Function at 0x432ba0
Capabilities:
Create directory
Delete file
Enumerate files on windows
Get volume information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0117
mov eax, dword fs:[0]
push eax
sub esp, 0x4f0
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4ac], esi
cmp byte [ebx + 0xa4], 5
je 0x432bf1
xor al, al
jmp 0x43359c
mov dword [ebp - 0x4dc], esi
mov dword [ebp - 0x4d8], esi
mov dword [ebp - 0x4d4], esi
mov dword [ebp - 0x4d0], esi
mov dword [ebp - 0x4cc], 0xffffffff
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x50]
mov byte [ebp - 0x499], 0
cmp dword [eax - 0xc], 0
jl 0x4335b8
movzx edx, word [eax]
lea ecx, [ebp - 0x4dc]
call fcn.00432060
test al, al
je 0x433561
push 0x60
lea eax, [ebp - 0x248]
push eax
push 0
push 0
push 0x90064
lea eax, [ebp - 0x4fc]
push eax
push 0
push 0
push 0
push dword [ebp - 0x4cc]
call dword [ebp - 0x4dc]
test eax, eax
jne 0x433561
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x4b4], eax
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x4335c2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x4c4], eax
mov byte [ebp - 4], 1
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x4335cc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x4a0], eax
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 2
call fcn.0044c4f3
mov byte [ebp - 4], 4
lea edi, [ebp - 0x1e8]
mov ecx, 0x74
mov eax, 0x300030
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push eax
push dword [ebp - 0x218]
mov word [ebp - 0x16], ax
push dword [ebp - 0x20c]
push dword [ebp - 0x210]
call fcn.00586b40
mov ecx, 1
cmp eax, ecx
cmovb eax, ecx
mov ecx, dword [ebx + 0x1d8]
mov edx, eax
sub edx, ecx
cmp eax, ecx
cmovbe edx, eax
lea eax, [ebx + 0xc]
push eax
mov dword [ebp - 0x4b0], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x432d62
push 0
push 0
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
nop dword [eax + eax]
mov edi, dword [ebp - 0x4a4]
mov eax, 0x57619f1
mul edi
mov ecx, edi
shr edx, 6
imul eax, edx, 0xbb8
sub ecx, eax
jne 0x432ea7
mov eax, dword [ebp - 0x4c0]
mov ecx, eax
inc eax
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebx + 0x50]
cmp dword [eax - 0xc], 0
jl 0x4335d6
movzx eax, word [eax]
push ecx
push str.CJEDEFS.
push eax
lea eax, [ebp - 0x4a0]
push str._c:_s_04X
push eax
call fcn.00402b00
mov ecx, dword [ebp - 0x4a0]
add esp, 0x14
mov edx, dword [ecx - 0xc]
push 1
push 1
call fcn.0041bb00
add esp, 8
push 0
push dword [ebp - 0x4a0]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x43304b
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x432e11
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x432e27
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4335e0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
or esi, 1
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a0]
push 1
push 0x5f4568
mov dword [ebp - 0x4ac], esi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.00416370
add esp, 0x14
lea eax, [ebp - 0x4a8]
lea ecx, [ebp - 0x4f4]
push eax
push dword [ebp - 0x4ec]
call fcn.0044c8e6
mov byte [ebp - 4], 4
and esi, 0xfffffffe
mov edx, dword [ebp - 0x4a8]
or eax, 0xffffffff
mov dword [ebp - 0x4ac], esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x432ea1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x4a4]
push edi
lea eax, [ebp - 0x1e8]
push eax
push dword [ebp - 0x4a0]
lea eax, [ebp - 0x4c4]
push str._s_s_08X
push eax
call fcn.00402b00
mov eax, dword [ebp - 0x4c4]
add esp, 0x14
push 0
push 0
push 1
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43304b
inc dword [ebp - 0x4a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4a4]
mov eax, 0xcccccccd
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mul ecx
shr edx, 4
lea eax, [edx + edx*4]
shl eax, 2
sub ecx, eax
je 0x432f2a
push 0
push dword [ebx + 0x38]
call edi
test eax, eax
jne 0x433023
push 0x60
lea eax, [ebp - 0x248]
push eax
push 0
push 0
push 0x90064
lea eax, [ebp - 0x4fc]
push eax
push 0
push 0
push 0
push dword [ebp - 0x4cc]
call dword [ebp - 0x4dc]
push 0
push dword [ebx + 0x38]
mov dword [ebp - 0x4bc], eax
call edi
test eax, eax
je 0x433057
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, dword [ebx + 0x1f4]
cmp ecx, eax
jbe 0x432fb2
mov edi, dword [ebp - 0x4a4]
sub ecx, eax
imul eax, edi, 0x3e8
xor edx, edx
div ecx
mov ecx, eax
test ecx, ecx
je 0x432fa8
mov eax, dword [ebp - 0x4b0]
xor edx, edx
sub eax, edi
div ecx
mov dword [ebx + 0x1b4], eax
jmp 0x432fb2
mov dword [ebx + 0x1b4], 0
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
imul eax, dword [ebp - 0x4a4], 0x64
xor edx, edx
mov ecx, 0x64
div dword [ebp - 0x4b0]
cmp eax, 0x64
cmova eax, ecx
lea ecx, [ebx + 4]
mov byte [ebx + 0x1bc], al
mov eax, dword [ebx + 4]
call dword [eax + 0x14]
mov ecx, ebx
call fcn.00403d40
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x433011
push 0
push 1
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
cmp dword [ebp - 0x4bc], 0
jne 0x433057
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x20c], eax
jl 0x432d70
jg 0x433075
mov eax, dword [ebp - 0x4b8]
cmp dword [ebp - 0x210], eax
jbe 0x432d70
jmp 0x433075
mov edx, 0xd9
mov ecx, ebx
call fcn.00417ab0
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x20c], eax
jl 0x4330c5
jg 0x433075
mov eax, dword [ebp - 0x4b8]
cmp dword [ebp - 0x210], eax
jbe 0x4330c5
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [ebx + 0xc]
push esi
mov byte [ebp - 0x499], 1
call edi
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
mov byte [ebx + 0x1bc], 0x64
call dword [eax + 0x14]
mov ecx, ebx
call fcn.00403d40
push 1
push 4
lea eax, [ebp - 0x4a4]
push eax
call fcn.0044c4b5
test eax, eax
je 0x4330ce
mov edx, 4
lea ecx, [ebp - 0x4a4]
call fcn.004343b0
jmp 0x4330ce
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [ebx + 0xc]
push 0
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x433125
push esi
call edi
push 0xe
lea ecx, [ebx + 0x1c0]
push 0x5f7204
call fcn.00402d30
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
lea eax, [ebx + 0xc]
push eax
call edi
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x43311c
push 0
push 0
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
xor ecx, ecx
mov dword [ebp - 0x4b0], ecx
mov dword [ebp - 0x4bc], ecx
cmp ecx, dword [ebp - 0x4c0]
jae 0x433416
test ecx, ecx
js 0x4335fe
cmp ecx, dword [ebp - 0x4ec]
jge 0x4335fe
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x4a0]
lea edx, [ecx - 0x10]
lea esi, [eax - 0x10]
cmp edx, esi
je 0x4331c4
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4331af
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4331af
push edx
call fcn.00405670
add esp, 4
mov dword [ebp - 0x4a8], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4331a4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4a8]
add eax, 0x10
mov dword [ebp - 0x4a0], eax
jmp 0x4331c4
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x4a0]
call fcn.00402d30
mov eax, dword [ebp - 0x4a0]
mov byte [ebp - 4], 6
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4331da
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4331f0
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4335ea
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp - 0x4ac]
add eax, 0x10
mov dword [ebp - 0x4b8], eax
or edi, 2
mov eax, dword [ebp - 0x4a0]
push 1
push 0x5f5268
mov dword [ebp - 0x4ac], edi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x4b8]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x4b8]
lea eax, [ebp - 0x498]
add esp, 0x14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and edi, 0xfffffffd
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4ac], edi
add esi, 0xfffffff0
mov byte [ebp - 4], 4
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x43326c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4a8]
cmp eax, 0xffffffff
je 0x4333dc
nop dword [eax + eax]
test byte [ebp - 0x498], 0x10
jne 0x4333b9
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4332a9
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4332bf
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4335f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x46c]
or edi, 4
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4ac], edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4332e0
mov eax, dword [ebp - 0x4a0]
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x46c]
push ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x4b4]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, 0xfffffffb
mov byte [ebp - 4], 4
mov dword [ebp - 0x4ac], edi
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x433342
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4333b3
lea edi, [ebx + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x4b0]
lea ecx, [ebx + 4]
inc eax
xor edx, edx
mov dword [ebp - 0x4b0], eax
imul eax, eax, 0x64
div dword [ebp - 0x4a4]
mov byte [ebx + 0x1bc], al
mov eax, dword [ebx + 4]
call dword [eax + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x4333a4
push 0
push 1
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
mov edi, dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x4a8]
lea ecx, [ebp - 0x498]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x4a8]
jne 0x433280
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x4a0]
push 1
push 1
mov edx, dword [ecx - 0xc]
call fcn.0041bb00
add esp, 8
test eax, eax
jns 0x43340a
lea eax, [ebp - 0x4a0]
lea ecx, [ebx + 0x18c]
push eax
push dword [ecx + 8]
call fcn.0044c8e6
mov ecx, dword [ebp - 0x4bc]
inc ecx
jmp 0x43312d
push 0
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x433503
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebx + 0xc]
push eax
call edi
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
mov byte [ebx + 0x1bc], 0x64
call dword [eax + 0x14]
lea eax, [ebx + 0xc]
push eax
call edi
mov eax, dword [ebx + 0x168]
test eax, eax
je 0x433466
push 0
push 1
push dword [ebx + 0x16c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
call dword [eax + 0x14]
jmp 0x433503
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 4], 3
or esi, 0xffffffff
call fcn.0044c50a
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x4a0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x433539
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x4c4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x433558
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x499], 0
jne 0x433573
push dword [ebx + 0x50]
mov edx, 0xd1
mov ecx, ebx
call fcn.004237f0
add esp, 4
mov eax, dword [ebp - 0x4d0]
test eax, eax
je 0x433584
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x4cc]
cmp eax, 0xffffffff
je 0x433596
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x499]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
call fcn.004498c5
int3