Function at 0x44577b
Capabilities:
Enumerate files on windows
Get disk information
Get file system object information

Disassembly:
mov eax, 0x152c
call fcn.0042b3e0
push ebx
mov ebx, dword [esp + 0x1534]
push ebp
push esi
push edi
mov edi, dword [ebx + 0x10]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x34
lea eax, [esp + 0x2c]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [esp + 0x1550]
add esp, 0xc
test esi, esi
jne 0x4457bc
mov esi, 0x489028
cmp byte [esi], 0x5c
jne 0x4457d4
lea ebp, [esi + 1]
push 0x5c
push ebp
call sub.MSVCRT.dll_strchr
pop ecx
pop ecx
test eax, eax
jne 0x4457d4
mov esi, ebp
test esi, esi
je 0x44589f
cmp byte [esi], 0
je 0x44589f
push 0x5c
push esi
call sub.MSVCRT.dll_strchr
pop ecx
pop ecx
push esi
test eax, eax
jne 0x445804
lea eax, [edi + 0x110]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x44585b
call sub.MSVCRT.dll_strlen
pop ecx
lea ebp, [edi + 0xc]
cmp byte [eax + esi - 1], 0x5c
jne 0x44582f
push esi
push ebp
call sub.MSVCRT.dll_strcpy
mov al, byte [ebp]
pop ecx
cmp al, 0x61
movsx eax, al
pop ecx
jl 0x44582a
sub eax, 0x20
mov byte [ebp], al
jmp 0x44585b
push 0x104
push 0
push ebp
call sub.MSVCRT.dll_memset
push esi
call sub.MSVCRT.dll_strlen
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x445854
cmp byte [ebx + esi], 0x5c
je 0x44586d
dec ebx
jns 0x44584b
mov ebx, dword [esp + 0x1540]
lea ebp, [edi + 0xc]
cmp byte [ebp], 0
jne 0x4458a5
push dword [ebx]
call fcn.0044b67a
jmp 0x4458ad
lea eax, [ebx + 1]
push eax
push esi
push ebp
call sub.MSVCRT.dll_memcpy
lea eax, [esi + 1]
add eax, ebx
push eax
lea eax, [edi + 0x110]
push eax
call sub.MSVCRT.dll_strcpy
mov al, byte [ebp]
add esp, 0x14
cmp al, 0x61
movsx eax, al
jl 0x44589a
sub eax, 0x20
mov byte [ebp], al
jmp 0x445854
mov byte [edi + 0xc], 0
jmp 0x44585b
push ebp
push dword [ebx]
call fcn.0044ba7e
push 0
push 0
push 0x1009
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp byte [ebp], 0
jne 0x445ab2
test byte [edi + 8], 4
jne 0x4460ad
and dword [esp + 0x30], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0x10000
mov dword [esp + 0x3c], 0x489028
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
lea eax, [esp + 0x438]
push 0x48a380
push eax
mov dword [esp + 0x1c], ebp
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
xor eax, eax
inc eax
shl eax, cl
test ebp, eax
je 0x445a13
lea eax, [ecx + 0x41]
mov byte [esp + 0x1d4], 0
mov byte [esp + 0x438], al
lea eax, [esp + 0x3e8]
push str.Drive
push eax
mov dword [esp + 0x50], ecx
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x4001
push 0x160
lea eax, [esp + 0x2e0]
push eax
push 0
lea eax, [esp + 0x448]
push eax
call dword [sym.imp.SHELL32.DLL_SHGetFileInfoA]
mov eax, dword [esp + 0x2dc]
push 0x200
mov dword [esp + 0x48], eax
lea eax, [esp + 0x2dc]
push 0x160
push eax
push 0
lea eax, [esp + 0x448]
push eax
call dword [sym.imp.SHELL32.DLL_SHGetFileInfoA]
lea eax, [esp + 0x2e4]
push eax
lea eax, [esp + 0x1d8]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [esp + 0x28]
push eax
push 0
push 0x1007
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor esi, esi
mov dword [esp + 0x18], eax
cmp dword [edi + 0x111c], esi
jle 0x445a0f
mov ebp, eax
cmp byte [edi + esi + 0x1120], 2
jne 0x445a02
lea eax, [esp + 0x1d4]
mov dword [esp + 0x64], esi
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push ebp
push 0x102e
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageA]
inc esi
cmp esi, dword [edi + 0x111c]
jl 0x4459d6
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1f
jle 0x445915
cmp dword [0x49b07c], 0
je 0x4460ad
test dword [edi + 8], 0x200
jne 0x4460ad
mov eax, dword [0x49f0b8]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x1007
push dword [ebx]
mov dword [esp + 0x4c], 0x489028
mov dword [esp + 0x58], 0xfd
call dword [sym.imp.USER32.DLL_SendMessageA]
xor esi, esi
mov ebp, eax
cmp dword [edi + 0x111c], esi
jle 0x4460ad
cmp byte [edi + esi + 0x1120], 2
jne 0x445aa4
lea eax, [esp + 0x5c]
mov dword [esp + 0x64], esi
push eax
push ebp
push 0x102e
push dword [ebx]
mov dword [esp + 0x80], 0x49f168
call dword [sym.imp.USER32.DLL_SendMessageA]
inc esi
cmp esi, dword [edi + 0x111c]
jl 0x445a78
jmp 0x4460ad
test byte [edi + 8], 2
jne 0x445ba4
mov eax, dword [0x49f0b4]
and dword [esp + 0x2c], 0
push 0x5c
push 0x5c
push ebp
mov dword [esp + 0x34], 7
mov dword [esp + 0x48], 0x489028
mov dword [esp + 0x50], eax
call sub.MSVCRT.dll_strchr
pop ecx
pop ecx
inc eax
push eax
call sub.MSVCRT.dll_strchr
neg eax
pop ecx
sbb eax, eax
neg eax
add eax, 0xfa
cmp dword [0x49b07c], 0
pop ecx
mov dword [esp + 0x48], eax
je 0x445b4c
test dword [edi + 8], 0x200
jne 0x445b4c
mov esi, 0x49f26c
push esi
call sub.MSVCRT.dll_strlen
push eax
push esi
push ebp
call sub.MSVCRT.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x445b4c
push 0x5c
push esi
call sub.MSVCRT.dll_strlen
add eax, 0xc
pop ecx
add eax, edi
push eax
call sub.MSVCRT.dll_strchr
pop ecx
pop ecx
test eax, eax
jne 0x445b4c
mov dword [esp + 0x48], 0xfa
lea eax, [esp + 0x28]
push eax
push 0
push 0x1007
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor esi, esi
mov ebp, eax
cmp dword [edi + 0x111c], esi
jle 0x445ba1
cmp byte [edi + esi + 0x1120], 2
jne 0x445b98
lea eax, [esp + 0x5c]
mov dword [esp + 0x64], esi
push eax
push ebp
push 0x102e
push dword [ebx]
mov dword [esp + 0x80], 0x48a38c
call dword [sym.imp.USER32.DLL_SendMessageA]
inc esi
cmp esi, dword [edi + 0x111c]
jl 0x445b6c
lea ebp, [edi + 0xc]
test byte [edi + 8], 4
jne 0x445d85
lea eax, [esp + 0x1d4]
push ebp
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [esp + 0x1dc]
push 0x489090
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x445d85
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0x3c], 0x489028
mov dword [esp + 0x44], 7
mov dword [esp + 0x48], 0xfc
test byte [esp + 0x94], 0x10
je 0x445d67
lea eax, [esp + 0xc0]
push 0x48a228
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x445d67
lea eax, [esp + 0xc0]
push 0x48a38c
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x445d67
mov eax, dword [0x49f0b4]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x1007
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor esi, esi
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [edi + 0x111c], esi
jle 0x445d67
movzx eax, byte [edi + esi + 0x1120]
dec eax
dec eax
je 0x445d30
sub eax, 3
je 0x445cdf
dec eax
je 0x445cd6
dec eax
je 0x445ccd
dec eax
jne 0x445d56
lea eax, [esp + 0xa0]
push eax
push esi
push ecx
push dword [ebx]
call fcn.004460d1
jmp 0x445d52
lea eax, [esp + 0xa8]
jmp 0x445cbe
lea eax, [esp + 0x98]
jmp 0x445cbe
push 0xb
lea eax, [esp + 0x20]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor ebp, ebp
mov eax, dword [esp + 0x94]
test dword [ebp*4 + 0x49b050], eax
je 0x445d17
lea eax, [esp + 0x1c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov cl, byte [ebp + 0x49b044]
mov byte [esp + eax + 0x1c], cl
inc ebp
cmp ebp, 9
jle 0x445cf2
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x14]
jmp 0x445d41
lea eax, [esp + 0xc0]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push ecx
push 0x102e
push dword [ebx]
mov dword [esp + 0x74], esi
call dword [sym.imp.USER32.DLL_SendMessageA]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, dword [edi + 0x111c]
jl 0x445c95
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x94]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x445c1e
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [edi + 8], 1
jne 0x4460ad
lea ebp, [edi + 0x110]
lea eax, [esp + 0x438]
push ebp
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [esp + 0x440]
push eax
call sub.MSVCRT.dll_strlen
push ebp
xor esi, esi
mov byte [esp + eax + 0x449], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp byte [esp + esi + 0x438], 0x3b
jne 0x445dd5
mov byte [esp + esi + 0x438], 0
push ebp
inc esi
call sub.MSVCRT.dll_strlen
pop ecx
cmp esi, eax
jbe 0x445dc3
push 0x4a1004
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esp + 0x438], 0
lea ebp, [esp + 0x438]
mov dword [esp + 0x18], ebp
je 0x4460a2
lea esi, [edi + 0xc]
lea eax, [esp + 0x1d4]
push esi
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [esp + 0x1dc]
push ebp
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x44608a
push 0x160
lea eax, [esp + 0x2dc]
mov dword [esp + 0x2c], 7
push 0
push eax
mov dword [esp + 0x38], 0xffff
mov dword [esp + 0x48], 0x489028
mov dword [esp + 0x50], 0xa
mov dword [esp + 0x54], 0xff
call sub.MSVCRT.dll_memset
mov ebp, dword [esp + 0x1c]
add esp, 0xc
test byte [esp + 0x94], 0x10
jne 0x446068
lea eax, [esp + 0x1d4]
push esi
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x1e0]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x1d8]
push eax
call fcn.0044b6fa
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x1007
push dword [ebx]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor ebp, ebp
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [edi + 0x111c], ebp
jle 0x446061
movzx eax, byte [edi + ebp + 0x1120]
dec eax
dec eax
je 0x446032
dec eax
je 0x445faf
dec eax
je 0x445fa3
dec eax
je 0x445f58
dec eax
je 0x445f42
dec eax
je 0x445f39
dec eax
jne 0x446054
lea eax, [esp + 0xa0]
jmp 0x445f49
lea eax, [esp + 0xa8]
jmp 0x445f49
lea eax, [esp + 0x98]
push eax
push ebp
push esi
push dword [ebx]
call fcn.004460d1
jmp 0x446054
push 0xb
lea eax, [esp + 0x20]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor esi, esi
mov eax, dword [esp + 0x94]
test dword [esi*4 + 0x49b050], eax
je 0x445f90
lea eax, [esp + 0x1c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov cl, byte [esi + 0x49b044]
mov byte [esp + eax + 0x1c], cl
inc esi
cmp esi, 9
jle 0x445f6b
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
jmp 0x446039
mov eax, dword [esp + 0x90]
jmp 0x446039
mov ecx, dword [esp + 0xb0]
test ecx, ecx
je 0x445fde
xor eax, eax
add eax, dword [esp + 0xb4]
adc ecx, 0
shrd eax, ecx, 0xa
shr ecx, 0xa
push ecx
push eax
lea eax, [esp + 0x1dc]
push eax
call fcn.004852c6
jmp 0x446015
mov ecx, dword [esp + 0xb4]
lea eax, [ecx - 1]
cmp eax, 0x3ffffffe
ja 0x445ffc
add ecx, 0x3ff
mov dword [esp + 0xb4], ecx
shr ecx, 0xa
lea eax, [esp + 0x1d4]
push ecx
push 0x48a390
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x1d4]
push 0x48a394
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [esp + 0x1d4]
jmp 0x446039
lea eax, [esp + 0xc0]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x5c]
push eax
push esi
push 0x102e
push dword [ebx]
mov dword [esp + 0x74], ebp
call dword [sym.imp.USER32.DLL_SendMessageA]
inc ebp
cmp ebp, dword [edi + 0x111c]
jl 0x445f02
mov ebp, dword [esp + 0x10]
lea esi, [edi + 0xc]
lea eax, [esp + 0x94]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x445e8d
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x18]
push ebp
call sub.MSVCRT.dll_strlen
inc ebp
add ebp, eax
pop ecx
mov dword [esp + 0x18], ebp
cmp byte [ebp], 0
jne 0x445e08
push 0x4a1004
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x11e8], 0
je 0x4460bc
push edi
call fcn.0044618e
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x152c
ret 8