Function at 0x1002487d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x304]
sub esp, 0x380
mov eax, dword [0x10178af8]
xor eax, ebp
mov dword [ebp + 0x300], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x6c], ebx
cmp ebx, esi
jne 0x100248be
push sym.CoreFoundation.dll_kCFTypeArrayCallBacks
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFArrayCreateMutable
add esp, 0xc
jmp 0x10024d38
push edi
mov edi, 0x1017b0f0
push edi
call sym.CoreFoundation.dll___CFSpinLock
cmp dword [ebp + 0x30c], 2
pop ecx
jne 0x100248db
mov eax, dword [0x1017b0fc]
jmp 0x100248ee
cmp dword [ebp + 0x30c], 1
mov eax, dword [0x1017b0f8]
je 0x100248ee
mov eax, dword [0x1017b0f4]
test eax, eax
je 0x10024908
push ebx
push eax
call sym.CoreFoundation.dll_CFDictionaryGetValue
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10024908
push esi
call sym.CoreFoundation.dll_CFRetain
pop ecx
push edi
call sym.CoreFoundation.dll___CFSpinUnlock
pop ecx
test esi, esi
jne 0x10024d35
mov esi, sym.CoreFoundation.dll_kCFTypeArrayCallBacks
push esi
xor edi, edi
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov byte [ebp - 0x59], 1
call sym.CoreFoundation.dll_CFArrayCreateMutable
push esi
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [ebp - 0x64], eax
call sym.CoreFoundation.dll_CFArrayCreateMutable
push esi
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [ebp - 0x60], eax
call sym.CoreFoundation.dll_CFArrayCreateMutable
mov dword [ebp - 0x68], eax
push 0x106
lea eax, [ebp + 0x1f8]
push eax
push ebx
mov byte [ebp + 0x1f8], 0
call sym.CoreFoundation.dll_CFStringGetFileSystemRepresentation
add esp, 0x30
test al, al
je 0x10024bc9
lea eax, [ebp + 0x1f8]
push eax
mov byte [ebp - 0x5a], 1
call fcn.10128470
mov esi, eax
pop ecx
mov ecx, esi
mov eax, ecx
dec ecx
test eax, eax
jle 0x100249ad
mov al, byte [ebp + ecx + 0x1f8]
cmp al, 0x5c
jne 0x100249a1
mov edi, ecx
jmp 0x100249a9
cmp al, 0x2e
je 0x100249a9
mov byte [ebp - 0x59], 0
test edi, edi
je 0x1002498b
test edi, edi
jle 0x10024aad
lea eax, [edi + 1]
cmp eax, esi
jge 0x10024aad
cmp byte [ebp - 0x59], 0
jne 0x10024aad
lea eax, [ebp + 0x1f8]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
lea ebx, [ebp + edi + 0x1f8]
mov dword [ebp - 0x70], ebx
mov byte [ebx], 0
call sym.CoreFoundation.dll_CFStringCreateWithFileSystemRepresentation
pop ecx
pop ecx
mov dword [ebp - 0x78], eax
test eax, eax
je 0x10024aa0
lea eax, [ebp + edi + 0x1f9]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithFileSystemRepresentation
pop ecx
pop ecx
mov dword [ebp - 0x74], eax
test eax, eax
je 0x10024a97
push 0x1017b0f0
call sym.CoreFoundation.dll___CFSpinLock
mov eax, dword [0x1017b0f4]
pop ecx
test eax, eax
je 0x10024a80
push dword [ebp - 0x78]
push eax
call sym.CoreFoundation.dll_CFDictionaryGetValue
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10024a80
push ebx
mov byte [ebp - 0x59], 0
call sym.CoreFoundation.dll_CFArrayGetCount
pop ecx
mov dword [ebp - 0x7c], eax
xor edi, edi
cmp edi, dword [ebp - 0x7c]
jge 0x10024a76
push 1
push edi
push ebx
call sym.CoreFoundation.dll_CFArrayGetValueAtIndex
pop ecx
pop ecx
push eax
push dword [ebp - 0x74]
call sym.CoreFoundation.dll_CFStringCompare
add esp, 0xc
test eax, eax
jne 0x10024a6f
mov byte [ebp - 0x59], 1
inc edi
cmp byte [ebp - 0x59], 0
je 0x10024a4b
cmp byte [ebp - 0x59], 0
jne 0x10024a80
mov byte [ebp - 0x5a], 0
push 0x1017b0f0
call sym.CoreFoundation.dll___CFSpinUnlock
push dword [ebp - 0x74]
call sym.CoreFoundation.dll_CFRelease
mov ebx, dword [ebp - 0x70]
pop ecx
pop ecx
push dword [ebp - 0x78]
call sym.CoreFoundation.dll_CFRelease
pop ecx
cmp byte [ebp - 0x5a], 0
mov byte [ebx], 0x5c
je 0x10024bc9
lea eax, [esi + 2]
cmp eax, 0x106
jge 0x10024bc9
push 0x8000100
lea eax, [ebp + 0x1f8]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov word [ebp + esi + 0x1f8], 0x2a5c
mov byte [ebp + esi + 0x1fa], 0
call sym.CoreFoundation.dll_CFStringCreateWithCString
mov ebx, eax
push ebx
call sym.CoreFoundation.dll_CFStringGetLength
mov edi, eax
lea esi, [edi + edi]
lea eax, [esi + 2]
push eax
call dword [0x10181090]
push eax
xor ecx, ecx
push edi
push ecx
push ebx
mov dword [ebp - 0x70], eax
call sym.CoreFoundation.dll_CFStringGetCharacters
mov edi, dword [ebp - 0x70]
xor eax, eax
push ebx
mov word [esi + edi], ax
call sym.CoreFoundation.dll_CFRelease
add esp, 0x28
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10024bc1
lea eax, [ebp - 0x2c]
push eax
call dword [0x10180ee4]
pop ecx
test eax, eax
je 0x10024ba7
push 0x2e
pop ecx
cmp cx, word [ebp - 0x2c]
jne 0x10024b62
cmp eax, 1
je 0x10024ba7
cmp eax, 2
jne 0x10024b59
cmp cx, word [ebp - 0x2a]
je 0x10024ba7
push 0x5f
pop ecx
cmp cx, word [ebp - 0x2a]
je 0x10024ba7
push 0
push 0x100
add eax, eax
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithBytes
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10024ba7
push esi
push dword [ebp - 0x64]
call sym.CoreFoundation.dll_CFArrayAppendValue
cmp dword [ebp - 0x58], 0x10
pop ecx
pop ecx
jne 0x10024ba0
push esi
push dword [ebp - 0x60]
call sym.CoreFoundation.dll_CFArrayAppendValue
pop ecx
pop ecx
push esi
call sym.CoreFoundation.dll_CFRelease
pop ecx
lea eax, [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10024b31
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [0x10181098]
pop ecx
push 0
mov esi, sym.CoreFoundation.dll_CFStringCompare
push esi
push dword [ebp - 0x64]
call fcn.10001ea6
push 0
push esi
push dword [ebp - 0x60]
call fcn.10001ea6
push 0
push esi
push dword [ebp - 0x68]
call fcn.10001ea6
push 0x1017b0f0
call sym.CoreFoundation.dll___CFSpinLock
mov eax, dword [0x1017b0f4]
add esp, 0x28
mov ebx, sym.CoreFoundation.dll_kCFTypeDictionaryValueCallBacks
mov edi, sym.CoreFoundation.dll_kCFCopyStringDictionaryKeyCallBacks
mov esi, 0x80
test eax, eax
jne 0x10024c2a
push ebx
push edi
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFDictionaryCreateMutable
add esp, 0x10
mov dword [0x1017b0f4], eax
push eax
call sym.CoreFoundation.dll_CFDictionaryGetCount
pop ecx
cmp eax, esi
jl 0x10024c41
push dword [0x1017b0f4]
call sym.CoreFoundation.dll_CFDictionaryRemoveAllValues
pop ecx
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
push dword [0x1017b0f4]
call sym.CoreFoundation.dll_CFDictionaryAddValue
mov eax, dword [0x1017b0f8]
add esp, 0xc
test eax, eax
jne 0x10024c74
push ebx
push edi
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFDictionaryCreateMutable
add esp, 0x10
mov dword [0x1017b0f8], eax
push eax
call sym.CoreFoundation.dll_CFDictionaryGetCount
pop ecx
cmp eax, esi
jl 0x10024c8b
push dword [0x1017b0f8]
call sym.CoreFoundation.dll_CFDictionaryRemoveAllValues
pop ecx
push dword [ebp - 0x60]
push dword [ebp - 0x6c]
push dword [0x1017b0f8]
call sym.CoreFoundation.dll_CFDictionaryAddValue
mov eax, dword [0x1017b0fc]
add esp, 0xc
test eax, eax
jne 0x10024cbe
push ebx
push edi
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFDictionaryCreateMutable
add esp, 0x10
mov dword [0x1017b0fc], eax
push eax
call sym.CoreFoundation.dll_CFDictionaryGetCount
pop ecx
cmp eax, esi
jl 0x10024cd5
push dword [0x1017b0fc]
call sym.CoreFoundation.dll_CFDictionaryRemoveAllValues
pop ecx
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [0x1017b0fc]
call sym.CoreFoundation.dll_CFDictionaryAddValue
add esp, 0xc
cmp dword [ebp + 0x30c], 2
jne 0x10024cf7
push dword [ebp - 0x68]
jmp 0x10024d08
cmp dword [ebp + 0x30c], 1
jne 0x10024d05
push dword [ebp - 0x60]
jmp 0x10024d08
push dword [ebp - 0x64]
call sym.CoreFoundation.dll_CFRetain
pop ecx
push dword [ebp - 0x64]
mov esi, eax
call sym.CoreFoundation.dll_CFRelease
push dword [ebp - 0x60]
call sym.CoreFoundation.dll_CFRelease
push dword [ebp - 0x68]
call sym.CoreFoundation.dll_CFRelease
push 0x1017b0f0
call sym.CoreFoundation.dll___CFSpinUnlock
add esp, 0x10
mov eax, esi
pop edi
mov ecx, dword [ebp + 0x300]
pop esi
xor ecx, ebp
pop ebx
call fcn.10128342
add ebp, 0x304
leave
ret