Function at 0x7ddf01a6
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xaa0
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0xa84], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa8c], esi
test eax, eax
je 0x7ddf0533
test esi, esi
je 0x7ddf0533
test al, 3
jne 0x7ddf0235
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push eax
call fcn.7dd74835
test eax, eax
jne 0x7ddf0288
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, 0x218
push esi
push 8
push dword [eax + 0x18]
call edi
mov ebx, eax
test ebx, ebx
jne 0x7ddf02b7
push 0xc0000017
jmp 0x7ddf0538
lea ecx, [ebp - 0xa88]
push ecx
push eax
call dword [sym.imp.ntdll.dll_LdrGetFileNameFromLoadAsDataTable]
test eax, eax
jl 0x7ddf0205
mov eax, dword [ebp - 0xa88]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7ddf0250
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x7ddf0205
lea edi, [eax + eax]
push edi
push dword [ebp - 0xa88]
lea eax, [ebp - 0x214]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + edi - 0x214], ax
lea eax, [ebp - 0x214]
push 0x5c
push eax
call sub.ntdll.dll_wcsrchr
pop ecx
pop ecx
inc eax
inc eax
push 0x2a
pop ecx
mov word [eax], cx
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x214]
mov dword [ebp - 0xa84], eax
jmp 0x7ddf0452
lea eax, [ebp - 0xa98]
push eax
push esi
push ebx
push 2
push dword [ebp - 0xa80]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
jl 0x7ddf044c
mov eax, dword fs:[0x18]
movzx ecx, word [ebx]
mov eax, dword [eax + 0x30]
push ecx
push 8
push dword [eax + 0x18]
call edi
mov dword [ebp - 0xa84], eax
test eax, eax
je 0x7ddf022b
xor eax, eax
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82c]
push eax
push 0x207
call fcn.7de1f3bb
test eax, eax
je 0x7ddf0427
mov esi, 0x7ddf0550
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x82c]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0xa80]
mov ax, word [eax]
mov word [ebp - 0xc], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.7dd9b6f7
test eax, eax
je 0x7ddf03ff
lea eax, [ebp - 0x41c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7ddf0369
sub eax, edx
sar eax, 1
mov dword [ebp - 0xa94], eax
cmp eax, esi
jae 0x7ddf051a
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebx + 4]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
je 0x7ddf03ff
lea eax, [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7ddf03a7
mov esi, dword [ebp - 0xa84]
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call sub.ntdll.dll_memcpy
lea eax, [ebp - 0xc]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x7ddf03d1
movzx edx, word [ebx]
sub eax, ecx
mov ecx, dword [ebp - 0xa94]
add ecx, ecx
sub edx, ecx
push edx
mov edx, dword [ebx + 4]
sar eax, 1
add edx, ecx
push edx
lea eax, [esi + eax*2]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xa80]
mov ax, word [eax]
add dword [ebp - 0xa80], 2
test ax, ax
jne 0x7ddf03ff
test edi, edi
jne 0x7ddf0427
mov eax, dword [ebp - 0xa80]
cmp word [eax], di
jne 0x7ddf0335
push 0x5c
push dword [ebp - 0xa84]
call sub.ntdll.dll_wcsrchr
pop ecx
pop ecx
test eax, eax
je 0x7ddf051a
inc eax
inc eax
push 0x2a
pop ecx
mov word [eax], cx
xor ecx, ecx
mov word [eax + 2], cx
mov esi, dword [ebp - 0xa8c]
push 0x250
lea eax, [ebp - 0xa7c]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
push dword [ebp - 0xa84]
call fcn.7dd74489
mov edi, eax
cmp edi, 0xffffffff
je 0x7ddf053d
test byte [ebp - 0xa7c], 0x10
je 0x7ddf04fa
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xaa0]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0xaa0]
push eax
call dword [sym.imp.ntdll.dll_RtlCultureNameToLCID]
test al, al
je 0x7ddf04fa
mov ecx, dword [esi + 4]
cmp dword [esi], ecx
jb 0x7ddf04e8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [ecx + ecx + 0x40]
push ecx
push dword [esi + 8]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
test eax, eax
je 0x7ddf0521
add dword [esi + 4], 0x20
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
mov dx, word [ebp - 0xa90]
mov word [ecx + eax*2], dx
inc dword [esi]
lea eax, [ebp - 0xa7c]
push eax
push edi
call fcn.7dd75edb
test eax, eax
jne 0x7ddf0485
push edi
call fcn.7dd7447e
xor eax, eax
inc eax
jmp 0x7ddf053f
push 0xc0000098
jmp 0x7ddf0538
push 0xc0000017
call sym.KERNEL32.dll_BaseSetLastNTError
push edi
call fcn.7dd7447e
jmp 0x7ddf053d
push 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 8