Function at 0x4179a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46f7f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x298
push ebp
push esi
push edi
mov edi, ecx
call fcn.00468777
mov ecx, dword [eax + 4]
call fcn.00457f84
lea esi, [edi + 0x1f74]
xor ebp, ebp
push esi
mov ecx, edi
mov dword [esp + 0x2b0], ebp
call fcn.00418580
mov eax, dword [0x4ad780]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2ac], 1
push ecx
push str.UDISK_IMG
lea ecx, [edi + 0x93c]
call fcn.0042fd60
cmp eax, 0xffffffff
je 0x417de9
cmp dword [esp + 0x2c], ebp
je 0x417de9
lea edx, [esp + 0xc]
push eax
push edx
lea ecx, [edi + 0x8cc]
call fcn.00412690
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b0], 2
call fcn.0045861d
lea ecx, [esp + 0xc]
mov byte [esp + 0x2ac], 1
call fcn.004584d6
mov eax, dword [esp + 0x14]
cmp dword [eax - 8], ebp
je 0x417de9
push 0x475c28
push eax
call fcn.0043f8ef
add esp, 8
cmp eax, ebp
je 0x417de9
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.00458243
push 0x5c
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 3
call fcn.004512ef
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00451277
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 4
call fcn.0045861d
lea ecx, [esp + 0x10]
mov byte [esp + 0x2b0], 3
call fcn.004584d6
lea edx, [esp + 0x14]
push str.udisk_img_.bin
lea eax, [esp + 0x30]
push edx
push eax
call fcn.0045877b
mov edx, dword [esp + 0x2c]
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x5c]
mov dword [esp + 0x58], ebp
mov byte [esp + 0x2b0], 5
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov edi, 1
cmp ebx, 0xffffffff
mov dword [esp + 0x38], ebx
je 0x417dc6
cmp edi, ebp
je 0x417dbf
lea eax, [esp + 0x84]
lea ecx, [esp + 0x3c]
push eax
call fcn.0045854a
mov ecx, dword [eax]
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x2b4], 6
mov edi, dword [ecx - 8]
lea ecx, [esp + 0x44]
call fcn.0045854a
add edi, 0xfffffffc
lea ecx, [esp + 0x24]
push edi
push ecx
mov ecx, eax
mov byte [esp + 0x2b8], 7
call fcn.00451277
lea ecx, [esp + 0x40]
mov byte [esp + 0x2b0], 0xa
call fcn.004584d6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2b0], 9
call fcn.004584d6
mov edx, dword [esp + 0x24]
cmp dword [edx - 8], 0xd
jne 0x417d9b
lea eax, [esp + 0x10]
push 3
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], ebp
call fcn.004511fb
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 0x4ab880
push edx
call fcn.0043f6f3
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x4ad780]
shl eax, 0xa
add esp, 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x84]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x4a958c
push ecx
mov byte [esp + 0x2c0], 0xc
call fcn.00451685
push 0x21c
call fcn.00458a48
mov edx, eax
add esp, 0x14
cmp edx, ebp
je 0x417c26
mov ecx, 0x87
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, edx
mov dword [esp + 0x28], edi
jmp 0x417c2c
mov dword [esp + 0x28], ebp
mov edi, ebp
mov edx, dword [esp + 0x1c]
lea eax, [edi + 8]
push edx
push eax
call fcn.0043f59c
mov ecx, dword [esp + 0x24]
add esp, 8
push 0x8020
push ecx
lea ecx, [esp + 0x4c]
call fcn.00458ef8
lea ecx, [esp + 0x44]
mov byte [esp + 0x2b0], 0xd
call fcn.0045934f
cmp eax, ebp
mov dword [edi], eax
je 0x417c80
push eax
call fcn.00458a48
mov edx, dword [edi]
add esp, 4
lea ecx, [esp + 0x44]
mov dword [edi + 4], eax
push edx
push eax
call fcn.00459172
lea ecx, [esp + 0x44]
call fcn.00459270
mov edi, dword [esp + 0x20]
mov ebx, dword [esi + 8]
mov eax, edi
xor edx, edx
shr eax, 4
div ebx
mov ecx, dword [esi + 4]
mov dword [esp + 0x34], edi
test ecx, ecx
mov ebp, edx
mov dword [esp + 0x54], ebp
je 0x417cca
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x417cc6
cmp dword [eax + 8], edi
je 0x417cbe
mov eax, dword [eax]
test eax, eax
jne 0x417cb1
jmp 0x417cc6
test eax, eax
jne 0x417d5b
test ecx, ecx
jne 0x417cf6
lea edi, [ebx*4]
push edi
call fcn.00458a48
mov edx, eax
mov ecx, edi
mov dword [esi + 4], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x417d2c
mov eax, dword [esi + 0x18]
push 0x10
lea ecx, [esi + 0x14]
push eax
push ecx
call fcn.00453450
mov ecx, dword [esi + 0x18]
mov edx, ecx
shl edx, 4
dec ecx
test ecx, ecx
lea eax, [edx + eax - 0xc]
jl 0x417d2c
inc ecx
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
sub eax, 0x10
dec ecx
jne 0x417d1e
mov eax, dword [esi + 0x10]
mov edx, dword [esp + 0x34]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0xc]
inc ecx
mov dword [esi + 0xc], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov ecx, dword [esi + 4]
mov edx, dword [ecx + ebp*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov dword [ecx + ebp*4], eax
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x44]
mov dword [eax + 0xc], edx
mov byte [esp + 0x2b0], 0xc
call fcn.00458f98
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2b0], 0xb
call fcn.004584d6
lea ecx, [esp + 0x10]
mov byte [esp + 0x2b0], 9
call fcn.004584d6
mov ebx, dword [esp + 0x38]
xor ebp, ebp
lea eax, [esp + 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x24]
mov edi, eax
mov byte [esp + 0x2b0], 5
call fcn.004584d6
jmp 0x417b1d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2b0], 3
call fcn.004584d6
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b0], 1
call fcn.004584d6
pop ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x2ac], 0
call fcn.004584d6
mov dword [esp + 0x2ac], 0xffffffff
call fcn.00468777
mov ecx, dword [eax + 4]
call fcn.00457f99
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x2a4
ret