Function at 0x44cfe8
Capabilities:
Enumerate files on windows
Get disk information
Get file system object information

Disassembly:
mov eax, 0x4bb4
call fcn.005732e0
push ebx
push ebp
mov ebp, dword [esp + 0x4bc0]
push esi
push edi
push 2
mov ebx, dword [ebp + 0x10]
push ebp
call fcn.0044c37f
xor esi, esi
cmp eax, 2
jne 0x44d025
cmp edx, esi
jne 0x44d025
push esi
push esi
push 0x101d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44d029
mov eax, dword [esp + 0x24]
push 1
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x34
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.0042d490
add esp, 0xc
mov edi, 0x5b9268
cmp dword [esp + 0x4bcc], esi
cmovne edi, dword [esp + 0x4bcc]
push 0x5c
pop eax
cmp word [edi], ax
jne 0x44d077
push eax
lea esi, [edi + 2]
push esi
call fcn.00431184
pop ecx
test eax, eax
pop ecx
push 0x5c
cmove edi, esi
xor esi, esi
pop eax
test edi, edi
je 0x44d142
cmp word [edi], si
je 0x44d142
push eax
push edi
call fcn.00431184
pop ecx
pop ecx
push edi
test eax, eax
jne 0x44d0ac
lea eax, [ebx + 0x214]
push eax
call fcn.0058a563
pop ecx
pop ecx
lea esi, [ebx + 0xc]
jmp 0x44d14a
lea esi, [ebx + 0xc]
mov dword [esp + 0x18], esi
call fcn.0042267c
pop ecx
push 0x5c
pop ecx
cmp word [edi + eax*2 - 2], cx
jne 0x44d0e2
push edi
push esi
call fcn.0058a563
pop ecx
pop ecx
movzx ecx, word [esi]
cmp ecx, 0x61
lea eax, [ecx - 0x20]
movzx edx, ax
mov eax, ecx
cmovb edx, eax
mov word [esi], dx
jmp 0x44d14a
push 0x208
xor eax, eax
push eax
push esi
call fcn.0042d490
push edi
call fcn.0042267c
add esp, 0x10
test eax, eax
js 0x44d14e
lea ecx, [edi + eax*2]
push 0x5c
mov dword [esp + 0x14], ecx
pop edx
cmp word [ecx], dx
je 0x44d11a
sub ecx, 2
sub eax, 1
mov dword [esp + 0x10], ecx
jns 0x44d107
jmp 0x44d14a
lea eax, [eax*2 + 2]
push eax
push edi
push esi
call fcn.00430c10
mov eax, dword [esp + 0x1c]
add eax, 2
push eax
lea eax, [ebx + 0x214]
push eax
call fcn.0058a563
add esp, 0x14
jmp 0x44d0cc
lea esi, [ebx + 0xc]
xor eax, eax
mov word [esi], ax
mov dword [esp + 0x14], esi
xor edi, edi
cmp word [esi], di
jne 0x44d15f
push dword [ebp]
call fcn.004503c5
jmp 0x44d168
push esi
push dword [ebp]
call fcn.004507e0
push edi
push edi
push 0x1009
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp word [esi], di
jne 0x44d388
test byte [ebx + 8], 4
jne 0x44d9b2
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0x10000
mov dword [esp + 0x3c], 0x5b9268
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
lea eax, [esp + 0x7b4]
push 0x5bbf28
push eax
mov dword [esp + 0x18], edi
call fcn.0058a563
xor eax, eax
pop ecx
pop ecx
mov esi, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov ecx, esi
inc eax
shl eax, cl
test edi, eax
je 0x44d2db
lea eax, [esi + 0x41]
mov dword [esp + 0x48], esi
mov word [esp + 0x7b4], ax
xor eax, eax
mov word [esp + 0x2f8], ax
lea eax, [esp + 0x714]
push str.Drive
push eax
call fcn.0058a563
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x508]
pop ecx
pop ecx
push 0x4001
push 0x2b4
push eax
xor eax, eax
push eax
lea eax, [esp + 0x7c4]
push eax
call edi
mov eax, dword [esp + 0x504]
push 0x200
mov dword [esp + 0x48], eax
lea eax, [esp + 0x504]
push 0x2b4
push eax
xor eax, eax
push eax
lea eax, [esp + 0x7c4]
push eax
call edi
lea eax, [esp + 0x50c]
push eax
lea eax, [esp + 0x2fc]
push eax
call fcn.0058a563
pop ecx
pop ecx
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov edi, ecx
cmp dword [ebx + 0x2220], ecx
jle 0x44d37f
mov esi, eax
cmp byte [ebx + edi + 0x2224], 2
jne 0x44d2ca
lea eax, [esp + 0x2f8]
mov dword [esp + 0x64], edi
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push esi
push 0x1074
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, dword [ebx + 0x2220]
jl 0x44d29d
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
xor ecx, ecx
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x1f
jle 0x44d1cf
cmp dword [0x86de70], 0
je 0x44d9b0
test dword [ebx + 8], 0x200
jne 0x44d9b0
mov eax, dword [0x874f7c]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
push ecx
push 0x104d
push dword [ebp]
mov dword [esp + 0x4c], 0x5b9268
mov dword [esp + 0x58], 0xfd
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
xor eax, eax
mov esi, eax
cmp dword [ebx + 0x2220], eax
jle 0x44d9b0
cmp byte [ebx + esi + 0x2224], 2
jne 0x44d371
lea eax, [esp + 0x5c]
mov dword [esp + 0x64], esi
push eax
push edi
push 0x1074
push dword [ebp]
mov dword [esp + 0x80], 0x873d30
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, dword [ebx + 0x2220]
jl 0x44d344
jmp 0x44d9b0
mov edi, dword [esp + 0x10]
jmp 0x44d2dd
test byte [ebx + 8], 2
jne 0x44d493
mov eax, dword [0x874f78]
push 0x5c
mov dword [esp + 0x48], eax
pop eax
push eax
push eax
push esi
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], edi
mov dword [esp + 0x48], 0x5b9268
call fcn.00431184
pop ecx
pop ecx
add eax, 2
push eax
call fcn.00431184
neg eax
pop ecx
sbb eax, eax
neg eax
add eax, 0xfa
pop ecx
mov dword [esp + 0x48], eax
cmp dword [0x86de70], edi
je 0x44d433
test dword [ebx + 8], 0x200
jne 0x44d433
push 0x873f38
call fcn.0042267c
push eax
push 0x873f38
push esi
call fcn.00423d80
add esp, 0x10
test eax, eax
jne 0x44d433
push 0x5c
pop eax
push eax
push 0x873f38
call fcn.0042267c
add eax, 6
pop ecx
lea eax, [ebx + eax*2]
push eax
call fcn.00431184
pop ecx
pop ecx
mov ecx, dword [esp + 0x48]
test eax, eax
mov eax, 0xfa
cmove ecx, eax
mov dword [esp + 0x48], ecx
lea eax, [esp + 0x28]
push eax
push edi
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x18], eax
xor eax, eax
cmp dword [ebx + 0x2220], eax
jle 0x44d493
mov esi, dword [esp + 0x18]
cmp byte [ebx + edi + 0x2224], 2
jne 0x44d486
lea eax, [esp + 0x5c]
mov dword [esp + 0x64], edi
push eax
push esi
push 0x1074
push dword [ebp]
mov dword [esp + 0x80], 0x5bbf3c
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, dword [ebx + 0x2220]
jl 0x44d459
mov esi, dword [esp + 0x14]
test byte [ebx + 8], 4
jne 0x44d69f
lea eax, [esp + 0x2f8]
push esi
push eax
call fcn.0058a563
lea eax, [esp + 0x300]
push 0x5bbf44
push eax
call fcn.0058a585
add esp, 0x10
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, 0xffffffff
je 0x44d69f
push 7
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0x3c], 0x5b9268
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0xfc
test byte [esp + 0xa8], 0x10
je 0x44d67d
lea eax, [esp + 0xd4]
push 0x5b6248
push eax
call fcn.005959d4
pop ecx
pop ecx
test eax, eax
je 0x44d67d
lea eax, [esp + 0xd4]
push 0x5bbf3c
push eax
call fcn.005959d4
pop ecx
pop ecx
test eax, eax
je 0x44d67d
mov eax, dword [0x874f78]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov esi, eax
mov edi, ecx
cmp dword [ebx + 0x2220], ecx
jle 0x44d679
movzx eax, byte [ebx + edi + 0x2224]
dec eax
sub eax, 1
je 0x44d647
sub eax, 3
je 0x44d5d2
sub eax, 1
je 0x44d5c9
sub eax, 1
je 0x44d5c0
sub eax, 1
jne 0x44d66c
lea eax, [esp + 0xb4]
push eax
push edi
push esi
push dword [ebp]
call fcn.0044d9fc
jmp 0x44d66a
lea eax, [esp + 0xbc]
jmp 0x44d5b0
lea eax, [esp + 0xac]
jmp 0x44d5b0
push 0xb
push ecx
lea eax, [esp + 0x98]
push eax
call fcn.0042d490
mov edx, str.RHSDANTCOE
mov ecx, 0x86de44
add esp, 0xc
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0xa8]
test dword [ecx], eax
je 0x44d628
lea eax, [esp + 0x90]
push eax
call fcn.0042267c
mov edx, dword [esp + 0x20]
pop ecx
lea ecx, [esp + 0x90]
lea ecx, [ecx + eax*2]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [esp + 0x10]
add ecx, 4
add edx, 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0x86de68
jle 0x44d5f7
lea eax, [esp + 0x90]
jmp 0x44d64e
lea eax, [esp + 0xd4]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push esi
push 0x1074
push dword [ebp]
mov dword [esp + 0x74], edi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
inc edi
cmp edi, dword [ebx + 0x2220]
jl 0x44d57f
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xa8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44d508
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x14]
test byte [ebx + 8], 1
jne 0x44d9a5
lea eax, [esp + 0x29bc]
push eax
lea eax, [ebx + 0x214]
push eax
call fcn.00450930
push 0x875e6c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x2f8]
push esi
push eax
call fcn.0058a563
lea eax, [esp + 0x300]
push 0x5bbf44
push eax
call fcn.0058a585
add esp, 0x10
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x44d9a5
xor eax, eax
mov dword [esp + 0x28], 7
push 0x2b4
push eax
lea eax, [esp + 0x508]
mov dword [esp + 0x34], 0xffff
push eax
mov dword [esp + 0x48], 0x5b9268
mov dword [esp + 0x50], 0xa
mov dword [esp + 0x54], 0xff
call fcn.0042d490
mov edi, dword [esp + 0x1c]
add esp, 0xc
test byte [esp + 0xa8], 0x10
jne 0x44d987
lea eax, [esp + 0x29bc]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.00450890
test eax, eax
je 0x44d987
lea eax, [esp + 0x2f8]
push esi
push eax
call fcn.0058a563
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x304]
push eax
call fcn.0058a585
add esp, 0x10
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2fc]
push eax
call fcn.00450445
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov dword [esp + 0x18], eax
mov edi, edx
cmp dword [ebx + 0x2220], edx
jle 0x44d983
mov esi, eax
movzx eax, byte [ebx + edi + 0x2224]
dec eax
sub eax, 1
je 0x44d94d
sub eax, 1
je 0x44d8cb
sub eax, 1
je 0x44d8c2
sub eax, 1
je 0x44d84a
sub eax, 1
je 0x44d841
sub eax, 1
je 0x44d838
sub eax, 1
jne 0x44d972
lea eax, [esp + 0xb4]
push eax
push edi
push esi
push dword [ebp]
call fcn.0044d9fc
jmp 0x44d970
lea eax, [esp + 0xbc]
jmp 0x44d828
lea eax, [esp + 0xac]
jmp 0x44d828
push 0xb
push edx
lea eax, [esp + 0x98]
push eax
call fcn.0042d490
mov edx, str.RHSDANTCOE
mov ecx, 0x86de44
add esp, 0xc
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0xa8]
test dword [ecx], eax
je 0x44d8a0
lea eax, [esp + 0x90]
push eax
call fcn.0042267c
mov edx, dword [esp + 0x20]
pop ecx
lea ecx, [esp + 0x90]
lea ecx, [ecx + eax*2]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [esp + 0x18]
add ecx, 4
add edx, 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0x86de68
jle 0x44d86f
lea eax, [esp + 0x90]
jmp 0x44d954
mov eax, dword [esp + 0x24]
jmp 0x44d954
mov ecx, dword [esp + 0xc4]
test ecx, ecx
je 0x44d8f9
xor eax, eax
add eax, dword [esp + 0xc8]
adc ecx, edx
shrd eax, ecx, 0xa
shr ecx, 0xa
push ecx
push eax
lea eax, [esp + 0x300]
push eax
call fcn.0057272b
jmp 0x44d930
mov ecx, dword [esp + 0xc8]
lea eax, [ecx - 1]
cmp eax, 0x3ffffffe
ja 0x44d917
add ecx, 0x3ff
mov dword [esp + 0xc8], ecx
shr ecx, 0xa
lea eax, [esp + 0x2f8]
push ecx
push 0x5bbf4c
push eax
call fcn.0044e115
add esp, 0xc
lea eax, [esp + 0x2f8]
push 0x5bbf54
push eax
call fcn.0058a585
pop ecx
pop ecx
lea eax, [esp + 0x2f8]
jmp 0x44d954
lea eax, [esp + 0xd4]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push esi
push 0x1074
push dword [ebp]
mov dword [esp + 0x74], edi
call dword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
inc edi
cmp edi, dword [ebx + 0x2220]
jl 0x44d7e5
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0xa8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44d752
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x875e6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
cmp dword [ebx + 0x22ec], edi
je 0x44d9c0
push ebx
call fcn.0044dabc
push 2
push ebp
call fcn.0044c37f
cmp eax, 2
jne 0x44d9e8
cmp edx, edi
jne 0x44d9e8
mov eax, dword [esp + 0x20]
movzx eax, ax
push eax
push edi
push 0x101e
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4bb4
ret 8