Function at 0x427089
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
mov eax, 0x45ff9c
call fcn.0045d320
sub esp, 0x27c
push ebx
push esi
push edi
lea eax, [ebp - 0x1f]
mov edi, ecx
push 3
push eax
mov dword [ebp - 0x1c], edi
call fcn.004278b0
mov esi, 0xff
cmp word [ebp - 0x1e], si
ja 0x4273bc
movzx eax, word [ebp - 0x1e]
push eax
lea eax, [ebp - 0x288]
push eax
mov ecx, edi
call fcn.004278b0
movzx eax, word [ebp - 0x1e]
xor ebx, ebx
cmp dword [edi + 8], ebx
mov byte [ebp + eax - 0x288], bl
je 0x4273bc
lea eax, [ebp - 0x288]
push eax
call fcn.004283e6
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0043209f
lea eax, [ebp - 0x288]
mov dword [ebp - 4], ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov ecx, dword [0x47aaf0]
test eax, eax
mov eax, dword [ecx]
jne 0x4271ab
push ebx
push str.View_folder__root_disks_
call dword [eax + 0x3c]
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x4273b0
xor esi, esi
cmp byte [ebp - 0x148], bl
je 0x4272a4
lea edi, [ebp - 0x148]
push edi
call dword [sym.imp.MSVCRT.dll__strdup]
push 0x5c
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0xc
cmp eax, ebx
je 0x427168
mov byte [eax], bl
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.004320d7
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll_free]
mov dword [esp], 0x47a63c
push edi
call dword [sym.imp.MSVCRT.dll_strcspn]
lea esi, [esi + eax + 1]
pop ecx
pop ecx
cmp byte [ebp + esi - 0x148], bl
lea edi, [ebp + esi - 0x148]
jne 0x42714c
mov edi, dword [ebp - 0x1c]
jmp 0x4272a4
lea edx, [ebp - 0x288]
push edx
push str.View_folder__s_
call dword [eax + 0x3c]
lea eax, [ebp - 0x288]
push 0x471840
push eax
call sub.MSVCRT.dll_strcat
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop ecx
pop ecx
push 1
call esi
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 0x1c], eax
call esi
cmp dword [ebp - 0x14], 0xffffffff
je 0x4273cb
lea eax, [ebp - 0x15c]
push 0x47183c
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x427283
lea eax, [ebp - 0x15c]
push 0x471838
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x427283
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x170]
sub eax, 0x61da8000
push ebx
sbb ecx, 0x1028f051
push 0x989680
push ecx
push eax
call fcn.0045d670
test byte [ebp - 0x188], 0x10
mov dword [ebp - 0x34], eax
je 0x427267
push ebx
push 0xffffffffffffffff
jmp 0x427274
test byte [ebp - 0x1f], 0x10
jne 0x427283
push edx
push dword [ebp - 0x168]
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004320d7
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x427204
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x1f]
lea ecx, [ebp - 0x2c]
and al, 0xf0
mov byte [ebp - 0x14], 0x82
mov byte [ebp - 0x13], al
call fcn.004321e0
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x12], ax
call fcn.004321e4
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.004321e0
add esi, eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x10], si
call fcn.004321e0
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.004321e4
lea ecx, [ebp - 0x2c]
lea esi, [eax + esi*8]
call fcn.004321e0
lea eax, [esi + eax + 6]
lea ecx, [ebp - 0x48]
push eax
call fcn.00411c93
lea eax, [ebp - 0x14]
push 6
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00411cce
lea ecx, [ebp - 0x2c]
xor esi, esi
call fcn.004321e0
test eax, eax
jle 0x427351
push esi
lea ecx, [ebp - 0x2c]
call fcn.00432198
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
call fcn.004321bc
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push 8
push eax
lea ecx, [ebp - 0x48]
call fcn.00411cce
lea ecx, [ebp - 0x2c]
inc esi
call fcn.004321e0
cmp esi, eax
jl 0x42731e
lea ecx, [ebp - 0x2c]
xor esi, esi
call fcn.004321e0
test eax, eax
jle 0x42738c
push esi
lea ecx, [ebp - 0x2c]
call fcn.0043217b
push eax
mov dword [ebp - 0x1c], eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea ecx, [ebp - 0x48]
push dword [ebp - 0x1c]
call fcn.00411cce
lea ecx, [ebp - 0x2c]
inc esi
call fcn.004321e0
cmp esi, eax
jl 0x42735f
mov eax, dword [edi + 0x1c]
push 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x48]
mov esi, dword [eax]
call fcn.00412465
mov ecx, dword [edi + 0x1c]
push eax
call dword [esi + 4]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00411cb9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004320cc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
cmp dword [ebp - 0x1c], ebx
je 0x42729b
cmp dword [ebp - 0x1c], 2
je 0x42729b
mov al, byte [ebp - 0x1f]
mov ecx, dword [edi + 0x1c]
or al, 0x80
mov byte [ebp - 0x1c], 0x82
mov word [ebp - 0x1a], bx
mov word [ebp - 0x18], bx
mov byte [ebp - 0x1b], al
mov eax, dword [ecx]
push 1
lea edx, [ebp - 0x1c]
push 6
push edx
call dword [eax + 4]
jmp 0x4273b0