Function at 0x4195f9
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9ac
mov dword [ebp - 0x9a0], edx
mov dword [ebp - 0x99c], ecx
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4199b8
test ecx, ecx
je 0x4199b8
mov ebx, eax
test esi, esi
je 0x419645
mov dword [esp + 4], 0x5c9f7a
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x419643
cmp byte [esi], 0
jne 0x419645
xor esi, esi
lea edx, [ebp - 0x978]
mov ecx, 8
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x5c9f7c
mov dword [esp], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x419703
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
call edi
push ebx
push ebx
mov esi, eax
lea eax, [eax + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebx, eax
mov byte [eax], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
push esi
push esi
mov dword [esp], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov esi, eax
mov dword [ebp - 0x974], 1
mov dword [ebp - 0x970], 1
mov edi, ebx
test esi, esi
je 0x4196f6
lea eax, [ebp - 0x978]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5c9f7e
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x99c]
call eax
lea edi, [edi + esi + 1]
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov esi, eax
jmp 0x4196be
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x4199b4
mov dword [esp], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dl, byte [ebx + eax - 1]
cmp dl, 0x2f
lea eax, [ebp - 0x818]
je 0x41971f
cmp dl, 0x5c
jne 0x419735
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5c9f7f
mov dword [esp], eax
call fcn.005ae188
jmp 0x419751
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5c9f83
mov dword [esp], eax
call fcn.005ae188
lea eax, [ebp - 0x958]
mov dword [esp + 4], eax
lea edi, [ebp - 0x818]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edx
push edx
mov ebx, eax
mov eax, 0xfffffffd
cmp ebx, 0xffffffff
je 0x4199bb
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov byte [ebp + eax - 0x819], 0
lea edx, [ebp - 0x978]
mov ecx, 8
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x5ca034
lea edi, [ebp - 0x92c]
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x419958
mov dword [esp + 4], 0x5c9f89
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x419958
mov eax, dword [ebp - 0x958]
shr eax, 4
and eax, 1
mov dword [ebp - 0x974], eax
cmp dword [ebp - 0x9a0], 0
jne 0x4197f7
test eax, eax
je 0x4197ff
jmp 0x419958
test eax, eax
je 0x419958
test esi, esi
je 0x419850
mov dword [esp + 4], 0x2e
lea eax, [ebp - 0x92c]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strrchr
test eax, eax
je 0x419958
inc eax
mov dword [esp + 4], eax
lea edi, [ebp - 0x996]
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll__strlwr
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
test eax, eax
je 0x419958
mov eax, dword [ebp - 0x958]
mov edx, eax
shr edx, 1
and edx, 1
mov dword [ebp - 0x978], edx
shr eax, 2
and eax, 1
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x93c]
mov ecx, dword [ebp - 0x938]
mov dword [ebp - 0x968], ecx
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x944]
mov edx, dword [ebp - 0x940]
add eax, 0x2ac18000
adc edx, 0xfe624e21
mov dword [esp + 8], 0x989680
xor edi, edi
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005a8158
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], edx
lea eax, [ebp - 0x818]
mov dword [esp + 4], eax
lea edi, [ebp - 0x418]
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea edx, [ebp - 0x92c]
mov dword [esp + 4], edx
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [ebp - 0x978]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
lea edx, [ebp - 0x92c]
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x99c]
call eax
test eax, eax
je 0x419958
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ecx
test eax, eax
jne 0x4199b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5af030], 0
je 0x4199b4
mov dword [0x611418], 1
xor edx, edx
mov dword [0x611414], edx
mov dword [esp + 4], eax
mov dword [esp], str._core__FindClose___in_gf_enum_directory___returned_1__the_following_error_code:__d_n
jmp 0x4199af
lea eax, [ebp - 0x958]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edi
push edi
test eax, eax
jne 0x41978c
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ecx
test eax, eax
jne 0x4199b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5af030], 0
je 0x4199b4
mov dword [0x611418], 1
xor edx, edx
mov dword [0x611414], edx
mov dword [esp + 4], eax
mov dword [esp], str._core__FindClose___in_gf_enum_directory___returned_2__the_following_error_code:__d_n
call fcn.004268ea
xor eax, eax
jmp 0x4199bb
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret