Function at 0x417b10
Capabilities:
Enumerate files on windows
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4fc
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push 0x7c
xor ebx, ebx
mov dword [esp + 0x2c], edi
push esi
mov dword [esp + 0x40], ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x417bd6
mov ecx, eax
mov dword [esp + 0x24], ebx
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.0043b8e8
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
add edx, 2
mov ecx, dword [eax]
call fcn.00417924
mov ecx, dword [esp + 0x18]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test esi, esi
je 0x417b85
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x417bbf
push dword [esp + 0x24]
lea eax, [esp + 0x24]
push 0x491284
push eax
call fcn.0044af44
add esp, 0xc
mov edx, edi
mov ecx, dword [eax]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417b10
mov ecx, dword [esp + 0x30]
add esp, 0x10
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4182da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4182da
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x4952e8
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x417de7
lea ecx, [esp + 0x40]
call fcn.00431b45
lea edx, [esp + 0x40]
mov ecx, esi
call fcn.004335f7
test eax, eax
je 0x417c0c
push eax
jmp 0x417c3b
mov edx, str.ActionList_Media
lea ecx, [esp + 0x40]
call fcn.0043b82e
mov dword [esp + 0x10], eax
test eax, eax
je 0x417c39
push ecx
push 4
push str.Name
mov ecx, eax
call fcn.0043b6e0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x417c46
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x417d73
push esi
lea ecx, [esp + 0x1c]
call fcn.0043c2b8
mov esi, dword [esp + 0x18]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x417c68
or eax, 0xffffffff
jmp 0x417c6c
sub eax, esi
sar eax, 1
inc eax
lea ecx, [esp + 0x18]
push eax
call fcn.0043d882
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x417c87
mov eax, 0x4934ec
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.0043baed
pop ecx
push ebx
push ebx
push 0x20000000
push 3
push edi
push dword [eax]
call dword [sym.imp.WIMGAPI.DLL_WIMCreateFile]
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
call fcn.0043d912
cmp dword [esp + 0x1c], ebx
je 0x417d62
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WIMGAPI.DLL_WIMSetTemporaryPath]
test edi, edi
je 0x417d5a
mov ecx, dword [esp + 0x10]
push 1
push 7
push str.Package
call fcn.0043b7cc
jmp 0x417d52
push ecx
push 0xb
push str.PackagePath
mov ecx, eax
call fcn.0043b6e0
mov dword [esp + 0x28], eax
test eax, eax
je 0x417dda
mov eax, dword [eax + 4]
test eax, eax
jne 0x417d16
mov eax, 0x4934ec
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.0043baed
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
call fcn.004179f3
mov ecx, dword [esp + 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test edi, edi
je 0x417d90
push ecx
mov ecx, dword [esp + 0x24]
push 7
push str.Package
call fcn.0043b741
mov dword [esp + 0x20], eax
test eax, eax
jne 0x417cef
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.004397f4
lea ecx, [esi - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x80]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x74]
call fcn.0043295e
jmp 0x4182da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x28]
mov edi, eax
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x417da8
mov ecx, 0x4934ec
push edi
push ecx
lea eax, [esp + 0x30]
push 0x49534c
push eax
call fcn.0044af44
add esp, 0x10
push dword [eax]
push str.Wimgapi
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push edi
jmp 0x417ddc
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x417d62
mov dword [esp + 0x24], ebx
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x24]
call fcn.0043bbe8
push 9
push 0x4935ec
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x417e6d
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x12]
mov dword [esp + 0x1c], 3
push 0x495364
push eax
or edi, 0x1000
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
push 0xc
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x417e4e
push dword [esp + 0x24]
mov ecx, eax
call fcn.00417a36
jmp 0x417e50
mov eax, ebx
push eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0x491284
push eax
call fcn.0043c575
mov esi, dword [esp + 0x2c]
add esp, 0xc
jmp 0x417ee2
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
cmp eax, 3
je 0x417edf
cmp eax, 4
jne 0x417e89
mov ecx, esi
call fcn.0044d9e7
test eax, eax
jne 0x417edf
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x417eda
sub eax, 1
je 0x417ecc
sub eax, 1
je 0x417ec4
sub eax, 1
je 0x417ebf
sub eax, 1
je 0x417eb1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4182c0
mov edi, dword [ebp + 0xc]
push 3
pop eax
or edi, 0x20000000
jmp 0x417f0c
push 2
pop eax
jmp 0x417ec7
xor eax, eax
inc eax
mov edi, dword [ebp + 0xc]
jmp 0x417f0c
mov edi, dword [ebp + 0xc]
push 7
pop eax
or edi, 0x2000
jmp 0x417f0c
mov edi, dword [ebp + 0xc]
jmp 0x417f0a
mov edi, dword [ebp + 0xc]
push ebx
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
mov ecx, 0x492da0
mov dword [esp + 0x40], ebx
call fcn.0044d9a9
cmp dword [esp + 0x40], 0x60002
pop ecx
jbe 0x417f0a
or edi, 0x20000000
mov eax, ebx
push ebx
push eax
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x38]
push edi
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMCreateFile]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4182be
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WIMGAPI.DLL_WIMSetTemporaryPath]
test edi, edi
je 0x4182ba
test edi, 0x40000000
jne 0x4182ba
push 0x230
lea eax, [esp + 0x2dc]
push eax
push dword [esp + 0x24]
call dword [sym.imp.WIMGAPI.DLL_WIMGetAttributes]
test eax, eax
je 0x4182ba
test byte [esp + 0x500], 0x10
je 0x41801d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push esi
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.0043c2b8
test edi, edi
je 0x417f9a
sub edi, esi
sar edi, 1
jmp 0x417fa1
mov eax, dword [esp + 0x10]
mov edi, dword [eax - 0xc]
push 0x49356c
push edi
lea ecx, [esp + 0x18]
call fcn.00432070
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x1c]
call fcn.0043bbe8
mov esi, dword [esp + 0x10]
push 2
pop ebx
jmp 0x417fd7
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.004179f3
inc ebx
push ebx
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0044af44
add esp, 0xc
lea ecx, [esp + 0x18]
push eax
call fcn.0043c5cb
mov ecx, dword [eax]
call fcn.0044d9e7
mov ecx, dword [esp + 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test edi, edi
jne 0x417fc8
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esi - 0x10]
jmp 0x4182b5
cmp dword [esp + 0x4f4], 3
jne 0x4182ba
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
mov ecx, edi
mov dword [esp + 0x38], edi
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.0043b8e8
push str.Microsoft_Windows_Foundation_Package.ESD
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x30]
call fcn.0043baed
pop ecx
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [eax]
call fcn.0044d9e7
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
jne 0x4180ca
push str.Microsoft_Windows_Foundation_Package.cab
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x38]
call fcn.0043baed
pop ecx
push 3
pop ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [eax]
call fcn.0044d9e7
test eax, eax
jne 0x4180ca
push str._Microsoft_Windows_Foundation_Package
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.0043baed
pop ecx
lea ecx, [esp + 0x88]
push ecx
push dword [eax]
call esi
mov dword [esp + 0x28], eax
push 0xf
pop ecx
cmp eax, 0xffffffff
jne 0x4180ce
mov byte [esp + 0x17], bl
jmp 0x4180d8
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x17], 1
test cl, 8
je 0x4180ec
and ecx, 0xfffffff7
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
call fcn.00439a21
mov ecx, dword [esp + 0x10]
test cl, 4
je 0x418108
and ecx, 0xfffffffb
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x10]
test cl, 2
je 0x418124
and ecx, 0xfffffffd
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x34]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x10]
and ecx, 0xfffffffe
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp byte [esp + 0x17], bl
je 0x4182ae
push 0x48f330
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x30]
call fcn.0043baed
pop ecx
lea ecx, [esp + 0x88]
push ecx
push dword [eax]
call esi
mov ecx, dword [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x28], esi
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp esi, 0xffffffff
je 0x4182a5
test byte [esp + 0x88], 0x10
je 0x41821b
lea ecx, [esp + 0xb4]
call fcn.0044cdbe
test al, al
jne 0x4181da
or dword [esp + 0x10], 0x30
lea edx, [esp + 0x18]
mov eax, ecx
lea ecx, [esp + 0x34]
push str._filehashes_.dat
push eax
call fcn.0043baed
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.0043baed
pop ecx
mov ecx, dword [eax]
call fcn.0044d9e7
cmp eax, 1
jne 0x4181da
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], bl
mov dword [esp + 0x10], eax
jmp 0x4181e3
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], 1
test al, 0x20
je 0x4181fe
mov ecx, dword [esp + 0x2c]
and eax, 0xffffffdf
mov dword [esp + 0x10], eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x418215
mov ecx, dword [esp + 0x34]
and eax, 0xffffffef
mov dword [esp + 0x10], eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp byte [esp + 0x17], bl
jmp 0x41825c
push edi
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x41828a
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
push 0x4939bc
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x41825e
push 0x492d20
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x41828a
lea eax, [esp + 0xb4]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.0043baed
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
call fcn.004179f3
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea eax, [esp + 0x88]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [esp + 0x38]
test eax, eax
jne 0x41817b
lea ecx, [esp + 0x28]
call fcn.00439a21
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov eax, dword [esp + 0x1c]
mov ebx, eax
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4182da
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret