Function at 0x10005170
Capabilities:
Check if file exists
Create directory
Enumerate files on windows
Get disk information
Get file attributes
Hash data using fnv
Set file attributes

Disassembly:
sub esp, 0xbd4
mov eax, dword [0x1001b2a8]
xor eax, esp
mov dword [esp + 0xbcc], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x104
lea eax, [esp + 0x6a4]
push esi
push eax
call fcn.1000caa1
lea eax, [esp + 0x6ac]
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100051b0
sub eax, edx
sar eax, 1
test eax, eax
jle 0x100051e6
cmp word [esp + eax*2 + 0x69e], 0x5c
je 0x100051e6
mov ecx, 0x5c
mov word [esp + eax*2 + 0x6a0], cx
inc eax
xor edx, edx
mov word [esp + eax*2 + 0x6a0], dx
xor ecx, ecx
jmp 0x100051f0
movzx edx, word [esp + ecx + 0x6a0]
mov word [esp + ecx + 0x268], dx
add ecx, 2
test dx, dx
jne 0x100051f0
mov ecx, 0x2a
xor edx, edx
mov word [esp + eax*2 + 0x268], cx
mov word [esp + eax*2 + 0x26a], dx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x100055de
xor eax, eax
jmp 0x10005250
movzx ecx, word [esp + eax + 0x6a0]
mov word [esp + eax + 0x268], cx
add eax, 2
test cx, cx
jne 0x10005250
lea eax, [esp + 0x268]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10005272
mov edx, dword [str.RECYCLED_]
mov ecx, dword [0x10019460]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [eax], edx
mov edx, dword [0x10019464]
mov dword [eax + 4], ecx
mov ecx, dword [0x10019468]
mov dword [eax + 8], edx
mov edx, dword [0x1001946c]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
push 0
lea eax, [esp + 0x26c]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 6
lea ecx, [esp + 0x26c]
push ecx
call ebp
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
push esi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x100052fa
mov dword [esp + 0x10], 0x83345681
mov eax, dword [esp + 0x10]
push 0x80
push 0
push eax
lea edi, [esp + 0x8dc]
call fcn.10009a60
mov eax, edi
add esp, 0xc
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005320
lea edi, [esp + 0x268]
sub eax, edx
add edi, 0xfffffffe
jmp 0x10005340
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005340
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x268]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005366
mov ecx, dword [0x10019470]
push 0
lea edx, [esp + 0x26c]
push edx
mov dword [edi], ecx
call ebx
push 6
lea eax, [esp + 0x26c]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push 0x80
not ecx
push 0
push ecx
lea edi, [esp + 0x8dc]
call fcn.10009a60
mov eax, edi
add esp, 0xc
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100053b3
lea edi, [esp + 0x268]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100053d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x268]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x100053f6
mov edx, dword [0x10019474]
mov ecx, dword [0x10019478]
mov dword [eax], edx
mov dx, word [0x1001947c]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000543e
lea ecx, [esp + 0x268]
push ecx
call fcn.10005820
lea eax, [esp + 0x6a0]
lea edx, [eax + 2]
jmp 0x10005450
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005450
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x268]
lea edx, [esp + 0x9d0]
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10005470
lea eax, [esp + 0x9d0]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10005490
mov edx, dword [0x10019480]
mov ecx, dword [0x10019484]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [eax], edx
mov dword [eax + 4], ecx
test byte [esp + 0x18], 0x10
je 0x100055bf
lea ecx, [esp + 0x44]
call fcn.10009ac0
cmp eax, 0x3908149
je 0x100055bf
mov cx, word [esp + 0x44]
xor edx, edx
mov eax, 0x811c9dc5
test cx, cx
je 0x10005545
movzx ecx, cx
movzx ecx, cx
lea esi, [ecx - 0x41]
cmp si, 0x19
ja 0x100054f5
add ecx, 0x20
imul eax, eax, 0x1000193
movzx ecx, cx
inc edx
xor eax, ecx
movzx ecx, word [esp + edx*2 + 0x44]
test cx, cx
jne 0x100054e6
cmp eax, 0x227a1cc6
ja 0x10005533
je 0x100055bf
sub eax, 0x350988a
je 0x100055bf
sub eax, 0x12
je 0x100055bf
sub eax, 0x1bbc495
jmp 0x10005543
cmp eax, 0x2376b40d
je 0x100055bf
cmp eax, 0xc2dfb6e7
je 0x100055bf
xor eax, eax
jmp 0x10005550
movzx ecx, word [esp + eax + 0x6a0]
mov word [esp + eax + 0x268], cx
add eax, 2
test cx, cx
jne 0x10005550
lea eax, [esp + 0x44]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005570
lea edi, [esp + 0x268]
sub eax, edx
add edi, 0xfffffffe
jmp 0x10005590
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005590
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x9d0]
lea ebx, [esp + 0x268]
call fcn.10005600
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call ebp
test eax, eax
jne 0x100054b3
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0xbdc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000c11c
add esp, 0xbd4
ret