Function at 0x4b89a6
Capabilities:
Enumerate files on windows
Get disk information
Get file system object information

Disassembly:
mov eax, 0x29a8
call fcn.0048a360
push ebx
mov ebx, dword [esp + 0x29b0]
push ebp
push esi
push edi
mov edi, dword [ebx + 0x10]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x34
xor ebp, ebp
lea eax, [esp + 0x20]
push ebp
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [esp + 0x29cc]
add esp, 0xc
test esi, esi
jne 0x4b89e8
mov esi, 0x4f4bf4
push 0x5c
pop eax
cmp word [esi], ax
jne 0x4b8a07
push eax
lea ebp, [esi + 2]
push ebp
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
push 0x5c
test eax, eax
pop eax
jne 0x4b8a05
mov esi, ebp
xor ebp, ebp
test esi, esi
je 0x4b8ae0
cmp word [esi], bp
je 0x4b8ae0
push eax
push esi
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
push esi
test eax, eax
jne 0x4b8a36
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
jmp 0x4b8a67
call sub.MSVCRT.dll_wcslen
pop ecx
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
jne 0x4b8a7b
lea ebx, [edi + 0xc]
push esi
push ebx
call sub.MSVCRT.dll_wcscpy
movzx eax, word [ebx]
pop ecx
pop ecx
cmp eax, 0x61
jb 0x4b8a5d
sub eax, 0x20
mov word [ebx], ax
mov ebx, dword [esp + 0x29bc]
lea ebp, [edi + 0xc]
xor esi, esi
cmp word [ebp], si
jne 0x4b8aeb
push dword [ebx]
call fcn.004be17f
jmp 0x4b8af3
push 0x208
xor eax, eax
lea ebp, [edi + 0xc]
push eax
push ebp
call sub.MSVCRT.dll_memset
push esi
call sub.MSVCRT.dll_wcslen
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x4b8a60
push 0x5c
pop eax
cmp word [esi + ebx*2], ax
je 0x4b8aa9
dec ebx
jns 0x4b8a9e
jmp 0x4b8a60
lea eax, [ebx*2 + 2]
push eax
push esi
push ebp
call sub.MSVCRT.dll_memcpy
lea eax, [ebx + 1]
lea eax, [esi + eax*2]
push eax
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcscpy
movzx eax, word [ebp]
add esp, 0x14
cmp eax, 0x61
jb 0x4b8ada
sub eax, 0x20
mov word [ebp], ax
jmp 0x4b8a60
xor eax, eax
mov word [edi + 0xc], ax
jmp 0x4b8a67
push ebp
push dword [ebx]
call fcn.004be58f
push esi
push esi
push 0x1009
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageW]
cmp word [ebp], si
jne 0x4b8d08
test byte [edi + 8], 4
jne 0x4b9371
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x30], 0x4f4bf4
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
lea eax, [esp + 0x7b0]
push 0x50947c
push eax
mov dword [esp + 0x1c], ebp
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
mov dword [esp + 0x10], esi
xor eax, eax
mov ecx, esi
inc eax
shl eax, cl
test ebp, eax
je 0x4b8c60
lea eax, [esi + 0x41]
mov dword [esp + 0x3c], esi
mov word [esp + 0x7b0], ax
xor eax, eax
mov word [esp + 0x2f4], ax
lea eax, [esp + 0x710]
push str.Drive
push eax
call sub.MSVCRT.dll_wcscpy
mov ebp, dword [sym.imp.SHELL32.DLL_SHGetFileInfoW]
lea eax, [esp + 0x504]
pop ecx
pop ecx
push 0x4001
push 0x2b4
push eax
xor eax, eax
push eax
lea eax, [esp + 0x7c0]
push eax
call ebp
mov eax, dword [esp + 0x500]
push 0x200
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x500]
push 0x2b4
push eax
xor eax, eax
push eax
lea eax, [esp + 0x7c0]
push eax
call ebp
lea eax, [esp + 0x508]
push eax
lea eax, [esp + 0x2f8]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
lea eax, [esp + 0x1c]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov ebp, ecx
cmp dword [edi + 0x2220], ecx
jle 0x4b8cff
mov esi, eax
cmp byte [edi + ebp + 0x2224], 2
jne 0x4b8c4f
lea eax, [esp + 0x2f4]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
push eax
push esi
push 0x1074
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageW]
inc ebp
cmp ebp, dword [edi + 0x2220]
jl 0x4b8c23
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
xor ecx, ecx
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x1f
jle 0x4b8b56
cmp dword [0x53df58], 0
je 0x4b936f
test dword [edi + 8], 0x200
jne 0x4b936f
mov eax, dword [0x542b50]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
push ecx
push 0x104d
push dword [ebx]
mov dword [esp + 0x40], 0x4f4bf4
mov dword [esp + 0x4c], 0xfd
call dword [sym.imp.USER32.DLL_SendMessageW]
mov ebp, eax
xor eax, eax
mov esi, eax
cmp dword [edi + 0x2220], eax
jle 0x4b936f
cmp byte [edi + esi + 0x2224], 2
jne 0x4b8cf1
lea eax, [esp + 0x50]
mov dword [esp + 0x58], esi
push eax
push ebp
push 0x1074
push dword [ebx]
mov dword [esp + 0x74], 0x542c00
call dword [sym.imp.USER32.DLL_SendMessageW]
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x4b8cc8
jmp 0x4b936f
mov ebp, dword [esp + 0x14]
jmp 0x4b8c62
test byte [edi + 8], 2
jne 0x4b8e03
mov eax, dword [0x542b4c]
push 0x5c
mov dword [esp + 0x3c], eax
pop eax
push eax
push eax
push ebp
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], 0x4f4bf4
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
add eax, 2
push eax
call sub.MSVCRT.dll_wcschr
neg eax
pop ecx
sbb eax, eax
neg eax
add eax, 0xfa
pop ecx
mov dword [esp + 0x3c], eax
cmp dword [0x53df58], esi
je 0x4b8dad
test dword [edi + 8], 0x200
jne 0x4b8dad
push 0x542e08
call sub.MSVCRT.dll_wcslen
push eax
push 0x542e08
push ebp
call sub.MSVCRT.dll_wcsncmp
add esp, 0x10
test eax, eax
jne 0x4b8dad
push 0x5c
pop eax
push eax
push 0x542e08
call sub.MSVCRT.dll_wcslen
add eax, 6
pop ecx
lea eax, [edi + eax*2]
push eax
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
test eax, eax
jne 0x4b8dad
mov dword [esp + 0x3c], 0xfa
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageW]
mov ebp, eax
xor eax, eax
cmp dword [edi + 0x2220], eax
jle 0x4b8dfe
cmp byte [edi + esi + 0x2224], 2
jne 0x4b8df5
lea eax, [esp + 0x50]
mov dword [esp + 0x58], esi
push eax
push ebp
push 0x1074
push dword [ebx]
mov dword [esp + 0x74], 0x509490
call dword [sym.imp.USER32.DLL_SendMessageW]
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x4b8dcc
xor esi, esi
lea ebp, [edi + 0xc]
test byte [edi + 8], 4
jne 0x4b9009
lea eax, [esp + 0x2f4]
push ebp
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0x2fc]
push 0x509498
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
je 0x4b9009
push 7
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x30], 0x4f4bf4
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0xfc
jmp 0x4b8e7c
xor esi, esi
test byte [esp + 0xa4], 0x10
je 0x4b8feb
lea eax, [esp + 0xd0]
push 0x5094a0
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4b8feb
lea eax, [esp + 0xd0]
push 0x509490
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4b8feb
mov eax, dword [0x542b4c]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor edx, edx
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [edi + 0x2220], edx
jle 0x4b8feb
movzx eax, byte [edi + esi + 0x2224]
dec eax
dec eax
je 0x4b8fb2
sub eax, 3
je 0x4b8f3c
dec eax
je 0x4b8f33
dec eax
je 0x4b8f2a
dec eax
jne 0x4b8fda
lea eax, [esp + 0xb0]
push eax
push esi
push ecx
push dword [ebx]
call fcn.004b9393
jmp 0x4b8fd4
lea eax, [esp + 0xb8]
jmp 0x4b8f1b
lea eax, [esp + 0xa8]
jmp 0x4b8f1b
push 0xb
push edx
lea eax, [esp + 0x94]
push eax
call sub.MSVCRT.dll_memset
mov ecx, str.RHSDANTCOE
add esp, 0xc
mov dword [esp + 0x14], ecx
mov ebp, 0x53df2c
mov eax, dword [esp + 0xa4]
test dword [ebp], eax
je 0x4b8f8a
lea eax, [esp + 0x8c]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [esp + 0x14]
mov cx, word [ecx]
mov word [esp + eax*2 + 0x8c], cx
mov ecx, dword [esp + 0x14]
add ebp, 4
add ecx, 2
mov dword [esp + 0x14], ecx
cmp ebp, 0x53df50
jle 0x4b8f5d
lea eax, [esp + 0x8c]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x14]
jmp 0x4b8fc3
lea eax, [esp + 0xd0]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
push eax
push ecx
push 0x1074
push dword [ebx]
mov dword [esp + 0x68], esi
call dword [sym.imp.USER32.DLL_SendMessageW]
mov ecx, dword [esp + 0x10]
xor edx, edx
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x4b8ef2
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0xa4]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b8e7a
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [edi + 8], 1
jne 0x4b936f
lea ebp, [edi + 0x214]
lea eax, [esp + 0x7b0]
push ebp
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0x7b8]
push eax
call sub.MSVCRT.dll_wcslen
xor ecx, ecx
push ebp
mov word [esp + eax*2 + 0x7c2], cx
xor eax, eax
mov esi, eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
cmp word [esp + esi*2 + 0x7b0], 0x3b
jne 0x4b9060
xor eax, eax
mov word [esp + esi*2 + 0x7b0], ax
push ebp
inc esi
call sub.MSVCRT.dll_wcslen
pop ecx
cmp esi, eax
jbe 0x4b904b
push 0x5452dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [esp + 0x7b0], 0
lea ebp, [esp + 0x7b0]
mov dword [esp + 0x18], ebp
je 0x4b9364
lea esi, [edi + 0xc]
lea eax, [esp + 0x2f4]
push esi
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0x2fc]
push ebp
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4b9346
xor eax, eax
mov dword [esp + 0x1c], 7
push 0x2b4
push eax
lea eax, [esp + 0x504]
mov dword [esp + 0x28], 0xffff
push eax
mov dword [esp + 0x3c], 0x4f4bf4
mov dword [esp + 0x44], 0xa
mov dword [esp + 0x48], 0xff
call sub.MSVCRT.dll_memset
mov ebp, dword [esp + 0x1c]
add esp, 0xc
test byte [esp + 0xa4], 0x10
jne 0x4b9324
lea eax, [esp + 0x2f4]
push esi
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x300]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x2f8]
push eax
call fcn.004be1ff
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor edx, edx
mov ebp, eax
mov esi, edx
mov dword [esp + 0x84], ebp
cmp dword [edi + 0x2220], edx
jle 0x4b931d
movzx eax, byte [edi + esi + 0x2224]
dec eax
dec eax
je 0x4b92ec
dec eax
je 0x4b926a
dec eax
je 0x4b925e
dec eax
je 0x4b91eb
dec eax
je 0x4b91e2
dec eax
je 0x4b91d9
dec eax
jne 0x4b9310
lea eax, [esp + 0xb0]
push eax
push esi
push ebp
push dword [ebx]
call fcn.004b9393
jmp 0x4b930e
lea eax, [esp + 0xb8]
jmp 0x4b91ca
lea eax, [esp + 0xa8]
jmp 0x4b91ca
push 0xb
push edx
lea eax, [esp + 0x94]
push eax
call sub.MSVCRT.dll_memset
mov ecx, str.RHSDANTCOE
add esp, 0xc
mov dword [esp + 0x14], ecx
mov ebp, 0x53df2c
mov eax, dword [esp + 0xa4]
test dword [ebp], eax
je 0x4b9239
lea eax, [esp + 0x8c]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [esp + 0x14]
mov cx, word [ecx]
mov word [esp + eax*2 + 0x8c], cx
mov ecx, dword [esp + 0x14]
add ebp, 4
add ecx, 2
mov dword [esp + 0x14], ecx
cmp ebp, 0x53df50
jle 0x4b920c
mov ebp, dword [esp + 0x84]
lea eax, [esp + 0x8c]
jmp 0x4b92f3
mov eax, dword [esp + 0x88]
jmp 0x4b92f3
mov ecx, dword [esp + 0xc0]
test ecx, ecx
je 0x4b9298
xor eax, eax
add eax, dword [esp + 0xc4]
adc ecx, edx
shrd eax, ecx, 0xa
shr ecx, 0xa
push ecx
push eax
lea eax, [esp + 0x2fc]
push eax
call fcn.004f313b
jmp 0x4b92cf
mov ecx, dword [esp + 0xc4]
lea eax, [ecx - 1]
cmp eax, 0x3ffffffe
ja 0x4b92b6
add ecx, 0x3ff
mov dword [esp + 0xc4], ecx
shr ecx, 0xa
lea eax, [esp + 0x2f4]
push ecx
push 0x5094a4
push eax
call fcn.004f3880
add esp, 0xc
lea eax, [esp + 0x2f4]
push 0x5094ac
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 0x2f4]
jmp 0x4b92f3
lea eax, [esp + 0xd0]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
push eax
push ebp
push 0x1074
push dword [ebx]
mov dword [esp + 0x68], esi
call dword [sym.imp.USER32.DLL_SendMessageW]
xor edx, edx
inc esi
cmp esi, dword [edi + 0x2220]
jl 0x4b9195
mov ebp, dword [esp + 0x10]
lea esi, [edi + 0xc]
lea eax, [esp + 0xa4]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b911a
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x18]
push ebp
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [ebp + eax*2]
xor eax, eax
add ebp, 2
mov dword [esp + 0x18], ebp
cmp word [ebp], ax
jne 0x4b9094
push 0x5452dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
cmp dword [edi + 0x22ec], esi
je 0x4b937f
push edi
call fcn.004b9451
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29a8
ret 8