Function at 0x420dce
Capabilities:
Enumerate files on windows
Get disk information
Get file system object information

Disassembly:
mov eax, 0x4bb4
call fcn.0044a5e0
push ebx
push ebp
mov ebp, dword [esp + 0x4bc0]
push esi
push edi
push 2
mov ebx, dword [ebp + 0x10]
push ebp
call fcn.00420cc5
xor edi, edi
cmp eax, 2
jne 0x420e0b
cmp edx, edi
jne 0x420e0b
push edi
push edi
push 0x101d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x420e0f
mov eax, dword [esp + 0x24]
push 1
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x34
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.0042bcb0
mov esi, dword [esp + 0x4bd8]
add esp, 0xc
test esi, esi
jne 0x420e3b
mov esi, 0x4a6494
push 0x5c
pop eax
cmp word [esi], ax
jne 0x420e5a
push eax
lea edi, [esi + 2]
push edi
call fcn.004494e0
pop ecx
pop ecx
push 0x5c
test eax, eax
pop eax
jne 0x420e58
mov esi, edi
xor edi, edi
test esi, esi
je 0x420f1f
cmp word [esi], di
je 0x420f1f
push eax
push esi
call fcn.004494e0
pop ecx
pop ecx
push esi
test eax, eax
jne 0x420e8f
lea eax, [ebx + 0x214]
push eax
call fcn.0042be0a
pop ecx
pop ecx
lea edi, [ebx + 0xc]
jmp 0x420f27
lea edi, [ebx + 0xc]
mov dword [esp + 0x18], edi
call fcn.0042be2c
pop ecx
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
jne 0x420ebf
push esi
push edi
call fcn.0042be0a
pop ecx
pop ecx
movzx eax, word [edi]
cmp eax, 0x61
jb 0x420f24
add eax, 0xffffffe0
movzx eax, ax
jmp 0x420f24
push 0x208
xor eax, eax
push eax
push edi
call fcn.0042bcb0
push esi
call fcn.0042be2c
add esp, 0x10
test eax, eax
js 0x420f2b
lea ecx, [esi + eax*2]
push 0x5c
mov dword [esp + 0x14], ecx
pop edx
cmp word [ecx], dx
je 0x420ef7
sub ecx, 2
sub eax, 1
mov dword [esp + 0x10], ecx
jns 0x420ee4
jmp 0x420f27
lea eax, [eax*2 + 2]
push eax
push esi
push edi
call fcn.0043b210
mov eax, dword [esp + 0x1c]
add eax, 2
push eax
lea eax, [ebx + 0x214]
push eax
call fcn.0042be0a
add esp, 0x14
jmp 0x420eaf
lea edi, [ebx + 0xc]
xor eax, eax
mov word [edi], ax
mov dword [esp + 0x14], edi
xor esi, esi
cmp word [edi], si
jne 0x420f3c
push dword [ebp]
call fcn.0044a344
jmp 0x420f45
push edi
push dword [ebp]
call fcn.0044a29b
push esi
push esi
push 0x1009
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp word [edi], si
jne 0x421161
test byte [ebx + 8], 4
jne 0x421785
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0x10000
mov dword [esp + 0x3c], 0x4a6494
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
lea eax, [esp + 0x7b4]
push 0x4a5760
push eax
mov dword [esp + 0x18], edi
call fcn.0042be0a
pop ecx
pop ecx
mov dword [esp + 0x14], esi
xor eax, eax
mov ecx, esi
inc eax
shl eax, cl
test edi, eax
je 0x4210b4
lea eax, [esi + 0x41]
mov dword [esp + 0x48], esi
mov word [esp + 0x7b4], ax
xor eax, eax
mov word [esp + 0x2f8], ax
lea eax, [esp + 0x714]
push str.Drive
push eax
call fcn.0042be0a
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x508]
pop ecx
pop ecx
push 0x4001
push 0x2b4
push eax
xor eax, eax
push eax
lea eax, [esp + 0x7c4]
push eax
call edi
mov eax, dword [esp + 0x504]
push 0x200
mov dword [esp + 0x48], eax
lea eax, [esp + 0x504]
push 0x2b4
push eax
xor eax, eax
push eax
lea eax, [esp + 0x7c4]
push eax
call edi
lea eax, [esp + 0x50c]
push eax
lea eax, [esp + 0x2fc]
push eax
call fcn.0042be0a
pop ecx
pop ecx
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov edi, ecx
cmp dword [ebx + 0x2220], ecx
jle 0x421158
mov esi, eax
cmp byte [ebx + edi + 0x2224], 2
jne 0x4210a3
lea eax, [esp + 0x2f8]
mov dword [esp + 0x64], edi
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push esi
push 0x1074
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, dword [ebx + 0x2220]
jl 0x421076
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
xor ecx, ecx
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x1f
jle 0x420fa8
cmp dword [0x4e6590], 0
je 0x421783
test dword [ebx + 8], 0x200
jne 0x421783
mov eax, dword [0x4e8a84]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
push ecx
push 0x104d
push dword [ebp]
mov dword [esp + 0x4c], 0x4a6494
mov dword [esp + 0x58], 0xfd
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
xor eax, eax
mov esi, eax
cmp dword [ebx + 0x2220], eax
jle 0x421783
cmp byte [ebx + esi + 0x2224], 2
jne 0x42114a
lea eax, [esp + 0x5c]
mov dword [esp + 0x64], esi
push eax
push edi
push 0x1074
push dword [ebp]
mov dword [esp + 0x80], 0x4e7838
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, dword [ebx + 0x2220]
jl 0x42111d
jmp 0x421783
mov edi, dword [esp + 0x10]
jmp 0x4210b6
test byte [ebx + 8], 2
jne 0x421266
mov eax, dword [0x4e8a80]
push 0x5c
mov dword [esp + 0x48], eax
pop eax
push eax
push eax
push edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], 0x4a6494
call fcn.004494e0
pop ecx
pop ecx
add eax, 2
push eax
call fcn.004494e0
neg eax
pop ecx
sbb eax, eax
neg eax
add eax, 0xfa
pop ecx
mov dword [esp + 0x48], eax
cmp dword [0x4e6590], esi
je 0x421206
test dword [ebx + 8], 0x200
jne 0x421206
push 0x4e7a40
call fcn.0042be2c
push eax
push 0x4e7a40
push edi
call fcn.00449590
add esp, 0x10
test eax, eax
jne 0x421206
push 0x5c
pop eax
push eax
push 0x4e7a40
call fcn.0042be2c
add eax, 6
pop ecx
lea eax, [ebx + eax*2]
push eax
call fcn.004494e0
pop ecx
pop ecx
test eax, eax
jne 0x421206
mov dword [esp + 0x48], 0xfa
lea eax, [esp + 0x28]
push eax
push esi
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x18], eax
xor eax, eax
cmp dword [ebx + 0x2220], eax
jle 0x421266
mov edi, dword [esp + 0x18]
cmp byte [ebx + esi + 0x2224], 2
jne 0x421259
lea eax, [esp + 0x5c]
mov dword [esp + 0x64], esi
push eax
push edi
push 0x1074
push dword [ebp]
mov dword [esp + 0x80], 0x4a6418
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, dword [ebx + 0x2220]
jl 0x42122c
mov edi, dword [esp + 0x14]
test byte [ebx + 8], 4
jne 0x421472
lea eax, [esp + 0x2f8]
push edi
push eax
call fcn.0042be0a
lea eax, [esp + 0x300]
push 0x4a6450
push eax
call fcn.0042c48f
add esp, 0x10
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
je 0x421472
push 7
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0x3c], 0x4a6494
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0xfc
test byte [esp + 0xa8], 0x10
je 0x421450
lea eax, [esp + 0xd4]
push 0x4a6420
push eax
call fcn.00448b94
pop ecx
pop ecx
test eax, eax
je 0x421450
lea eax, [esp + 0xd4]
push 0x4a6418
push eax
call fcn.00448b94
pop ecx
pop ecx
test eax, eax
je 0x421450
mov eax, dword [0x4e8a80]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edi, eax
mov esi, ecx
cmp dword [ebx + 0x2220], ecx
jle 0x42144c
movzx eax, byte [ebx + esi + 0x2224]
dec eax
sub eax, 1
je 0x42141a
sub eax, 3
je 0x4213a5
sub eax, 1
je 0x42139c
sub eax, 1
je 0x421393
sub eax, 1
jne 0x42143f
lea eax, [esp + 0xb4]
push eax
push esi
push edi
push dword [ebp]
call fcn.00420d0e
jmp 0x42143d
lea eax, [esp + 0xbc]
jmp 0x421383
lea eax, [esp + 0xac]
jmp 0x421383
push 0xb
push ecx
lea eax, [esp + 0x98]
push eax
call fcn.0042bcb0
mov edx, str.RHSDANTCOE
mov ecx, 0x4e6564
add esp, 0xc
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0xa8]
test dword [ecx], eax
je 0x4213fb
lea eax, [esp + 0x90]
push eax
call fcn.0042be2c
mov edx, dword [esp + 0x20]
pop ecx
lea ecx, [esp + 0x90]
lea ecx, [ecx + eax*2]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [esp + 0x10]
add ecx, 4
add edx, 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0x4e6588
jle 0x4213ca
lea eax, [esp + 0x90]
jmp 0x421421
lea eax, [esp + 0xd4]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push edi
push 0x1074
push dword [ebp]
mov dword [esp + 0x74], esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
inc esi
cmp esi, dword [ebx + 0x2220]
jl 0x421352
mov esi, dword [esp + 0x18]
lea eax, [esp + 0xa8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4212db
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x14]
test byte [ebx + 8], 1
jne 0x421778
lea eax, [esp + 0x29bc]
push eax
lea eax, [ebx + 0x214]
push eax
call fcn.00449cb0
push 0x4e98a0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x2f8]
push edi
push eax
call fcn.0042be0a
lea eax, [esp + 0x300]
push 0x4a6450
push eax
call fcn.0042c48f
add esp, 0x10
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x421778
xor eax, eax
mov dword [esp + 0x28], 7
push 0x2b4
push eax
lea eax, [esp + 0x508]
mov dword [esp + 0x34], 0xffff
push eax
mov dword [esp + 0x48], 0x4a6494
mov dword [esp + 0x50], 0xa
mov dword [esp + 0x54], 0xff
call fcn.0042bcb0
mov esi, dword [esp + 0x1c]
add esp, 0xc
test byte [esp + 0xa8], 0x10
jne 0x42175a
lea eax, [esp + 0x29bc]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.00449c10
test eax, eax
je 0x42175a
lea eax, [esp + 0x2f8]
push edi
push eax
call fcn.0042be0a
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x304]
push eax
call fcn.0042c48f
add esp, 0x10
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2fc]
push eax
call fcn.00449fd9
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push 0x104d
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov dword [esp + 0x18], eax
mov esi, edx
cmp dword [ebx + 0x2220], edx
jle 0x421756
mov edi, eax
movzx eax, byte [ebx + esi + 0x2224]
dec eax
sub eax, 1
je 0x421720
sub eax, 1
je 0x42169e
sub eax, 1
je 0x421695
sub eax, 1
je 0x42161d
sub eax, 1
je 0x421614
sub eax, 1
je 0x42160b
sub eax, 1
jne 0x421745
lea eax, [esp + 0xb4]
push eax
push esi
push edi
push dword [ebp]
call fcn.00420d0e
jmp 0x421743
lea eax, [esp + 0xbc]
jmp 0x4215fb
lea eax, [esp + 0xac]
jmp 0x4215fb
push 0xb
push edx
lea eax, [esp + 0x98]
push eax
call fcn.0042bcb0
mov edx, str.RHSDANTCOE
mov ecx, 0x4e6564
add esp, 0xc
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0xa8]
test dword [ecx], eax
je 0x421673
lea eax, [esp + 0x90]
push eax
call fcn.0042be2c
mov edx, dword [esp + 0x20]
pop ecx
lea ecx, [esp + 0x90]
lea ecx, [ecx + eax*2]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [esp + 0x18]
add ecx, 4
add edx, 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0x4e6588
jle 0x421642
lea eax, [esp + 0x90]
jmp 0x421727
mov eax, dword [esp + 0x24]
jmp 0x421727
mov ecx, dword [esp + 0xc4]
test ecx, ecx
je 0x4216cc
xor eax, eax
add eax, dword [esp + 0xc8]
adc ecx, edx
shrd eax, ecx, 0xa
shr ecx, 0xa
push ecx
push eax
lea eax, [esp + 0x300]
push eax
call fcn.00449747
jmp 0x421703
mov ecx, dword [esp + 0xc8]
lea eax, [ecx - 1]
cmp eax, 0x3ffffffe
ja 0x4216ea
add ecx, 0x3ff
mov dword [esp + 0xc8], ecx
shr ecx, 0xa
lea eax, [esp + 0x2f8]
push ecx
push 0x4a4cdc
push eax
call fcn.0041fb3b
add esp, 0xc
lea eax, [esp + 0x2f8]
push 0x4a5fe8
push eax
call fcn.0042c48f
pop ecx
pop ecx
lea eax, [esp + 0x2f8]
jmp 0x421727
lea eax, [esp + 0xd4]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push edi
push 0x1074
push dword [ebp]
mov dword [esp + 0x74], esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
inc esi
cmp esi, dword [ebx + 0x2220]
jl 0x4215b8
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0xa8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x421525
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4e98a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
cmp dword [ebx + 0x22ec], esi
je 0x421793
push ebx
call fcn.004204fc
push 2
push ebp
call fcn.00420cc5
cmp eax, 2
jne 0x4217bb
cmp edx, esi
jne 0x4217bb
mov eax, dword [esp + 0x20]
movzx eax, ax
push eax
push esi
push 0x101e
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4bb4
ret 8