Function at 0x100036e0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ae8b
mov eax, dword fs:[0]
push eax
mov eax, 0x23a4
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23a4], ecx
mov eax, dword [ebp + 8]
mov ecx, 0x101cf430
mov edi, dword [ebp + 0x28]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x238c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2384], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2380], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2394], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x237c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x239c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2398], eax
mov eax, edi
mov dword [ebp - 0x2388], ebx
mov dword [ebp - 0x23a0], esi
mov dword [ebp - 0x23a8], edi
mov dword [ebp - 0x2390], 1
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100037a3
test dl, dl
je 0x1000379f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100037a3
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003783
xor eax, eax
jmp 0x100037a8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100037d3
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100037b1
sub ecx, edx
jne 0x100037d3
push esi
lea eax, [ebp - 0x1910]
push 0x101cf434
push eax
call fcn.100011a0
add esp, 0xc
jmp 0x100037ea
push esi
push edi
push ebx
lea eax, [ebp - 0x1910]
push str._s_s_s
push eax
call fcn.100011a0
add esp, 0x14
lea ecx, [ebp - 0x1910]
call fcn.10011fe0
mov esi, eax
mov dword [ebp - 0x2114], 7
xor eax, eax
mov dword [ebp - 0x2118], 0
mov word [ebp - 0x2128], ax
cmp word [esi], ax
jne 0x1000381d
xor ecx, ecx
jmp 0x10003831
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003822
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2128]
call fcn.10005450
push esi
mov dword [ebp - 4], 0
call fcn.1015bd72
lea ecx, [ebp - 0x2128]
call fcn.10006580
test eax, eax
jne 0x10003988
push 0x100
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.10154a20
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor ebx, ebx
cmp byte [ebp - 0x110], bl
je 0x10003988
xor edi, edi
nop word [eax + eax]
lea esi, [ebp - 0x110]
mov eax, 0x101cf2a2
add esi, ebx
add ebx, 4
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100038d2
test dl, dl
je 0x100038ce
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100038d2
add ecx, 2
add eax, 2
test dl, dl
jne 0x100038b2
xor eax, eax
jmp 0x100038d7
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000397a
push 0x101cf444
push esi
call fcn.101538c0
add esp, 8
test eax, eax
jne 0x10003970
push 0x101cf448
push esi
call fcn.101538c0
add esp, 8
test eax, eax
jne 0x10003970
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x10003970
cmp eax, 1
je 0x10003970
test eax, eax
je 0x10003970
push dword [ebp + 0x3c]
mov eax, dword [ebp + 0x2c]
push dword [ebp + 0x38]
mov ecx, dword [ebp - 0x23a4]
dec eax
push dword [ebp + 0x34]
push dword [ebp - 0x2398]
push eax
push esi
push dword [ebp - 0x239c]
push dword [ebp - 0x237c]
push dword [ebp - 0x2394]
push dword [ebp - 0x2380]
push dword [ebp - 0x2384]
push dword [ebp - 0x23a0]
push dword [ebp - 0x2388]
push dword [ebp - 0x238c]
call fcn.100036e0
test eax, eax
js 0x10003d38
inc edi
cmp edi, 1
jb 0x100038a0
cmp byte [ebp + ebx - 0x110], 0
jne 0x10003893
cmp dword [ebp - 0x2114], 8
lea eax, [ebp - 0x2128]
cmovae eax, dword [ebp - 0x2128]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x10003a23
mov edx, dword [ebp - 0x2118]
lea ecx, [edx - 1]
cmp edx, ecx
ja 0x100039be
push str.invalid_string_position
call fcn.1008fd5e
mov esi, dword [ebp - 0x2114]
lea eax, [ebp - 0x2128]
mov edi, dword [ebp - 0x2128]
cmp esi, 8
cmovae eax, edi
cmp word [eax + ecx*2], 0x5c
je 0x10003a07
cmp edx, ecx
ja 0x100039eb
push str.invalid_string_position
call fcn.1008fd5e
cmp esi, 8
lea eax, [ebp - 0x2128]
cmovae eax, edi
cmp word [eax + ecx*2], 0x2f
je 0x10003a07
push 4
push 0x101cf454
jmp 0x10003a0e
push 3
push 0x101cf44c
lea ecx, [ebp - 0x2128]
call fcn.10005df0
cmp dword [ebp + 0x2c], 0
jl 0x10003d60
cmp dword [ebp - 0x2114], 8
lea ecx, [ebp - 0x2378]
lea eax, [ebp - 0x2128]
cmovae eax, dword [ebp - 0x2128]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10003d60
push 0x800
lea eax, [ebp - 0x910]
push 0
push eax
call fcn.10154a20
add esp, 0xc
lea eax, [ebp - 0x234c]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x10003a8e
xor esi, esi
jmp 0x10003ad2
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.101609af
add esp, 4
lea ecx, [edi + 1]
mov esi, eax
push ecx
push 0
push esi
call fcn.10154a20
add esp, 0xc
lea eax, [ebp - 0x234c]
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x910]
mov ecx, esi
sub edx, esi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10003ae0
push esi
call fcn.1015bd72
mov edi, dword [ebp - 0x235c]
xor esi, esi
add esp, 4
add esi, dword [ebp - 0x2358]
adc edi, 0
test byte [ebp - 0x2378], 0x10
je 0x10003c95
mov ecx, 0x101cf460
lea eax, [ebp - 0x910]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003b40
test dl, dl
je 0x10003b3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003b40
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003b20
xor eax, eax
jmp 0x10003b45
sbb eax, eax
or eax, 1
test eax, eax
je 0x10003d43
mov ecx, 0x101cf464
lea eax, [ebp - 0x910]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003b78
test dl, dl
je 0x10003b74
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003b78
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003b58
xor eax, eax
jmp 0x10003b7d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10003d43
push 0x800
lea eax, [ebp - 0x1110]
push 0
push eax
call fcn.10154a20
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push dword [ebp - 0x23a8]
lea eax, [ebp - 0x1110]
push str._s_s_
push eax
call fcn.100011a0
mov edx, dword [ebp - 0x237c]
lea ecx, [ebp - 0x910]
add esp, 0x10
call fcn.1000ed10
cmp eax, 1
je 0x10003d43
mov edi, dword [ebp - 0x2394]
lea ecx, [ebp - 0x910]
mov edx, edi
call fcn.1000ed10
cmp eax, 1
jne 0x10003d43
push dword [ebp + 0x3c]
mov esi, dword [ebp + 0x38]
mov eax, dword [ebp + 0x2c]
push esi
push dword [ebp + 0x34]
mov ecx, dword [ebp - 0x23a4]
dec eax
push dword [ebp - 0x2398]
push eax
lea eax, [ebp - 0x1110]
push eax
push dword [ebp - 0x239c]
push dword [ebp - 0x237c]
push edi
push dword [ebp - 0x2380]
mov edi, dword [ebp - 0x2388]
push dword [ebp - 0x2384]
push dword [ebp - 0x23a0]
push edi
push dword [ebp - 0x238c]
call fcn.100036e0
test eax, eax
js 0x10003d31
lea eax, [ebp - 0x1110]
push eax
push edi
lea eax, [ebp - 0x2110]
push str._s_s_
push eax
call fcn.100011a0
add esp, 0x10
test esi, esi
jne 0x10003d43
lea ecx, [ebp - 0x2110]
call fcn.10011fe0
mov esi, eax
push esi
call fcn.10162828
add esp, 4
push esi
call fcn.1015bd72
add esp, 4
jmp 0x10003d43
lea ecx, [ebp - 0x910]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003ca0
sub ecx, edx
cmp ecx, 4
jl 0x10003cc7
lea eax, [ebp + ecx - 0x914]
push str..otg
push eax
call fcn.1016674b
add esp, 8
test eax, eax
je 0x10003d43
mov edx, dword [ebp - 0x2380]
lea ecx, [ebp - 0x910]
call fcn.1000ed10
cmp eax, 1
je 0x10003d43
mov edx, dword [ebp - 0x2384]
lea ecx, [ebp - 0x910]
call fcn.1000ed10
cmp eax, 1
jne 0x10003d43
mov eax, dword [ebp + 0x3c]
cmp dword [ebp - 0x2390], eax
jle 0x10003d02
test eax, eax
jne 0x10003d43
push dword [ebp + 0x38]
lea eax, [ebp - 0x910]
push dword [ebp + 0x34]
push edi
push esi
push eax
push dword [ebp - 0x23a8]
push dword [ebp - 0x2388]
push dword [ebp - 0x238c]
call fcn.100031c0
test eax, eax
jns 0x10003d3d
cmp eax, 0xfffffff6
jle 0x10003d43
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
jmp 0x10003d65
inc dword [ebp - 0x2390]
lea eax, [ebp - 0x2378]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003a50
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
mov ecx, dword [ebp - 0x2114]
cmp ecx, 8
jb 0x10003d83
inc ecx
push ecx
push dword [ebp - 0x2128]
lea ecx, [ebp - 0x2128]
call fcn.10005bc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a66bf
mov esp, ebp
pop ebp
ret 0x38