Function at 0x42bef0
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46303e
mov eax, dword fs:[0]
push eax
mov eax, 0x2f80
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2f78], edx
mov ebx, ecx
mov dword [ebp - 0x2f84], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2f7c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2f88], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x2818], 7
mov dword [ebp - 0x281c], 0
mov word [ebp - 0x282c], ax
mov dword [ebp - 0x2830], 7
mov dword [ebp - 0x2834], eax
mov word [ebp - 0x2844], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0x2f64], eax
xor al, al
mov byte [ebp - 0x2f66], al
mov eax, dword [0x49460c]
test eax, eax
je 0x42bfa1
lea ecx, [ebp - 0x2f64]
push ecx
call eax
push 0x500
lea eax, [ebp - 0x2814]
push eax
push str._SystemRoot_Inf_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push ebx
lea eax, [ebp - 0x2814]
push 0x500
push eax
call fcn.00451274
add esp, 0xc
lea eax, [ebp - 0x2868]
push eax
push 0
lea eax, [ebp - 0x2814]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x42c36a
mov eax, dword [ebp - 0x2848]
mov dword [ebp - 0x2f80], eax
test eax, eax
je 0x42c36a
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.DLL_FindClose]
xor edi, edi
mov dword [ebp - 0x2f74], edi
push 0x500
lea eax, [ebp - 0x1414]
push eax
push str._SystemRoot_System32DriverStoreFileRepository
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
cmp edi, 3
ja case.default.0x42c033
jmp dword [edi*4 + 0x42c9d8]
push dword [ebp - 0x2f84]
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s_
push eax
call fcn.00409980
add esp, 0x10
jmp 0x42c10c
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s
push eax
call fcn.00409980
add esp, 0xc
jmp 0x42c0d1
cmp dword [ebp - 0x2818], 8
lea eax, [ebp - 0x282c]
cmovae eax, dword [ebp - 0x282c]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s_
push eax
call fcn.00409980
add esp, 0x10
jmp 0x42c0e5
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s
push eax
call fcn.00409980
add esp, 0xc
jmp 0x42c102
cmp edi, 1
jne 0x42c0e0
cmp dword [ebp - 0x281c], 0
jne 0x42c35a
jmp 0x42c10c
cmp edi, 2
jne 0x42c0fd
cmp byte [ebp + 0x41], 0
je 0x42c35a
cmp dword [ebp - 0x281c], 0
jne 0x42c10c
jmp 0x42c35a
cmp edi, 3
jne 0x42c10c
cmp byte [ebp + 0x42], 0
je 0x42c35a
lea eax, [ebp - 0x2d0c]
push eax
lea eax, [ebp - 0xa14]
push eax
call esi
mov dword [ebp - 0x2f6c], eax
cmp eax, 0xffffffff
je 0x42c35a
mov edi, eax
lea ecx, [ecx]
test byte [ebp - 0x2d0c], 0x10
je 0x42c330
cmp word [ebp - 0x2ce0], 0x2e
jne 0x42c16b
mov ax, word [ebp - 0x2cde]
test ax, ax
je 0x42c330
cmp ax, 0x2e
jne 0x42c16b
cmp word [ebp - 0x2cdc], 0
je 0x42c330
lea eax, [ebp - 0x2ce0]
push 0x104
push eax
call fcn.00451b0d
mov eax, dword [ebp + 0x60]
add esp, 8
cmp eax, dword [ebp + 0x64]
je 0x42c221
jmp 0x42c190
cmp word [ebp - 0x2ce0], 0
jne 0x42c19e
xor edx, edx
jmp 0x42c1b6
lea edx, [ebp - 0x2ce0]
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x42c1a7
sub edx, esi
sar edx, 1
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x42c1c3
mov esi, dword [eax]
jmp 0x42c1c5
mov esi, eax
cmp edi, edx
mov ebx, edx
cmovb ebx, edi
test ebx, ebx
je 0x42c1f8
lea edi, [ebp - 0x2ce0]
jmp 0x42c1e0
mov cx, word [esi]
cmp cx, word [edi]
jne 0x42c2e0
add esi, 2
add edi, 2
dec ebx
jne 0x42c1e0
mov edi, dword [eax + 0x10]
xor ecx, ecx
test ecx, ecx
jne 0x42c20f
cmp edi, edx
jb 0x42c20f
cmp edi, edx
setne cl
test ecx, ecx
je 0x42c2f4
add eax, 0x18
cmp eax, dword [ebp + 0x64]
jne 0x42c190
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x2ce0]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s.inf
push eax
call fcn.00409980
add esp, 0x10
lea eax, [ebp - 0x2abc]
push eax
lea eax, [ebp - 0xa14]
push eax
call esi
mov ebx, eax
mov dword [ebp - 0x2f8c], ebx
cmp ebx, 0xffffffff
je 0x42c9cd
lea eax, [ebp - 0x2a90]
push 0x104
push eax
call fcn.00451b0d
lea eax, [ebp - 0x2a90]
push eax
lea eax, [ebp - 0x2ce0]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0x1e14]
push 0x47c9e8
push eax
call fcn.00409980
mov cx, word [ebp - 0x2a90]
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x2f70], eax
cmp byte [ebp + 0x44], al
je 0x42c4ac
mov eax, dword [ebp + 0x48]
cmp eax, dword [ebp + 0x4c]
je 0x42c4ac
lea esi, [eax + 0x10]
mov dword [ebp - 0x2f60], esi
jmp 0x42c2d0
test cx, cx
jne 0x42c3ff
xor ecx, ecx
jmp 0x42c41f
movzx ecx, word [esi]
cmp cx, word [edi]
mov edi, dword [eax + 0x10]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x42c1fa
cmp dword [eax + 0x14], 8
jb 0x42c2fc
mov eax, dword [eax]
push eax
push str.___________Excluded_due_to_folder_name_match___s_
push 0x494648
call fcn.00409980
add esp, 0xc
mov edx, 4
mov ecx, 0x494648
call fcn.0040da30
mov ebx, dword [sym.imp.KERNEL32.DLL_FindClose]
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov edi, dword [ebp - 0x2f6c]
lea eax, [ebp - 0x2d0c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x42c130
mov edi, dword [ebp - 0x2f74]
push dword [ebp - 0x2f6c]
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
inc edi
mov dword [ebp - 0x2f74], edi
cmp edi, 4
jl 0x42c013
mov eax, dword [0x494608]
test eax, eax
je 0x42c37b
push dword [ebp - 0x2f64]
call eax
cmp dword [ebp - 0x2830], 8
jb 0x42c392
push dword [ebp - 0x2844]
call fcn.00450920
add esp, 4
xor eax, eax
cmp dword [ebp - 0x2818], 8
mov word [ebp - 0x2844], ax
mov dword [ebp - 0x2834], eax
mov dword [ebp - 0x2830], 7
jb 0x42c3c2
push dword [ebp - 0x282c]
call fcn.00450920
add esp, 4
xor eax, eax
lea ecx, [ebp + 0x10]
mov word [ebp - 0x282c], ax
mov dword [ebp - 0x281c], eax
mov dword [ebp - 0x2818], 7
call fcn.0040cb40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2a90]
lea edx, [ecx + 2]
jmp 0x42c410
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c410
sub ecx, edx
sar ecx, 1
cmp dword [esi + 4], 8
mov ebx, dword [esi]
jb 0x42c42c
mov edx, dword [esi - 0x10]
jmp 0x42c42f
lea edx, [esi - 0x10]
cmp ebx, ecx
mov edi, ecx
cmovb edi, ebx
test edi, edi
je 0x42c457
lea esi, [ebp - 0x2a90]
mov ax, word [edx]
cmp ax, word [esi]
jne 0x42c487
add edx, 2
add esi, 2
dec edi
jne 0x42c440
mov esi, dword [ebp - 0x2f60]
xor eax, eax
test eax, eax
jne 0x42c46a
cmp ebx, ecx
jb 0x42c46a
cmp ebx, ecx
setne al
test eax, eax
je 0x42c49b
mov cx, word [ebp - 0x2a90]
add esi, 0x18
mov dword [ebp - 0x2f60], esi
lea eax, [esi - 0x10]
cmp eax, dword [ebp + 0x4c]
je 0x42c4ac
jmp 0x42c2d0
movzx eax, word [edx]
cmp ax, word [esi]
mov esi, dword [ebp - 0x2f60]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x42c459
mov cx, word [ebp - 0x2a90]
mov dword [ebp - 0x2f70], 1
mov eax, dword [ebp + 0x60]
cmp eax, dword [ebp + 0x64]
je 0x42c56b
lea esi, [eax + 0x10]
mov dword [ebp - 0x2f60], esi
test cx, cx
jne 0x42c4ca
xor eax, eax
jmp 0x42c4e2
lea eax, [ebp - 0x2a90]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42c4d3
sub eax, edx
sar eax, 1
cmp dword [esi + 4], 8
mov ebx, dword [esi]
jb 0x42c4ef
mov edx, dword [esi - 0x10]
jmp 0x42c4f2
lea edx, [esi - 0x10]
cmp ebx, eax
mov edi, eax
cmovb edi, ebx
test edi, edi
je 0x42c51a
lea esi, [ebp - 0x2a90]
mov cx, word [edx]
cmp cx, word [esi]
jne 0x42c54a
add edx, 2
add esi, 2
dec edi
jne 0x42c503
mov esi, dword [ebp - 0x2f60]
xor ecx, ecx
test ecx, ecx
jne 0x42c52d
cmp ebx, eax
jb 0x42c52d
cmp ebx, eax
setne cl
test ecx, ecx
je 0x42c55e
add esi, 0x18
mov dword [ebp - 0x2f60], esi
lea eax, [esi - 0x10]
cmp eax, dword [ebp + 0x64]
je 0x42c56b
mov cx, word [ebp - 0x2a90]
jmp 0x42c4c1
movzx ecx, word [edx]
cmp cx, word [esi]
mov esi, dword [ebp - 0x2f60]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x42c51c
mov esi, 2
mov dword [ebp - 0x2f70], esi
jmp 0x42c571
mov esi, dword [ebp - 0x2f70]
mov edi, dword [ebp - 0x2f74]
cmp edi, 2
jge 0x42c776
lea eax, [ebp - 0x2868]
push eax
push 0
lea eax, [ebp - 0x1e14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x42c98c
mov eax, dword [ebp - 0x2f80]
cmp eax, dword [ebp - 0x2848]
jne 0x42c98c
push 0
push 0
lea edx, [ebp - 0x1e14]
lea ecx, [ebp - 0x2814]
call fcn.0040e450
add esp, 8
test al, al
je 0x42c98c
xor bl, bl
cmp word [ebp - 0x2a90], 0
mov byte [ebp - 0x2f66], 1
jne 0x42c5e7
xor ecx, ecx
jmp 0x42c5ff
lea ecx, [ebp - 0x2a90]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c5f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x2a90]
push eax
lea ecx, [ebp - 0x282c]
call fcn.004023a0
lea eax, [ebp - 0x2ce0]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push 0x46c04c
push eax
call fcn.00409980
add esp, 0x10
cmp word [ebp - 0xa14], 0
jne 0x42c642
xor ecx, ecx
jmp 0x42c65f
lea ecx, [ebp - 0xa14]
lea edx, [ecx + 2]
jmp 0x42c650
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c650
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa14]
push eax
lea ecx, [ebp - 0x2844]
call fcn.004023a0
cmp byte [ebp + 0x43], 0
jne 0x42c6d4
test esi, esi
jne 0x42c6d4
sub esp, 0x18
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], esi
mov word [edx], ax
cmp word [ebp - 0xa14], ax
jne 0x42c69d
xor ecx, ecx
jmp 0x42c6bb
lea ecx, [ebp - 0xa14]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c6a6
sub ecx, esi
mov esi, dword [ebp - 0x2f70]
sar ecx, 1
push ecx
lea eax, [ebp - 0xa14]
push eax
mov ecx, edx
call fcn.004023a0
call fcn.0042bb20
add esp, 0x18
mov bl, al
lea eax, [ebp - 0xa14]
push eax
mov eax, 0x47ca04
mov ecx, 0x47c9fc
test bl, bl
cmove ecx, eax
push ecx
push str.________s__s
push 0x494648
call fcn.00409980
lea eax, [ebp - 0x2ce0]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s.sys
push eax
call fcn.00409980
add esp, 0x20
lea eax, [ebp - 0x2f5c]
push eax
lea eax, [ebp - 0xa14]
push eax
mov dword [ebp - 0x2f60], 0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x42c748
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x42c75f
push str.___drv_
push 0x500
push 0x494648
call fcn.00451274
add esp, 0xc
cmp esi, 1
jne 0x42c76e
push str.___f_
jmp 0x42c96b
cmp esi, 2
jmp 0x42c964
push dword [ebp - 0x2f88]
mov edx, dword [ebp - 0x2f78]
push dword [ebp - 0x2f7c]
lea ecx, [ebp - 0x1e14]
call fcn.0042bc30
add esp, 8
test al, al
je 0x42c98c
lea eax, [ebp - 0x2ce0]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push 0x46c04c
push eax
mov byte [ebp - 0x2f65], 0
call fcn.00409980
add esp, 0x10
test esi, esi
jne 0x42c8c2
cmp byte [ebp + 0x43], 0
je 0x42c902
cmp word [ebp - 0xa14], si
jne 0x42c7e6
xor ecx, ecx
jmp 0x42c7ff
lea ecx, [ebp - 0xa14]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c7f0
sub ecx, edx
sar ecx, 1
cmp dword [ebp - 0x2830], 8
mov ebx, dword [ebp - 0x2834]
lea edx, [ebp - 0x2844]
cmovae edx, dword [ebp - 0x2844]
cmp ebx, ecx
mov edi, ecx
cmovb edi, ebx
test edi, edi
je 0x42c841
lea esi, [ebp - 0xa14]
lea ebx, [ebx]
mov ax, word [edx]
cmp ax, word [esi]
jne 0x42c879
add edx, 2
add esi, 2
dec edi
jne 0x42c830
xor eax, eax
test eax, eax
jne 0x42c854
cmp ebx, ecx
jb 0x42c854
cmp ebx, ecx
setne al
test eax, eax
je 0x42c8bc
sub esp, 0x18
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [ebp - 0xa14], ax
jne 0x42c887
xor ecx, ecx
jmp 0x42c89f
movzx eax, word [edx]
cmp ax, word [esi]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x42c843
lea ecx, [ebp - 0xa14]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c890
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [ebp - 0xa14]
push eax
mov ecx, edx
call fcn.004023a0
call fcn.0042bb20
add esp, 0x18
mov byte [ebp - 0x2f65], al
mov edi, dword [ebp - 0x2f74]
cmp byte [ebp - 0x2f65], 0
lea eax, [ebp - 0xa14]
push eax
mov ecx, 0x47ca70
mov eax, 0x47ca68
cmove eax, ecx
push eax
push str.________s__s
push 0x494648
call fcn.00409980
mov eax, dword [ebp - 0x2f70]
add esp, 0x10
cmp eax, 1
jne 0x42c961
push str.___f_
jmp 0x42c96b
sub esp, 0x18
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [ebp - 0xa14], ax
jne 0x42c927
xor ecx, ecx
jmp 0x42c93f
lea ecx, [ebp - 0xa14]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c930
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [ebp - 0xa14]
push eax
mov ecx, edx
call fcn.004023a0
call fcn.0042bb20
add esp, 0x18
mov byte [ebp - 0x2f65], al
jmp 0x42c8c2
cmp eax, 2
jne 0x42c97d
push str.___e_
push 0x500
push 0x494648
call fcn.00451274
add esp, 0xc
mov edx, 4
mov ecx, 0x494648
call fcn.0040da30
mov ebx, dword [ebp - 0x2f8c]
lea eax, [ebp - 0x2abc]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x42c264
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_FindClose]
call ebx
mov al, byte [ebp - 0x2f66]
test al, al
je 0x42c324
cmp edi, 2
jge 0x42c324
jmp 0x42c34c
mov ebx, dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x42c32a