle 0x100512fe
and dword [esp + 0x14], edi
lea ecx, [esp + 0x14]
push ecx
push 0x104
lea ecx, [esp + 0x4a0]
push ecx
push edi
push edi
push 0x100
push eax
push edi
push ebx
call sym.CoreFoundation.dll_CFStringGetBytes
mov eax, dword [esp + 0x38]
add esp, 0x24
shr eax, 1
mov dword [esp + 0x1c], eax
add eax, eax
cmp eax, 0x20c
jae 0x10051643
xor ecx, ecx
push 0x2e
mov word [esp + eax + 0x49c], cx
lea ecx, [esp + 0x49c]
pop edx
cmp word [esp + 0x498], dx
lea eax, [esp + 0x49a]
push edx
cmovne eax, ecx
push eax
call sub.VCRUNTIME140.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x100512fe
add eax, 2
inc edi
push 0x2e
push eax
call sub.VCRUNTIME140.dll_wcschr
pop ecx
pop ecx
test eax, eax
jne 0x100512e8
mov dword [esp + 0x20], edi
test esi, esi
jne 0x10051337
push 0x104
lea eax, [esp + 0x290]
push eax
push 1
push dword [esp + 0x24]
call sym.CoreFoundation.dll__CFURLGetWideFileSystemRepresentation
add esp, 0x10
test al, al
je 0x100513ee
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov ebp, eax
jmp 0x10051384
push 0x8000100
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCString
mov edi, eax
push edi
call sym.CoreFoundation.dll_CFStringGetLength
mov esi, eax
lea eax, [esp + 0x29c]
push eax
push esi
push 0
push edi
call sym.CoreFoundation.dll_CFStringGetCharacters
add esi, esi
add esp, 0x20
cmp esi, 0x20c
jae 0x10051643
xor eax, eax
push edi
mov word [esp + esi + 0x290], ax
call sym.CoreFoundation.dll_CFRelease
lea eax, [ebp + 2]
pop ecx
cmp eax, 0x104
jge 0x100513ee
add ebp, ebp
add eax, eax
push 0x5c
pop ecx
push 0x2a
mov word [esp + ebp + 0x290], cx
mov esi, 0x20c
pop ecx
mov word [esp + ebp + 0x28e], cx
cmp eax, esi
jae 0x10051643
xor ecx, ecx
mov word [esp + eax + 0x28c], cx
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x10051400
cmp ebp, esi
jae 0x10051643
xor eax, eax
mov word [esp + ebp + 0x28c], ax
test ebx, ebx
je 0x100513f9
push ebx
call sym.CoreFoundation.dll_CFRelease
pop ecx
xor eax, eax
jmp 0x1005162a
push sym.CoreFoundation.dll_kCFTypeArrayCallBacks
push 0
push dword [esp + 0x2c]
call sym.CoreFoundation.dll_CFArrayCreateMutable
mov ebx, dword [esp + 0x28]
add esp, 0xc
mov esi, dword [esp + 0x14]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
mov edi, eax
push 0x2e
pop eax
mov dword [esp + 0x2c], edi
cmp word [esp + 0x68], ax
jne 0x10051454
cmp edi, 1
je 0x100515d9
cmp edi, 2
jne 0x10051454
cmp word [esp + 0x6a], ax
je 0x100515d9
cmp ebx, edi
jg 0x100515d9
test ebx, ebx
jle 0x10051541
cmp word [esp + edi*2 + 0x66], ax
je 0x100515d9
push eax
xor esi, esi
lea eax, [esp + 0x6c]
push eax
cmp dword [esp + 0x28], esi
jne 0x10051488
call sub.VCRUNTIME140.dll_wcsrchr
pop ecx
pop ecx
mov esi, eax
jmp 0x100514fa
call sub.VCRUNTIME140.dll_wcschr
mov dword [esp + 0x30], eax
pop ecx
pop ecx
test eax, eax
je 0x100515d5
mov dword [esp + 0x38], eax
test esi, esi
jne 0x10051504
push 0x2e
pop ecx
push ecx
push eax
xor edi, edi
call sub.VCRUNTIME140.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x100514d2
mov esi, dword [esp + 0x20]
push 0x2e
pop ebx
inc edi
cmp edi, esi
je 0x100514ce
push ebx
push eax
call sub.VCRUNTIME140.dll_wcschr
pop ecx
pop ecx
test eax, eax
jne 0x100514bc
mov ebx, dword [esp + 0x1c]
push 0x2e
pop eax
push eax
push dword [esp + 0x2c]
call sub.VCRUNTIME140.dll_wcschr
mov esi, dword [esp + 0x40]
pop ecx
pop ecx
xor ecx, ecx
mov dword [esp + 0x28], eax
cmp edi, dword [esp + 0x20]
cmovne esi, ecx
test eax, eax
jne 0x1005149b
mov edi, dword [esp + 0x2c]
test esi, esi
je 0x100515d5
jmp 0x10051508
mov edi, dword [esp + 0x2c]
push 0x2e
pop eax
cmp word [esp + 0x498], ax
je 0x10051518
add esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, ebx
jne 0x100515d5
lea eax, [esp + 0x498]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100515d5
cmp dword [esp + 0x18], 0
jne 0x10051583
push 0
push 0x100
push ebp
lea eax, [esp + 0x298]
push eax
push dword [esp + 0x34]
call sym.CoreFoundation.dll_CFStringCreateWithBytes
push 1
mov esi, eax
push 2
push esi
push dword [esp + 0x44]
call sym.CoreFoundation.dll_CFURLCreateWithFileSystemPath
push esi
mov dword [esp + 0x40], eax
call sym.CoreFoundation.dll_CFRelease
add esp, 0x28
mov byte [esp + 0x13], 1
mov esi, dword [esp + 0x24]
lea ecx, [edi + edi]
push 0
push 0x100
push ecx
lea eax, [esp + 0x74]
push eax
push esi
call sym.CoreFoundation.dll_CFStringCreateWithBytes
mov ecx, dword [esp + 0x50]
mov edi, eax
push dword [esp + 0x2c]
shr ecx, 4
and cl, 1
movzx ecx, cl
push ecx
push 2
push edi
push esi
call sym.CoreFoundation.dll_CFURLCreateWithFileSystemPathRelativeToBase
mov esi, eax
push esi
push dword [esp + 0x60]
call sym.CoreFoundation.dll_CFArrayAppendValue
push esi
call sym.CoreFoundation.dll_CFRelease
push edi
call sym.CoreFoundation.dll_CFRelease
add esp, 0x38
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1005141f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x30]
cmp ebp, 0x20c
jae 0x10051643
xor eax, eax
mov word [esp + ebp + 0x28c], ax
test ebx, ebx
je 0x10051615
push ebx
call sym.CoreFoundation.dll_CFRelease
pop ecx
cmp byte [esp + 0x13], 0
je 0x10051626
push dword [esp + 0x18]
call sym.CoreFoundation.dll_CFRelease
pop ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x6a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x698
ret
call fcn.10001e29
int3