Function at 0x41769b
Capabilities:
Enumerate files on windows
Enumerate files recursively
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4fc
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push 0x7c
xor ebx, ebx
mov dword [esp + 0x2c], edi
push esi
mov dword [esp + 0x40], ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x417761
mov ecx, eax
mov dword [esp + 0x24], ebx
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.0043a92d
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
add edx, 2
mov ecx, dword [eax]
call fcn.004174bf
mov ecx, dword [esp + 0x18]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test esi, esi
je 0x417710
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x41774a
push dword [esp + 0x24]
lea eax, [esp + 0x24]
push 0x48f1b8
push eax
call fcn.00449eea
add esp, 0xc
mov edx, edi
mov ecx, dword [eax]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041769b
mov ecx, dword [esp + 0x30]
add esp, 0x10
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov eax, dword [esp + 0x24]
test eax, eax
je 0x417e65
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x417e65
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x4931a8
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x417972
lea ecx, [esp + 0x40]
call fcn.00430db9
lea edx, [esp + 0x40]
mov ecx, esi
call fcn.004329c8
test eax, eax
je 0x417797
push eax
jmp 0x4177c6
mov edx, str.ActionList_Media
lea ecx, [esp + 0x40]
call fcn.0043a873
mov dword [esp + 0x10], eax
test eax, eax
je 0x4177c4
push ecx
push 4
push str.Name
mov ecx, eax
call fcn.0043a719
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4177d1
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4178fe
push esi
lea ecx, [esp + 0x1c]
call fcn.0043b487
mov esi, dword [esp + 0x18]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x4177f3
or eax, 0xffffffff
jmp 0x4177f7
sub eax, esi
sar eax, 1
inc eax
lea ecx, [esp + 0x18]
push eax
call fcn.0043c894
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x417812
mov eax, 0x491414
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.0043ab55
pop ecx
push ebx
push ebx
push 0x20000000
push 3
push edi
push dword [eax]
call dword [sym.imp.WIMGAPI.DLL_WIMCreateFile]
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
call fcn.0043c924
cmp dword [esp + 0x1c], ebx
je 0x4178ed
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WIMGAPI.DLL_WIMSetTemporaryPath]
test edi, edi
je 0x4178e5
mov ecx, dword [esp + 0x10]
push 1
push 7
push str.Package
call fcn.0043a80d
jmp 0x4178dd
push ecx
push 0xb
push str.PackagePath
mov ecx, eax
call fcn.0043a719
mov dword [esp + 0x28], eax
test eax, eax
je 0x417965
mov eax, dword [eax + 4]
test eax, eax
jne 0x4178a1
mov eax, 0x491414
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.0043ab55
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
call fcn.004175ad
mov ecx, dword [esp + 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test edi, edi
je 0x41791b
push ecx
mov ecx, dword [esp + 0x24]
push 7
push str.Package
call fcn.0043a77e
mov dword [esp + 0x20], eax
test eax, eax
jne 0x41787a
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.00438772
lea ecx, [esi - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x80]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esp + 0x74]
call fcn.00431d5a
jmp 0x417e65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x28]
mov edi, eax
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x417933
mov ecx, 0x491414
push edi
push ecx
lea eax, [esp + 0x30]
push 0x49320c
push eax
call fcn.00449eea
add esp, 0x10
push dword [eax]
push str.Wimgapi
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push edi
jmp 0x417967
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4178ed
mov dword [esp + 0x24], ebx
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x24]
call fcn.0043ac50
push 9
push 0x49167c
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4179f8
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x12]
mov dword [esp + 0x1c], 3
push 0x493224
push eax
or edi, 0x1000
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
push 0xc
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x4179d9
push dword [esp + 0x24]
mov ecx, eax
call fcn.004175f0
jmp 0x4179db
mov eax, ebx
push eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0x48f1b8
push eax
call fcn.0043b543
mov esi, dword [esp + 0x2c]
add esp, 0xc
jmp 0x417a6d
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
cmp eax, 3
je 0x417a6a
cmp eax, 4
jne 0x417a14
mov ecx, esi
call fcn.0044c9a8
test eax, eax
jne 0x417a6a
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x417a65
sub eax, 1
je 0x417a57
sub eax, 1
je 0x417a4f
sub eax, 1
je 0x417a4a
sub eax, 1
je 0x417a3c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x417e4b
mov edi, dword [ebp + 0xc]
push 3
pop eax
or edi, 0x20000000
jmp 0x417a97
push 2
pop eax
jmp 0x417a52
xor eax, eax
inc eax
mov edi, dword [ebp + 0xc]
jmp 0x417a97
mov edi, dword [ebp + 0xc]
push 7
pop eax
or edi, 0x2000
jmp 0x417a97
mov edi, dword [ebp + 0xc]
jmp 0x417a95
mov edi, dword [ebp + 0xc]
push ebx
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
mov ecx, 0x490cc8
mov dword [esp + 0x40], ebx
call fcn.0044c96a
cmp dword [esp + 0x40], 0x60002
pop ecx
jbe 0x417a95
or edi, 0x20000000
mov eax, ebx
push ebx
push eax
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x38]
push edi
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMCreateFile]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x417e49
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WIMGAPI.DLL_WIMSetTemporaryPath]
test edi, edi
je 0x417e45
test edi, 0x40000000
jne 0x417e45
push 0x230
lea eax, [esp + 0x2dc]
push eax
push dword [esp + 0x24]
call dword [sym.imp.WIMGAPI.DLL_WIMGetAttributes]
test eax, eax
je 0x417e45
test byte [esp + 0x500], 0x10
je 0x417ba8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push esi
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.0043b487
test edi, edi
je 0x417b25
sub edi, esi
sar edi, 1
jmp 0x417b2c
mov eax, dword [esp + 0x10]
mov edi, dword [eax - 0xc]
push 0x491494
push edi
lea ecx, [esp + 0x18]
call fcn.004312e7
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x1c]
call fcn.0043ac50
mov esi, dword [esp + 0x10]
push 2
pop ebx
jmp 0x417b62
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.004175ad
inc ebx
push ebx
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00449eea
add esp, 0xc
lea ecx, [esp + 0x18]
push eax
call fcn.0043b599
mov ecx, dword [eax]
call fcn.0044c9a8
mov ecx, dword [esp + 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test edi, edi
jne 0x417b53
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esi - 0x10]
jmp 0x417e40
cmp dword [esp + 0x4f4], 3
jne 0x417e45
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
mov ecx, edi
mov dword [esp + 0x38], edi
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.0043a92d
push str.Microsoft_Windows_Foundation_Package.ESD
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x30]
call fcn.0043ab55
pop ecx
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [eax]
call fcn.0044c9a8
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
jne 0x417c55
push str.Microsoft_Windows_Foundation_Package.cab
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x38]
call fcn.0043ab55
pop ecx
push 3
pop ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [eax]
call fcn.0044c9a8
test eax, eax
jne 0x417c55
push str._Microsoft_Windows_Foundation_Package
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.0043ab55
pop ecx
lea ecx, [esp + 0x88]
push ecx
push dword [eax]
call esi
mov dword [esp + 0x28], eax
push 0xf
pop ecx
cmp eax, 0xffffffff
jne 0x417c59
mov byte [esp + 0x17], bl
jmp 0x417c5e
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x17], 1
test cl, 8
je 0x417c77
and ecx, 0xfffffff7
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
call fcn.0043899f
mov ecx, dword [esp + 0x10]
test cl, 4
je 0x417c93
and ecx, 0xfffffffb
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x10]
test cl, 2
je 0x417caf
and ecx, 0xfffffffd
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x34]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x10]
and ecx, 0xfffffffe
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp byte [esp + 0x17], bl
je 0x417e39
push 0x48d254
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x30]
call fcn.0043ab55
pop ecx
lea ecx, [esp + 0x88]
push ecx
push dword [eax]
call esi
mov ecx, dword [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x28], esi
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp esi, 0xffffffff
je 0x417e30
test byte [esp + 0x88], 0x10
je 0x417da6
lea ecx, [esp + 0xb4]
call fcn.0044bd7f
test al, al
jne 0x417d65
or dword [esp + 0x10], 0x30
lea edx, [esp + 0x18]
mov eax, ecx
lea ecx, [esp + 0x34]
push str._filehashes_.dat
push eax
call fcn.0043ab55
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.0043ab55
pop ecx
mov ecx, dword [eax]
call fcn.0044c9a8
cmp eax, 1
jne 0x417d65
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], bl
mov dword [esp + 0x10], eax
jmp 0x417d6e
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], 1
test al, 0x20
je 0x417d89
mov ecx, dword [esp + 0x2c]
and eax, 0xffffffdf
mov dword [esp + 0x10], eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x417da0
mov ecx, dword [esp + 0x34]
and eax, 0xffffffef
mov dword [esp + 0x10], eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp byte [esp + 0x17], bl
jmp 0x417de7
push edi
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x417e15
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
push 0x491a4c
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x417de9
push 0x490c48
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x417e15
lea eax, [esp + 0xb4]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.0043ab55
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
call fcn.004175ad
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea eax, [esp + 0x88]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [esp + 0x38]
test eax, eax
jne 0x417d06
lea ecx, [esp + 0x28]
call fcn.0043899f
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov eax, dword [esp + 0x1c]
mov ebx, eax
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x417e65
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret