Function at 0x40a160
Capabilities:
Enumerate files on windows
Get disk information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d6f39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2dc
mov eax, dword [0x511038]
xor eax, dword [esp + 0x2e8]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 8
mov dword [esp + 0x2ec], eax
mov dword [esp + 0x14], esi
call fcn.0044ec90
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.00453020
mov eax, dword [esp + 0x2fc]
xor ebx, ebx
cmp eax, ebx
je 0x40a415
mov dl, byte [0x50494c]
mov edi, 0x4db2e0
xor ecx, ecx
cmp dl, bl
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0x14
mov eax, 0x50494c
je 0x40a1ee
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a1e5
push ecx
push 0x50494c
lea ecx, [esp + 0x5c]
call fcn.00404810
mov dword [esp + 0x2f4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x58]
mov ebp, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov edi, edi
mov edx, dword [esp + 0x18]
mov eax, 1
shl eax, cl
test edx, eax
je 0x40a3ee
push ebx
push ebx
lea eax, [esp + 0x84]
push eax
push ebx
add cl, 0x41
push ebx
mov byte [esi], cl
push 0x104
lea ecx, [esp + 0xbc]
push ecx
push esi
mov byte [esp + 0xc4], bl
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40a3ea
mov dl, byte [esp + 0xa4]
xor ecx, ecx
cmp dl, bl
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x14
lea eax, [esp + 0xa4]
je 0x40a29c
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a293
push ecx
lea edx, [esp + 0xa8]
push edx
lea ecx, [esp + 0x24]
call fcn.00404810
lea eax, [esp + 0xa4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a2b8
sub eax, edx
mov dword [esp + 0x74], eax
je 0x40a2f0
mov dl, byte [0x504950]
xor ecx, ecx
cmp dl, bl
mov eax, 0x504950
je 0x40a2e1
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a2d8
push ecx
push 0x504950
lea ecx, [esp + 0x24]
call fcn.00409ec0
push 0x14
push ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], 0x14
call fcn.004045b0
add esp, 8
mov dword [esp + 0x48], eax
mov dl, byte [0x504954]
xor eax, eax
cmp dl, bl
mov byte [esp + 0x2f4], 2
mov ecx, 0x504954
je 0x40a339
lea esp, [esp]
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a330
push eax
push 0x504954
lea ecx, [esp + 0x4c]
call fcn.00409ec0
mov dl, byte [esi]
xor eax, eax
cmp dl, bl
mov ecx, esi
je 0x40a35b
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a352
push eax
push esi
lea ecx, [esp + 0x4c]
call fcn.00409ec0
mov dl, byte [0x504958]
xor eax, eax
cmp dl, bl
mov ecx, 0x504958
je 0x40a380
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a377
push eax
push 0x504958
lea ecx, [esp + 0x4c]
call fcn.00409ec0
push ebx
push ebx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xa4]
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.004531d0
mov eax, dword [esp + 0x48]
cmp eax, ebx
mov dword [esp + 0x44], edi
je 0x40a3cb
push eax
call fcn.004c73dc
add esp, 4
xor eax, eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x1c], edi
je 0x40a3e6
push eax
call fcn.004c73dc
add esp, 4
xor eax, eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, 0x1a
mov dword [esp + 0x10], ecx
jl 0x40a220
cmp esi, ebx
mov dword [esp + 0x2f4], 0xffffffff
je 0x40a940
push esi
jmp 0x40a938
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
add esi, 0x68
push esi
lea ecx, [esp + 0x58]
call fcn.004058e0
mov dl, byte [0x50495c]
xor eax, eax
cmp dl, bl
mov dword [esp + 0x2f4], 3
mov ecx, 0x50495c
je 0x40a44e
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a445
push eax
push 0x50495c
lea ecx, [esp + 0x5c]
call fcn.00409ec0
push 0x14
push ebx
mov dword [esp + 0x8c], 0x4db2e0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0x14
call fcn.004045b0
add esp, 8
mov dword [esp + 0x88], eax
mov ecx, dword [esp + 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x1a8]
push eax
push ecx
mov byte [esp + 0x2fc], 4
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x40a4ee
mov dl, byte [str.._.]
xor ecx, ecx
cmp dl, bl
mov eax, str.._.
je 0x40a4cc
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a4c3
push ecx
push str.._.
lea ecx, [esp + 0x5c]
call fcn.00404810
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x1a8]
push edx
push eax
call esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x40a85a
lea ecx, [ecx]
mov dl, byte [esp + 0x1d4]
xor ecx, ecx
cmp dl, bl
mov dword [esp + 0x1c], 0x4db2e0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x14
lea eax, [esp + 0x1d4]
je 0x40a539
lea esp, [esp]
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a530
push ecx
lea ecx, [esp + 0x1d8]
push ecx
lea ecx, [esp + 0x24]
call fcn.00404810
mov edi, dword [esp + 0x20]
cmp edi, ebx
mov byte [esp + 0x2f4], 5
mov esi, edi
je 0x40a592
mov cl, byte [0x50496c]
movsx eax, byte [edi]
movsx edx, cl
sub eax, edx
jne 0x40a588
mov edx, 0x50496c
sub edx, edi
cmp cl, bl
je 0x40a588
mov cl, byte [edx + esi + 1]
movsx eax, byte [esi + 1]
inc esi
movsx ebp, cl
sub eax, ebp
je 0x40a574
cmp eax, ebx
jl 0x40a5a8
jg 0x40a5a8
cmp eax, ebx
jne 0x40a5a8
push edi
push 0x504970
call fcn.00404510
add esp, 8
test eax, eax
jne 0x40a811
test byte [esp + 0x1a8], 0x10
je 0x40a6a0
push 0x14
mov esi, 0x4db2e0
push ebx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], 0x14
call fcn.004045b0
add esp, 8
mov dword [esp + 0x68], eax
mov dl, byte [0x504974]
xor ecx, ecx
cmp dl, bl
mov byte [esp + 0x2f4], 6
mov eax, 0x504974
je 0x40a600
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a5f7
push ecx
push 0x504974
lea ecx, [esp + 0x6c]
call fcn.00404810
mov edx, dword [esp + 0x20]
xor eax, eax
cmp edx, ebx
je 0x40a626
cmp byte [edx], bl
mov ecx, edx
je 0x40a626
nop
inc eax
inc ecx
cmp byte [ecx], bl
jne 0x40a620
push eax
push edx
lea ecx, [esp + 0x6c]
call fcn.00409ec0
mov dl, byte [0x504978]
xor eax, eax
cmp dl, bl
mov ecx, 0x504978
je 0x40a64b
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a642
push eax
push 0x504978
lea ecx, [esp + 0x6c]
call fcn.00409ec0
push ebx
push 1
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xa4]
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.004531d0
mov eax, dword [esp + 0x68]
cmp eax, ebx
mov dword [esp + 0x64], esi
je 0x40a697
push eax
call fcn.004c73dc
add esp, 4
xor eax, eax
mov dword [esp + 0x68], eax
jmp 0x40a811
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x8c]
xor ecx, ecx
cmp eax, ebx
je 0x40a7e5
cmp byte [eax], bl
je 0x40a7e5
lea esp, [esp]
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, bl
jne 0x40a6c0
cmp ecx, ebx
je 0x40a7e5
lea edx, [esp + 0xa4]
mov eax, edi
sub edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x40a6e0
lea ecx, [esp + 0xa4]
push 0x2e
push ecx
call fcn.004c8170
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x40a811
mov edx, dword [esp + 0x10]
mov edi, dword [edx + 0x8c]
inc ebp
mov esi, ebp
mov al, byte [esi]
mov dl, byte [edi]
mov cl, al
cmp al, dl
jne 0x40a73b
cmp cl, bl
je 0x40a737
mov dl, byte [esi + 1]
mov al, byte [edi + 1]
mov cl, dl
cmp dl, al
jne 0x40a73b
add esi, 2
add edi, 2
cmp cl, bl
jne 0x40a713
xor ecx, ecx
jmp 0x40a740
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
jne 0x40a811
mov byte [ebp - 1], bl
mov dl, byte [esp + 0xa4]
xor eax, eax
cmp dl, bl
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x34], 0x4db2e0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0x14
lea ecx, [esp + 0xa4]
je 0x40a789
nop
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a780
push eax
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x3c]
call fcn.00404810
push ebx
push 2
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x308], 7
call fcn.004531d0
mov eax, dword [esp + 0x38]
cmp eax, ebx
mov dword [esp + 0x34], 0x4db2e0
je 0x40a7df
push eax
call fcn.004c73dc
add esp, 4
xor eax, eax
mov dword [esp + 0x38], eax
jmp 0x40a811
push ebx
push 2
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
call fcn.004531d0
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1a8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov byte [esp + 0x2f4], 4
mov dword [esp + 0x1c], 0x4db2e0
je 0x40a847
push eax
call fcn.004c73dc
add esp, 4
xor eax, eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x40a500
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x6c]
push 0x2f
push eax
call fcn.004c80b0
add esp, 8
test eax, eax
jne 0x40a900
cmp byte [str._.._], bl
mov esi, 0x4db2e0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0x14
mov ecx, str._.._
je 0x40a8ab
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x40a8a2
push eax
push str._.._
lea ecx, [esp + 0x3c]
call fcn.00404810
push ebx
push 1
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x308], 8
call fcn.004531d0
mov eax, dword [esp + 0x38]
cmp eax, ebx
mov byte [esp + 0x2f4], 4
mov dword [esp + 0x34], esi
je 0x40a8fc
push eax
call fcn.004c73dc
add esp, 4
xor eax, eax
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x14]
push 0x409fa0
call fcn.00452840
mov eax, dword [esp + 0x88]
cmp eax, ebx
je 0x40a922
push eax
call fcn.004c73dc
add esp, 4
mov eax, dword [esp + 0x58]
cmp eax, ebx
mov dword [esp + 0x2f4], 0xffffffff
je 0x40a940
mov ecx, eax
push ecx
call fcn.004c73dc
add esp, 4
mov ecx, dword [esp + 0x14]
call fcn.00452e80
mov ecx, dword [esp + 0x2ec]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2e4]
xor ecx, dword [esp + 0x2f4]
pop esi
pop ebp
pop ebx
call fcn.004c72c5
add esp, 0x2e8
ret 4