Function at 0x4274e2
Capabilities:
Enumerate files on windows
Get disk information
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x70]
mov eax, 0x29c0
call fcn.00431750
push ebx
mov ebx, dword [ebp + 0x78]
push esi
push edi
mov edi, dword [ebx + 0x10]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x34
lea eax, [ebp + 0x28]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 0x7c]
add esp, 0xc
test esi, esi
jne 0x42751e
mov esi, 0x43301c
cmp word [esi], 0x5c
jne 0x42753b
lea eax, [esi + 2]
push 0x5c
push eax
mov dword [ebp + 0x7c], eax
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
test eax, eax
jne 0x42753b
mov esi, dword [ebp + 0x7c]
test esi, esi
je 0x4275e9
cmp word [esi], 0
je 0x4275e9
push 0x5c
push esi
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
push esi
test eax, eax
jne 0x42756f
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
jmp 0x4275ef
call sub.MSVCRT.dll_wcslen
cmp word [esi + eax*2 - 2], 0x5c
pop ecx
lea eax, [edi + 0xc]
jne 0x427597
push esi
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
movzx eax, word [edi + 0xc]
cmp eax, 0x61
jb 0x4275eb
add eax, 0xffffffe0
jmp 0x4275eb
push 0x208
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
call sub.MSVCRT.dll_wcslen
add esp, 0x10
test eax, eax
js 0x4275ef
cmp word [esi + eax*2], 0x5c
je 0x4275bd
dec eax
jns 0x4275b1
jmp 0x4275ef
add eax, eax
mov dword [ebp + 0x7c], eax
add eax, 2
push eax
lea eax, [edi + 0xc]
push esi
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 0x7c]
lea eax, [eax + esi + 2]
push eax
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcscpy
add esp, 0x14
jmp 0x427589
xor eax, eax
mov word [edi + 0xc], ax
lea eax, [edi + 0xc]
cmp word [eax], 0
jne 0x427601
push dword [ebx]
call fcn.00429d48
jmp 0x427609
push eax
push dword [ebx]
call fcn.00429c9f
mov esi, dword [sym.imp.USER32.DLL_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx]
call esi
cmp word [edi + 0xc], 0
jne 0x4277f4
test byte [edi + 8], 4
jne 0x427e4e
and dword [ebp + 0x30], 0
mov dword [ebp + 0x28], 7
mov dword [ebp + 0x2c], 0x10000
mov dword [ebp + 0x3c], 0x43301c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp + 0x78], eax
lea eax, [ebp - 0x2950]
push 0x433314
push eax
call sub.MSVCRT.dll_wcscpy
and dword [ebp + 0x6c], 0
pop ecx
pop ecx
mov ecx, dword [ebp + 0x6c]
xor eax, eax
inc eax
shl eax, cl
test dword [ebp + 0x78], eax
je 0x42775a
mov eax, ecx
lea ecx, [eax + 0x41]
mov dword [ebp + 0x48], eax
mov word [ebp - 0x2950], cx
lea eax, [ebp - 0x534]
xor ecx, ecx
push str.Drive
push eax
mov word [ebp - 0x494], cx
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
push 0x4001
push 0x2b4
lea eax, [ebp - 0x748]
push eax
push 0
lea eax, [ebp - 0x2950]
push eax
call dword [sym.imp.SHELL32.DLL_SHGetFileInfoW]
mov eax, dword [ebp - 0x744]
push 0x200
mov dword [ebp + 0x44], eax
push 0x2b4
lea eax, [ebp - 0x748]
push eax
push 0
lea eax, [ebp - 0x2950]
push eax
call dword [sym.imp.SHELL32.DLL_SHGetFileInfoW]
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x494]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
lea eax, [ebp + 0x28]
push eax
push 0
push 0x104d
push dword [ebx]
call esi
and dword [ebp + 0x7c], 0
cmp dword [edi + 0x2220], 0
mov dword [ebp + 0x64], eax
jle 0x42775a
mov eax, dword [ebp + 0x7c]
cmp byte [edi + eax + 0x2224], 2
jne 0x42774c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x494]
mov dword [ebp + 4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x64]
push 0x1074
push dword [ebx]
call esi
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [edi + 0x2220]
jl 0x427723
inc dword [ebp + 0x6c]
cmp dword [ebp + 0x6c], 0x1f
jle 0x42766a
cmp dword [0x438f88], 0
je 0x427e4e
test dword [edi + 8], 0x200
jne 0x427e4e
mov eax, dword [0x43c2e0]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x28]
push eax
push 0
push 0x104d
push dword [ebx]
mov dword [ebp + 0x3c], 0x43301c
mov dword [ebp + 0x48], 0xfd
call esi
and dword [ebp + 0x7c], 0
cmp dword [edi + 0x2220], 0
mov dword [ebp + 0x64], eax
jle 0x427e4e
mov eax, dword [ebp + 0x7c]
cmp byte [edi + eax + 0x2224], 2
jne 0x4277e1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x64]
mov dword [ebp + 4], 0x43c2e8
push 0x1074
push dword [ebx]
call esi
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [edi + 0x2220]
jl 0x4277ba
jmp 0x427e4e
test byte [edi + 8], 2
jne 0x4278ea
mov eax, dword [0x43c2dc]
and dword [ebp + 0x2c], 0
push 0x5c
mov dword [ebp + 0x44], eax
lea eax, [edi + 0xc]
push 0x5c
push eax
mov dword [ebp + 0x28], 7
mov dword [ebp + 0x3c], 0x43301c
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
add eax, 2
push eax
call sub.MSVCRT.dll_wcschr
neg eax
sbb eax, eax
neg eax
add eax, 0xfa
cmp dword [0x438f88], 0
pop ecx
pop ecx
mov dword [ebp + 0x48], eax
je 0x427896
test dword [edi + 8], 0x200
jne 0x427896
push 0x43c4f0
call sub.MSVCRT.dll_wcslen
push eax
lea eax, [edi + 0xc]
push 0x43c4f0
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0x10
test eax, eax
jne 0x427896
push 0x5c
push 0x43c4f0
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [edi + eax*2 + 0xc]
push eax
call sub.MSVCRT.dll_wcschr
pop ecx
pop ecx
test eax, eax
jne 0x427896
mov dword [ebp + 0x48], 0xfa
lea eax, [ebp + 0x28]
push eax
push 0
push 0x104d
push dword [ebx]
call esi
and dword [ebp + 0x7c], 0
cmp dword [edi + 0x2220], 0
mov dword [ebp + 0x64], eax
jle 0x4278ea
mov eax, dword [ebp + 0x7c]
cmp byte [edi + eax + 0x2224], 2
jne 0x4278dc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x64]
mov dword [ebp + 4], 0x43359c
push 0x1074
push dword [ebx]
call esi
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [edi + 0x2220]
jl 0x4278b5
test byte [edi + 8], 4
jne 0x427abd
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x494]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x494]
push 0x4335b8
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 0x64], eax
cmp eax, 0xffffffff
je 0x427abd
push 7
pop eax
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], 0xffff
mov dword [ebp + 0x3c], 0x43301c
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], 0xfc
test byte [ebp - 0x28c], 0x10
je 0x427a9c
lea eax, [ebp - 0x260]
push 0x4335b4
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x427a9c
lea eax, [ebp - 0x260]
push 0x43359c
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x427a9c
mov eax, dword [0x43c2dc]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x28]
push eax
push 0
push 0x104d
push dword [ebx]
call esi
and dword [ebp + 0x7c], 0
cmp dword [edi + 0x2220], 0
mov dword [ebp + 0x6c], eax
jle 0x427a9c
mov eax, dword [ebp + 0x7c]
movzx eax, byte [edi + eax + 0x2224]
dec eax
dec eax
je 0x427a6b
sub eax, 3
je 0x427a0f
dec eax
je 0x4279f9
dec eax
je 0x4279f1
dec eax
jne 0x427a8a
lea eax, [ebp - 0x280]
jmp 0x4279ff
lea eax, [ebp - 0x278]
jmp 0x4279ff
lea eax, [ebp - 0x288]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
push dword [ebx]
call fcn.004264f2
jmp 0x427a8a
push 0xb
lea eax, [ebp - 0x34]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp + 0x60], str.RHSDANTCOE
mov dword [ebp + 0x68], 0x438f5c
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp + 0x68]
test dword [ecx], eax
je 0x427a4f
lea eax, [ebp - 0x34]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [ebp + 0x60]
mov cx, word [ecx]
mov word [ebp + eax*2 - 0x34], cx
add dword [ebp + 0x68], 4
add dword [ebp + 0x60], 2
cmp dword [ebp + 0x68], 0x438f80
jle 0x427a2d
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
jmp 0x427a77
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x260]
mov dword [ebp + 4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x6c]
push 0x1074
push dword [ebx]
call esi
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [edi + 0x2220]
jl 0x4279c4
lea eax, [ebp - 0x28c]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x427956
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [edi + 8], 1
jne 0x427e4e
lea eax, [edi + 0x214]
push eax
lea eax, [ebp - 0x2950]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x2950]
push eax
call sub.MSVCRT.dll_wcslen
xor ecx, ecx
and dword [ebp + 0x6c], ecx
mov word [ebp + eax*2 - 0x294e], cx
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
mov eax, dword [ebp + 0x6c]
lea eax, [ebp + eax*2 - 0x2950]
cmp word [eax], 0x3b
jne 0x427b17
xor ecx, ecx
mov word [eax], cx
inc dword [ebp + 0x6c]
lea eax, [edi + 0x214]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
cmp dword [ebp + 0x6c], eax
jbe 0x427b02
push 0x43dc38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [ebp - 0x2950], 0
lea eax, [ebp - 0x2950]
jmp 0x427e3a
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x494]
push eax
call sub.MSVCRT.dll_wcscpy
push dword [ebp + 0x60]
lea eax, [ebp - 0x494]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 0x64], eax
cmp eax, 0xffffffff
je 0x427e26
push 0x2b4
lea eax, [ebp - 0x748]
push 0
push eax
mov dword [ebp + 0x28], 7
mov dword [ebp + 0x2c], 0xffff
mov dword [ebp + 0x3c], 0x43301c
mov dword [ebp + 0x44], 0xa
mov dword [ebp + 0x48], 0xff
call sub.MSVCRT.dll_memset
add esp, 0xc
test byte [ebp - 0x28c], 0x10
jne 0x427e05
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x494]
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x494]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x494]
push eax
call fcn.004299fe
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x28]
push eax
push 0
push 0x104d
push dword [ebx]
call esi
and dword [ebp + 0x7c], 0
cmp dword [edi + 0x2220], 0
mov dword [ebp + 0x6c], eax
jle 0x427e05
mov eax, dword [ebp + 0x7c]
movzx eax, byte [edi + eax + 0x2224]
dec eax
dec eax
je 0x427dd4
dec eax
je 0x427cf5
dec eax
je 0x427ce7
dec eax
je 0x427c88
dec eax
je 0x427c6f
dec eax
je 0x427c67
dec eax
jne 0x427df3
lea eax, [ebp - 0x280]
jmp 0x427c75
lea eax, [ebp - 0x278]
jmp 0x427c75
lea eax, [ebp - 0x288]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
push dword [ebx]
call fcn.004264f2
jmp 0x427df3
push 0xb
lea eax, [ebp - 0x34]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp + 0x5c], str.RHSDANTCOE
mov dword [ebp + 0x68], 0x438f5c
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp + 0x68]
test dword [ecx], eax
je 0x427cc8
lea eax, [ebp - 0x34]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [ebp + 0x5c]
mov cx, word [ecx]
mov word [ebp + eax*2 - 0x34], cx
add dword [ebp + 0x68], 4
add dword [ebp + 0x5c], 2
cmp dword [ebp + 0x68], 0x438f80
jle 0x427ca6
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
jmp 0x427de0
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
jmp 0x427de0
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x427d66
xor ecx, ecx
xor ebx, ebx
add ecx, dword [ebp - 0x26c]
lea edx, [ebp - 0x494]
adc eax, ebx
mov dword [ebp + 0x5c], edx
lea edx, [ebp - 0x1c]
shrd ecx, eax, 0xa
shr eax, 0xa
mov dword [ebp + 0x68], edx
push 0
push 0xa
push eax
push ecx
call fcn.00431670
add ecx, 0x30
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp + 0x68]
add dword [ebp + 0x68], 2
mov word [ebx], cx
mov ecx, eax
mov eax, edx
mov edx, ecx
or edx, eax
jne 0x427d21
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x68]
sub ecx, 2
mov dx, word [ecx]
mov word [eax], dx
lea edx, [ebp - 0x1c]
add eax, 2
cmp ecx, edx
jne 0x427d4c
xor ecx, ecx
mov word [eax], cx
jmp 0x427d9a
mov eax, dword [ebp - 0x26c]
lea ecx, [eax - 1]
cmp ecx, 0x3ffffffe
ja 0x427d82
add eax, 0x3ff
mov dword [ebp - 0x26c], eax
shr eax, 0xa
push eax
lea eax, [ebp - 0x494]
push 0x4335ac
push eax
call fcn.00432230
add esp, 0xc
lea eax, [ebp - 0x494]
push 0x4335a4
push eax
call sub.MSVCRT.dll_wcscat
mov eax, dword [ebp + 0x7c]
pop ecx
mov dword [ebp - 8], eax
pop ecx
lea eax, [ebp - 0x494]
mov dword [ebp + 4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x6c]
mov eax, dword [ebp + 0x78]
push 0x1074
push dword [eax]
call esi
mov ebx, dword [ebp + 0x78]
jmp 0x427df3
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x260]
mov dword [ebp + 4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x6c]
push 0x1074
push dword [ebx]
call esi
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [edi + 0x2220]
jl 0x427c2e
lea eax, [ebp - 0x28c]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x427bc5
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 0x60]
call sub.MSVCRT.dll_wcslen
pop ecx
mov ecx, dword [ebp + 0x60]
lea eax, [ecx + eax*2 + 2]
cmp word [eax], 0
mov dword [ebp + 0x60], eax
jne 0x427b4a
push 0x43dc38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x22ec], 0
je 0x427e5e
mov eax, edi
call fcn.00426fce
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8