Function at 0x41ab42
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push 0x37c
mov eax, 0x432cc9
call fcn.004318dd
mov dword [ebp - 0x374], ecx
lea esi, [ebp + 8]
xor ebx, ebx
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x368], ebx
and dword [ebp - 4], ebx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x368], esp
push 0x405138
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push 0x405180
call fcn.0041314d
push 0x15
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.00412723
mov byte [ebp - 4], 2
cmp dword [ebp + 0x2c], 8
mov eax, dword [ebp + 0x18]
jae 0x41abb1
lea eax, [ebp + 0x18]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
sub esp, 0x18
mov ecx, esp
push 0x4051d0
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
mov eax, dword [ebp - 0x374]
lea edx, [ebp - 0x364]
add esp, 0x4c
lea esi, [ebp - 0x20]
mov eax, dword [eax + 8]
push edx
sub esp, 0x10
mov edi, esp
mov ecx, dword [eax]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ecx + 0xa8]
mov ecx, esi
call dword [0x43b26c]
call esi
cmp eax, 0x80042308
je 0x41b33d
lea eax, [ebp - 0x364]
mov dword [ebp - 0x388], eax
mov byte [ebp - 4], 3
test byte [ebp - 0x318], 4
je 0x41ac64
sub esp, 0x18
mov ecx, esp
push 0x4052f0
jmp 0x41b347
cmp dword [ebp - 0x330], 0
jne 0x41b320
cmp dword [ebp - 0x32c], 0
jne 0x41b320
mov esi, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x18]
cmp esi, 2
jne 0x41ad52
mov edx, eax
cmp ecx, 8
jae 0x41ac9a
lea edx, [ebp + 0x18]
cmp word [edx + 2], 0x3a
jne 0x41ad52
cmp ecx, 8
jae 0x41acad
lea eax, [ebp + 0x18]
push eax
sub esp, 0x18
mov ecx, esp
push 0x405420
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
mov dword [ebp - 0x24], 7
xor ebx, ebx
lea ecx, [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x38], ax
push ebx
push 0x104
call fcn.0041a80f
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x7c]
call fcn.004137cd
cmp dword [ebp + 0x2c], 8
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x18]
jae 0x41ad08
lea eax, [ebp + 0x18]
push dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [ebp - 0x7c]
mov esi, eax
call fcn.004136db
test esi, esi
je 0x41ad4a
lea ecx, [ebp + 0x18]
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x405480
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
jmp 0x41b358
lea ecx, [ebp - 0x38]
jmp 0x41b152
mov edx, eax
cmp ecx, 8
jae 0x41ad5c
lea edx, [ebp + 0x18]
push 0x5c
pop edi
cmp word [edx + esi*2 - 2], di
je 0x41ad77
push edi
push 1
lea ecx, [ebp + 0x18]
call fcn.00413a8b
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x18]
cmp ecx, 8
jae 0x41ad7f
lea eax, [ebp + 0x18]
push eax
sub esp, 0x18
mov ecx, esp
push 0x405518
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
mov eax, dword [ebp + 0x18]
add esp, 0x20
cmp dword [ebp + 0x2c], 8
jae 0x41ada7
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41b30b
test al, 0x10
je 0x41b30b
push ecx
lea edx, [ebp + 0x18]
lea ecx, [ebp - 0x84]
call fcn.0041b6b5
mov byte [ebp - 4], 5
cmp dword [ebp - 0x70], 8
mov eax, dword [ebp - 0x84]
jae 0x41ade4
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0x304]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x37c], esi
cmp esi, 0xffffffff
jne 0x41af21
push 0x405608
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x368], esp
push 0x404ef0
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x384], esp
push 0x405138
call fcn.0041314d
push 0x5a
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
push 0x405180
call fcn.0041314d
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 5
push eax
call fcn.004125b8
add esp, 0x54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jg 0x41ae6b
mov esi, edi
jmp 0x41ae74
movzx esi, di
or esi, 0x80070000
test edi, edi
je 0x41af1b
push 0x405608
sub esp, 0x18
mov ecx, esp
push 0x4050c8
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
push edi
sub esp, 0x18
mov ecx, esp
push 0x405104
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x38]
mov edx, esi
call fcn.00412874
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.00413b89
sub esp, 0x18
mov ecx, esp
push 0x403bd8
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x1c
mov dword [ebp - 0x374], esi
jmp 0x41b362
mov esi, dword [ebp - 0x37c]
mov dword [ebp - 0x378], esi
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x38]
call fcn.0041314d
push 0x40562c
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0xa
call fcn.0041314d
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x38]
or ebx, 1
push eax
mov dword [ebp - 0x368], ebx
call fcn.0041b713
test eax, eax
je 0x41af8f
push 0x405630
lea ecx, [ebp - 0xb4]
call fcn.0041314d
push eax
lea ecx, [ebp - 0x38]
or ebx, 2
call fcn.0041b713
mov byte [ebp - 0x36d], 1
test eax, eax
jne 0x41af96
mov byte [ebp - 0x36d], 0
test bl, 2
je 0x41afad
push 0
push 1
lea ecx, [ebp - 0xb4]
and ebx, 0xfffffffd
call fcn.00413b40
push 0
push 1
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], 0xa
and ebx, 0xfffffffe
call fcn.00413b40
cmp byte [ebp - 0x36d], 0
jne 0x41b2d8
lea eax, [ebp - 0x304]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41b073
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x41b138
push 0x4056c0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x384], esp
push 0x404ef0
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x368], esp
push 0x405138
call fcn.0041314d
push 0x6e
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
push 0x405180
call fcn.0041314d
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
push eax
call fcn.004125b8
add esp, 0x54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jg 0x41b060
mov esi, edi
jmp 0x41b069
movzx esi, di
or esi, 0x80070000
test edi, edi
jne 0x41b088
mov esi, dword [ebp - 0x37c]
push 0
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call fcn.00413b40
jmp 0x41af2b
push 0x4056c0
sub esp, 0x18
mov ecx, esp
push 0x4050c8
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
push edi
sub esp, 0x18
mov ecx, esp
push 0x405104
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x9c]
mov edx, esi
call fcn.00412874
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9c]
call fcn.00413b89
sub esp, 0x18
mov ecx, esp
push 0x403bd8
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x1c
mov dword [ebp - 0x368], esi
push 0x4394e4
lea eax, [ebp - 0x368]
jmp 0x41b36d
xor ebx, ebx
lea ecx, [ebp - 0x38]
push ebx
push 1
call fcn.00413b40
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x84]
push ebx
push 1
mov byte [ebp - 4], 3
call fcn.00413b40
push 0x4056e0
sub esp, 0x18
mov dword [ebp - 0x380], ebx
mov ecx, esp
mov dword [ebp - 0x36c], esp
push 0x403d04
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x378], esp
push 0x405138
call fcn.0041314d
push 0x76
sub esp, 0x18
mov byte [ebp - 4], 0x10
mov ecx, esp
push 0x405180
call fcn.0041314d
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 3
push eax
call fcn.004125b8
mov eax, dword [ebp - 0x374]
add esp, 0x54
cmp dword [ebp + 0x2c], 8
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax + 8]
jae 0x41b1d1
lea ecx, [ebp + 0x18]
mov eax, dword [edx]
lea esi, [ebp - 0x380]
push esi
push ecx
push 0x100000
push ebx
sub esp, 0x10
lea esi, [ebp - 0x20]
mov edi, esp
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0xc0]
mov ecx, esi
call dword [0x43b26c]
call esi
mov esi, eax
test esi, esi
jns 0x41b27d
push 0x4056e0
sub esp, 0x18
mov ecx, esp
push 0x403ccc
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
push esi
sub esp, 0x18
mov ecx, esp
push 0x403c90
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x9c]
mov edx, esi
call fcn.00412874
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 3
jmp 0x41b0fc
mov esi, dword [ebp - 0x380]
mov dword [ebp - 0x36c], esi
push esi
sub esp, 0x18
mov byte [ebp - 4], 0x12
mov ecx, esp
push 0x4057d4
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.VSSAPI.DLL_VssFreeSnapshotPropertiesInternal]
lea ecx, [ebp - 0x6c]
call fcn.004127db
push ebx
push 1
lea ecx, [ebp + 0x18]
call fcn.00413b40
call fcn.0043188c
ret 0x28
lea ecx, [ebp + 0x18]
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x405638
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x20
mov dword [ebp - 0x368], 0x80070057
jmp 0x41b128
lea ecx, [ebp + 0x18]
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x405580
jmp 0x41b2eb
sub esp, 0x18
mov ecx, esp
push 0x4053a0
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x1c
jmp 0x41b2fc
sub esp, 0x18
mov ecx, esp
push 0x405290
call fcn.0041314d
lea eax, [ebp - 0x6c]
push eax
call fcn.004124a5
add esp, 0x1c
mov dword [ebp - 0x374], 0x80070057
push 0x4394e4
lea eax, [ebp - 0x374]
push eax
call sub.msvcrt.dll__CxxThrowException
int3