Function at 0x42cde0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x468bf0
mov eax, dword fs:[0]
push eax
mov eax, 0x1a44
call fcn.00454790
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x1a40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48807c]
xor eax, esp
push eax
lea eax, [esp + 0x1a58]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1a68]
push edi
xor esi, esi
push str.ProcessSectionIsAnyDriverExist_____s__n
mov ebx, ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x30], esi
call fcn.004454c0
inc dword [ebx + 0x8ee0]
mov eax, dword [ebx + 0x8ee0]
push eax
push edi
push str.Push___s____index___d__n
call fcn.004454c0
mov eax, dword [ebx + 0x8ee0]
imul eax, eax, 0x88
mov dword [eax + ebx + 0x4b64], 0xffffffff
mov edx, dword [ebx + 0x8ee0]
add esp, 0x14
imul edx, edx, 0x88
mov ecx, edi
lea edx, [edx + ebx + 0x4ae4]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, si
jne 0x42ce84
mov ecx, dword [ebx + 4]
push esi
lea eax, [esp + 0xa58]
push eax
push esi
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x44], esi
call fcn.00409a10
test al, al
je 0x42d4da
jmp 0x42cec0
lea ecx, [esp + 0xa54]
push ecx
push esi
push edi
push str.__s___d____s__n
call fcn.004454c0
add esp, 0x10
lea edx, [esp + 0xa54]
push edx
mov ecx, ebx
call fcn.004190c0
push 0x1c2d0
call fcn.004534f0
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1a60], 0
test eax, eax
je 0x42cf15
mov ecx, eax
call fcn.00444be0
mov ebp, eax
mov dword [esp + 0x38], eax
jmp 0x42cf1b
xor ebp, ebp
mov dword [esp + 0x38], ebp
push 0x474298
lea eax, [esp + 0xa58]
push eax
mov ecx, ebp
mov dword [esp + 0x1a68], 0xffffffff
call fcn.00444e30
cmp byte [ebp + 0x1c2cc], 0
je 0x42cf58
cmp dword [ebp + 0x1c2c8], 0
jg 0x42cf50
xor eax, eax
jmp 0x42cf66
lea eax, [ebp + 0x32c8]
jmp 0x42cf66
xor eax, eax
cmp dword [ebp + 0x1c2c8], eax
setle al
dec eax
and eax, ebp
push str.DriverClass
push eax
call fcn.00453ad3
add esp, 8
test eax, eax
jne 0x42d3e5
inc dword [ebx + 0x8ee0]
mov ecx, dword [ebx + 0x8ee0]
cmp byte [ebp + 0x1c2cc], al
je 0x42cfa0
cmp dword [ebp + 0x1c2c8], eax
jle 0x42cfae
lea eax, [ebp + 0x32c8]
jmp 0x42cfae
xor eax, eax
cmp dword [ebp + 0x1c2c8], eax
setle al
dec eax
and eax, ebp
push ecx
push eax
push str.__Push___s_m_nCurSct___Index___d__n
call fcn.004454c0
mov ecx, dword [ebx + 0x8ee0]
imul ecx, ecx, 0x88
add esp, 0xc
mov dword [ecx + ebx + 0x4b64], 0xffffffff
cmp byte [ebp + 0x1c2cc], 0
je 0x42cff2
cmp dword [ebp + 0x1c2c8], 0
jg 0x42cfea
xor ecx, ecx
jmp 0x42d000
lea ecx, [ebp + 0x32c8]
jmp 0x42d000
xor ecx, ecx
cmp dword [ebp + 0x1c2c8], ecx
setle cl
dec ecx
and ecx, ebp
mov edx, dword [ebx + 0x8ee0]
imul edx, edx, 0x88
lea edx, [edx + ebx + 0x4ae4]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x42d013
inc dword [esp + 0x14]
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x2c6]
or esi, 0xffffffff
push ecx
mov dword [esp + 0x2c], esi
mov word [esp + 0x2c8], ax
call fcn.00453450
add esp, 0xc
cmp byte [ebp + 0x1c2cc], 0
je 0x42d06a
cmp dword [ebp + 0x1c2c8], 1
jg 0x42d062
xor ecx, ecx
jmp 0x42d07d
lea ecx, [ebp + 0x3ac8]
jmp 0x42d07d
cmp dword [ebp + 0x1c2c8], 1
jg 0x42d077
xor ecx, ecx
jmp 0x42d07d
lea ecx, [ebp + 0x104]
lea edx, [esp + 0x2bc]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x42d084
lea edx, [esp + 0x2bc]
push edx
push str.___szClass_____s__n
call fcn.004454c0
lea eax, [esp + 0x2c4]
push str.Image
push eax
call fcn.00453ad3
add esp, 0x10
test eax, eax
jne 0x42d3ac
push 0x104
lea ecx, [esp + 0x648]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x644]
push edx
lea eax, [esp + 0x440]
push str._sinfoem.inf
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x42d3ac
jmp 0x42d120
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x648]
push ecx
lea edx, [esp + 0x444]
push str._sinf_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x4fc8
call fcn.004534f0
add esp, 0x14
mov dword [esp + 0x18], eax
mov dword [esp + 0x1a60], 1
test eax, eax
je 0x42d17c
push 0
lea ecx, [esp + 0x440]
push ecx
mov ecx, eax
call fcn.00446910
mov esi, eax
mov dword [esp + 0x1c], eax
jmp 0x42d182
xor esi, esi
mov dword [esp + 0x1c], esi
push 0x478
mov dword [esp + 0x1a64], 0xffffffff
call fcn.004534f0
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1a60], 2
test eax, eax
je 0x42d1c8
mov edx, dword [ebx + 8]
movzx ecx, byte [edx + 0x1e89]
mov edx, dword [ebx]
push ecx
push 0
push edx
mov ecx, eax
call fcn.00405420
mov edi, eax
jmp 0x42d1ca
xor edi, edi
lea eax, [esp + 0x2bc]
push eax
mov ecx, esi
mov dword [esp + 0x1a64], 0xffffffff
call fcn.00445ce0
push eax
call fcn.00453ad3
add esp, 8
test eax, eax
jne 0x42d359
lea ecx, [esp + 0x43c]
push ecx
push str.____Found_Inf___s__n
call fcn.004454c0
add esp, 8
lea ecx, [esp + 0x54]
call fcn.00407e20
lea edx, [esp + 0x54]
push edx
mov ecx, esi
mov dword [esp + 0x1a64], 3
call fcn.00446b20
mov dword [esp + 0x18], eax
test eax, eax
je 0x42d345
xor esi, esi
mov dword [esp + 0x2c], esi
test eax, eax
jle 0x42d338
lea ecx, [esp + 0x3c]
call fcn.00407e20
mov eax, dword [esp + 0x54]
mov eax, dword [eax + esi*8]
push eax
push str.MANUF____s__n
mov byte [esp + 0x1a68], 4
call fcn.004454c0
mov ecx, dword [esp + 0x5c]
mov ecx, dword [ecx + esi*8]
add esp, 8
lea edx, [esp + 0x84c]
jmp 0x42d280
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x42d280
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x850]
push eax
call fcn.00446c10
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x42d307
nop
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx + esi*8]
push eax
push esi
push str._____saModels__d___s_n
call fcn.004454c0
add esp, 0xc
test edi, edi
je 0x42d302
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + esi*8]
mov ecx, dword [ebx + 0xc]
push 0x478188
push eax
call fcn.004495e0
test eax, eax
je 0x42d302
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + esi*8]
push eax
mov ecx, edi
call fcn.00402c90
cmp dword [esp + 0x20], 1
jne 0x42d2fe
mov eax, 1
mov dword [esp + 0x20], eax
inc esi
cmp esi, ebp
jl 0x42d2b0
lea ecx, [esp + 0x3c]
call fcn.00401b40
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1a60], 3
call fcn.00405350
mov esi, dword [esp + 0x2c]
inc esi
cmp esi, dword [esp + 0x18]
mov dword [esp + 0x2c], esi
jl 0x42d244
mov ebp, dword [esp + 0x38]
lea ecx, [esp + 0x54]
call fcn.00401b40
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x54]
mov dword [esp + 0x1a60], 0xffffffff
call fcn.00405350
test edi, edi
je 0x42d36d
mov ecx, edi
call fcn.004054c0
push edi
call fcn.004534ca
add esp, 4
test esi, esi
je 0x42d381
mov ecx, esi
call fcn.00447670
push esi
call fcn.004534ca
add esp, 4
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x6c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42d120
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
push esi
push str.__nKeyResult_____d__n
call fcn.004454c0
add esp, 8
cmp esi, 0xffffffff
jne 0x42d3ce
push str.__Set_nKeyResult_to__0__n
xor esi, esi
call fcn.004454c0
add esp, 4
mov ecx, dword [ebx + 0x8ee0]
imul ecx, ecx, 0x88
mov dword [ecx + ebx + 0x4b64], esi
mov esi, dword [esp + 0x34]
cmp byte [ebp + 0x1c2cc], 0
je 0x42d403
cmp dword [ebp + 0x1c2c8], 0
jg 0x42d3fb
xor eax, eax
jmp 0x42d411
lea eax, [ebp + 0x32c8]
jmp 0x42d411
xor eax, eax
cmp dword [ebp + 0x1c2c8], eax
setle al
dec eax
and eax, ebp
push str.Return
push eax
call fcn.00453ad3
add esp, 8
test eax, eax
jne 0x42d4a9
xor edx, edx
push 0xfe
push edx
lea eax, [esp + 0x346]
push eax
mov word [esp + 0x348], dx
call fcn.00453450
add esp, 0xc
cmp byte [ebp + 0x1c2cc], 0
je 0x42d465
cmp dword [ebp + 0x1c2c8], 1
jg 0x42d45d
xor ecx, ecx
jmp 0x42d478
lea ecx, [ebp + 0x3ac8]
jmp 0x42d478
cmp dword [ebp + 0x1c2c8], 1
jg 0x42d472
xor ecx, ecx
jmp 0x42d478
lea ecx, [ebp + 0x104]
lea edx, [esp + 0x33c]
nop
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x42d480
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x340]
push edx
mov ecx, ebx
call fcn.00420020
mov dword [esp + 0x28], eax
mov ecx, ebp
call fcn.0043df40
push ebp
call fcn.004534ca
mov ecx, dword [ebx + 4]
add esp, 4
push 0
lea eax, [esp + 0xa58]
push eax
inc esi
push esi
push edi
mov dword [esp + 0x44], esi
call fcn.00409a10
test al, al
jne 0x42cec0
cmp dword [esp + 0x14], 1
jl 0x42d559
mov esi, dword [esp + 0x14]
xor ebp, ebp
or edi, 0xffffffff
lea ebx, [ebx]
mov eax, dword [ebx + 0x8ee0]
push eax
imul eax, eax, 0x88
lea ecx, [eax + ebx + 0x4ae4]
push ecx
push str.Pop___s__index___d__n
call fcn.004454c0
mov edx, dword [ebx + 0x8ee0]
imul edx, edx, 0x88
mov dword [edx + ebx + 0x4b64], edi
mov eax, dword [ebx + 0x8ee0]
imul eax, eax, 0x88
mov dword [eax + ebx + 0x4ae0], ebp
mov ecx, dword [ebx + 0x8ee0]
imul ecx, ecx, 0x88
xor edx, edx
mov word [ecx + ebx + 0x4ae4], dx
add dword [ebx + 0x8ee0], edi
add esp, 0xc
sub esi, 1
jne 0x42d4f0
mov esi, dword [esp + 0x28]
mov eax, dword [ebx + 0x8ee0]
mov ecx, dword [esp + 0x30]
push esi
push eax
push ecx
push str.Look_at___s____index___d__Res___d__n_n
call fcn.004454c0
mov edx, dword [ebx + 0x8ee0]
add esp, 0x10
imul edx, edx, 0x88
mov dword [edx + ebx + 0x4b64], esi
mov eax, esi
mov ecx, dword [esp + 0x1a58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a40]
xor ecx, esp
call fcn.00453432
add esp, 0x1a50
ret 4