Function at 0x58b058
Capabilities:
Enumerate files on windows
Get disk information
Get file system object information

Disassembly:
mov eax, 0x4bb0
call fcn.0054d6f0
push ebx
mov ebx, dword [esp + 0x4bb8]
push ebp
push esi
push edi
mov edi, dword [ebx + 0x10]
push 2
push ebx
call fcn.0058a450
xor ebp, ebp
cmp eax, 2
jne 0x58b090
push ebp
push ebp
push 0x101d
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x58b094
mov eax, dword [esp + 0x20]
push 1
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x34
lea eax, [esp + 0x28]
push ebp
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [esp + 0x4bd4]
add esp, 0xc
test esi, esi
jne 0x58b0c0
mov esi, 0x6ef070
push 0x5c
pop eax
cmp word [esi], ax
jne 0x58b0df
push eax
lea ebp, [esi + 2]
push ebp
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
push 0x5c
test eax, eax
pop eax
jne 0x58b0dd
mov esi, ebp
xor ebp, ebp
test esi, esi
je 0x58b1a1
cmp word [esi], bp
je 0x58b1a1
push eax
push esi
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
push esi
test eax, eax
jne 0x58b111
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
jmp 0x58b1a7
call sub.MSVCRT.dll_wcslen
pop ecx
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
jne 0x58b13f
lea ebp, [edi + 0xc]
push esi
push ebp
call sub.MSVCRT.dll_wcscpy
movzx eax, word [ebp]
pop ecx
pop ecx
cmp eax, 0x61
jb 0x58b139
sub eax, 0x20
mov word [ebp], ax
jmp 0x58b1a7
push 0x208
lea eax, [edi + 0xc]
push ebp
push eax
call sub.MSVCRT.dll_memset
push esi
call sub.MSVCRT.dll_wcslen
mov ebp, eax
add esp, 0x10
test ebp, ebp
js 0x58b1a7
push 0x5c
pop eax
cmp word [esi + ebp*2], ax
je 0x58b16b
dec ebp
jns 0x58b160
jmp 0x58b1a7
lea eax, [ebp*2 + 2]
push eax
lea eax, [edi + 0xc]
push esi
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp + 1]
lea eax, [esi + eax*2]
push eax
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcscpy
movzx eax, word [edi + 0xc]
add esp, 0x14
cmp eax, 0x61
jb 0x58b1a3
sub eax, 0x20
jmp 0x58b1a3
xor eax, eax
mov word [edi + 0xc], ax
lea ebp, [edi + 0xc]
xor esi, esi
cmp word [ebp], si
jne 0x58b1bb
push dword [ebx]
call fcn.005948ca
jmp 0x58b1c3
push ebp
push dword [ebx]
call fcn.00594d55
push esi
push esi
push 0x1009
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp word [ebp], si
jne 0x58b3c3
test byte [edi + 8], 4
jne 0x58b9fb
mov dword [esp + 0x24], 7
mov dword [esp + 0x28], 0x10000
mov dword [esp + 0x38], 0x6ef070
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
lea eax, [esp + 0x29b8]
push 0x705e00
push eax
mov dword [esp + 0x1c], ebp
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
mov dword [esp + 0x10], esi
xor eax, eax
mov ecx, esi
inc eax
shl eax, cl
test ebp, eax
je 0x58b327
lea eax, [esi + 0x41]
mov dword [esp + 0x44], esi
mov word [esp + 0x29b8], ax
xor eax, eax
mov word [esp + 0x2f4], ax
lea eax, [esp + 0x710]
push str.Drive
push eax
call sub.MSVCRT.dll_wcscpy
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x504]
pop ecx
pop ecx
push 0x4001
push 0x2b4
push eax
push 0
lea eax, [esp + 0x29c8]
push eax
call ebp
mov eax, dword [esp + 0x500]
push 0x200
mov dword [esp + 0x44], eax
lea eax, [esp + 0x500]
push 0x2b4
push eax
push 0
lea eax, [esp + 0x29c8]
push eax
call ebp
lea eax, [esp + 0x508]
push eax
lea eax, [esp + 0x2f8]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
lea eax, [esp + 0x24]
push eax
push 0
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
mov dword [esp + 0x18], eax
cmp dword [edi + 0x2220], ebp
jle 0x58b323
mov esi, eax
cmp byte [edi + ebp + 0x2224], 2
jne 0x58b316
lea eax, [esp + 0x2f4]
mov dword [esp + 0x60], ebp
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
push eax
push esi
push 0x1074
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
inc ebp
cmp ebp, dword [edi + 0x2220]
jl 0x58b2ea
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x1f
jle 0x58b226
cmp dword [0x7bc328], 0
je 0x58b9f9
test dword [edi + 8], 0x200
jne 0x58b9f9
mov eax, dword [0x7c49c0]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x104d
push dword [ebx]
mov dword [esp + 0x48], 0x6ef070
mov dword [esp + 0x54], 0xfd
call dword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov ebp, eax
cmp dword [edi + 0x2220], esi
jle 0x58b9f9
cmp byte [edi + esi + 0x2224], 2
jne 0x58b3b5
lea eax, [esp + 0x58]
mov dword [esp + 0x60], esi
push eax
push ebp
push 0x1074
push dword [ebx]
mov dword [esp + 0x7c], 0x7c4a70
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x58b38c
jmp 0x58b9f9
test byte [edi + 8], 2
jne 0x58b4bc
mov eax, dword [0x7c49bc]
push 0x5c
mov dword [esp + 0x44], eax
pop eax
push eax
push eax
push ebp
mov dword [esp + 0x30], 7
mov dword [esp + 0x34], esi
mov dword [esp + 0x44], 0x6ef070
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
add eax, 2
push eax
call sub.MSVCRT.dll_wcschr
neg eax
pop ecx
sbb eax, eax
neg eax
add eax, 0xfa
pop ecx
mov dword [esp + 0x44], eax
cmp dword [0x7bc328], esi
je 0x58b468
test dword [edi + 8], 0x200
jne 0x58b468
push 0x7c4c78
call sub.MSVCRT.dll_wcslen
push eax
push 0x7c4c78
push ebp
call sub.MSVCRT.dll_wcsncmp
add esp, 0x10
test eax, eax
jne 0x58b468
push 0x5c
pop eax
push eax
push 0x7c4c78
call sub.MSVCRT.dll_wcslen
add eax, 6
pop ecx
lea eax, [edi + eax*2]
push eax
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
test eax, eax
jne 0x58b468
mov dword [esp + 0x44], 0xfa
lea eax, [esp + 0x24]
push eax
push esi
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
cmp dword [edi + 0x2220], esi
jle 0x58b4b7
cmp byte [edi + esi + 0x2224], 2
jne 0x58b4ae
lea eax, [esp + 0x58]
mov dword [esp + 0x60], esi
push eax
push ebp
push 0x1074
push dword [ebx]
mov dword [esp + 0x7c], 0x705e14
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x58b485
xor esi, esi
lea ebp, [edi + 0xc]
test byte [edi + 8], 4
jne 0x58b6c0
lea eax, [esp + 0x2f4]
push ebp
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0x2fc]
push 0x705e1c
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
je 0x58b6c0
push 7
pop eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0xffff
mov dword [esp + 0x38], 0x6ef070
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0xfc
jmp 0x58b535
xor esi, esi
test byte [esp + 0xa4], 0x10
je 0x58b6a2
lea eax, [esp + 0xd0]
push 0x705e24
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x58b6a2
lea eax, [esp + 0xd0]
push 0x705e14
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x58b6a2
mov eax, dword [0x7c49bc]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x24]
push eax
push esi
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [edi + 0x2220], 0
mov ecx, eax
mov dword [esp + 0x10], ecx
jle 0x58b6a2
movzx eax, byte [edi + esi + 0x2224]
dec eax
dec eax
je 0x58b66b
sub eax, 3
je 0x58b5f4
dec eax
je 0x58b5eb
dec eax
je 0x58b5e2
dec eax
jne 0x58b691
lea eax, [esp + 0xb0]
push eax
push esi
push ecx
push dword [ebx]
call fcn.0058ba40
jmp 0x58b68d
lea eax, [esp + 0xb8]
jmp 0x58b5d3
lea eax, [esp + 0xa8]
jmp 0x58b5d3
push 0xb
lea eax, [esp + 0x90]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ecx, str.RHSDANTCOE
add esp, 0xc
mov dword [esp + 0x14], ecx
mov ebp, 0x7bc2fc
mov eax, dword [esp + 0xa4]
test dword [ebp], eax
je 0x58b643
lea eax, [esp + 0x8c]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [esp + 0x14]
mov cx, word [ecx]
mov word [esp + eax*2 + 0x8c], cx
mov ecx, dword [esp + 0x14]
add ebp, 4
add ecx, 2
mov dword [esp + 0x14], ecx
cmp ebp, 0x7bc320
jle 0x58b616
lea eax, [esp + 0x8c]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x14]
jmp 0x58b67c
lea eax, [esp + 0xd0]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
push eax
push ecx
push 0x1074
push dword [ebx]
mov dword [esp + 0x70], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x58b5aa
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0xa4]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x58b533
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [edi + 8], 1
jne 0x58b9ee
lea ebp, [edi + 0x214]
lea eax, [esp + 0x7b0]
push ebp
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0x7b8]
push eax
call sub.MSVCRT.dll_wcslen
xor ecx, ecx
xor esi, esi
push ebp
mov word [esp + eax*2 + 0x7c2], cx
call sub.MSVCRT.dll_wcslen
add esp, 0x10
cmp word [esp + esi*2 + 0x7b0], 0x3b
jne 0x58b715
xor eax, eax
mov word [esp + esi*2 + 0x7b0], ax
push ebp
inc esi
call sub.MSVCRT.dll_wcslen
pop ecx
cmp esi, eax
jbe 0x58b700
push 0x7c8c40
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [edi + 0xc]
lea eax, [esp + 0x2f4]
push esi
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0x2fc]
push 0x705e1c
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x58b9ee
push 0x2b4
lea eax, [esp + 0x500]
mov dword [esp + 0x28], 7
push 0
push eax
mov dword [esp + 0x34], 0xffff
mov dword [esp + 0x44], 0x6ef070
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x50], 0xff
call sub.MSVCRT.dll_memset
mov ebp, dword [esp + 0x1c]
add esp, 0xc
test byte [esp + 0xa4], 0x10
jne 0x58b9d0
lea eax, [esp + 0x7b0]
push eax
lea eax, [esp + 0xd4]
push eax
call fcn.00594cda
test eax, eax
je 0x58b9d0
lea eax, [esp + 0x2f4]
push esi
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x300]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2f8]
push eax
call fcn.0059494a
mov dword [esp + 0x40], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp dword [edi + 0x2220], esi
jle 0x58b9c9
movzx eax, byte [edi + esi + 0x2224]
dec eax
dec eax
je 0x58b99a
dec eax
je 0x58b917
dec eax
je 0x58b90e
dec eax
je 0x58b89d
dec eax
je 0x58b887
dec eax
je 0x58b87e
dec eax
jne 0x58b9bc
lea eax, [esp + 0xb0]
jmp 0x58b88e
lea eax, [esp + 0xb8]
jmp 0x58b88e
lea eax, [esp + 0xa8]
push eax
push esi
push ebp
push dword [ebx]
call fcn.0058ba40
jmp 0x58b9bc
push 0xb
lea eax, [esp + 0x90]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ecx, str.RHSDANTCOE
add esp, 0xc
mov dword [esp + 0x14], ecx
mov ebp, 0x7bc2fc
mov eax, dword [esp + 0xa4]
test dword [ebp], eax
je 0x58b8ec
lea eax, [esp + 0x8c]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [esp + 0x14]
mov cx, word [ecx]
mov word [esp + eax*2 + 0x8c], cx
mov ecx, dword [esp + 0x14]
add ebp, 4
add ecx, 2
mov dword [esp + 0x14], ecx
cmp ebp, 0x7bc320
jle 0x58b8bf
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x8c]
jmp 0x58b9a1
mov eax, dword [esp + 0x20]
jmp 0x58b9a1
mov ecx, dword [esp + 0xc0]
test ecx, ecx
je 0x58b946
xor eax, eax
add eax, dword [esp + 0xc4]
adc ecx, 0
shrd eax, ecx, 0xa
shr ecx, 0xa
push ecx
push eax
lea eax, [esp + 0x2fc]
push eax
call fcn.006ec927
jmp 0x58b97d
mov ecx, dword [esp + 0xc4]
lea eax, [ecx - 1]
cmp eax, 0x3ffffffe
ja 0x58b964
add ecx, 0x3ff
mov dword [esp + 0xc4], ecx
shr ecx, 0xa
lea eax, [esp + 0x2f4]
push ecx
push 0x705e28
push eax
call fcn.006ecdb0
add esp, 0xc
lea eax, [esp + 0x2f4]
push 0x705e30
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 0x2f4]
jmp 0x58b9a1
lea eax, [esp + 0xd0]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
push eax
push ebp
push 0x1074
push dword [ebx]
mov dword [esp + 0x70], esi
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x58b847
mov ebp, dword [esp + 0x10]
lea esi, [edi + 0xc]
lea eax, [esp + 0xa4]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x58b7b8
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x7c8c40
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
cmp dword [edi + 0x22ec], esi
je 0x58ba09
push edi
call fcn.0058bafe
push 2
push ebx
call fcn.0058a450
cmp eax, 2
jne 0x58ba2c
mov eax, dword [esp + 0x1c]
movzx eax, ax
push eax
push esi
push 0x101e
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4bb0
ret 8