Function at 0x10002a10
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
sub esp, 0x8a0
mov eax, dword [0x101cc040]
xor eax, esp
mov dword [esp + 0x89c], eax
mov eax, dword [esp + 0x8a4]
push ebx
push ebp
mov ebp, dword [esp + 0x8b0]
push edi
push esi
push 0x10143154
mov ecx, 0x104
lea edi, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.10001100
add esp, 8
mov edx, esi
call fcn.10007e70
mov ebx, eax
lea eax, [esp + 0x114]
mov ecx, eax
mov edi, 0x12c
sub edx, ecx
lea esp, [esp]
lea ecx, [edi + 0x7ffffed2]
test ecx, ecx
je 0x10002a90
movzx ecx, word [edx + eax]
test cx, cx
je 0x10002a90
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x10002a70
jmp 0x10002a94
test edi, edi
jne 0x10002a97
sub eax, 2
xor edx, edx
mov word [eax], dx
lea ecx, [esp + 0x114]
xor eax, eax
push ecx
mov word [esp + 0x11e], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x10002d9a
cmp ebp, 3
jne 0x10002afa
push str.New_Heur.FFD_VBS_
mov edi, dword [esp + 0x10]
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 8
pop edi
pop ebp
mov eax, 0x25
pop ebx
mov ecx, dword [esp + 0x89c]
xor ecx, esp
call fcn.1012fc12
add esp, 0x8a0
ret
push 0x1014316c
push ebx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
jne 0x10002b84
push 0x10143170
push ebx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
jne 0x10002b84
push 0x10143174
push ebx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
jne 0x10002b84
push 0x10143178
push ebx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
jne 0x10002b84
push 0x1014317c
push ebx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
jne 0x10002b84
push 0x10143180
push ebx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
je 0x10002bde
cmp dword [esp + 0x8b8], 0x265000
ja 0x10002bde
push ebx
push str.New_Heur.FFD__S_
mov ecx, 0x12c
lea edi, [esp + 0x374]
call fcn.10001100
mov edx, edi
mov edi, dword [esp + 0x14]
push edx
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 0x10
pop edi
pop ebp
mov eax, 0x25
pop ebx
mov ecx, dword [esp + 0x89c]
xor ecx, esp
call fcn.1012fc12
add esp, 0x8a0
ret
lea eax, [esp + 0x6a0]
mov ecx, esi
xor edi, edi
call fcn.10007ec0
test eax, eax
je 0x10002c1f
xor eax, eax
lea ecx, [esp + 0x6a0]
mov word [esp + 0x118], ax
push ecx
lea eax, [esp + 0x118]
lea ecx, [edi + 4]
call fcn.10008140
add esp, 4
test eax, eax
je 0x10002c1f
mov edi, 1
lea eax, [esp + 0x498]
mov ecx, esi
call fcn.10007f50
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x10002c54
lea edx, [esp + 0x498]
push edx
call ebx
cmp eax, 0xffffffff
je 0x10002c54
test al, 6
je 0x10002c54
push str.New_Heur.FFD_FakeDir_
jmp 0x10002ac7
cmp ebp, 1
jne 0x10002d87
lea eax, [esp + 0x10]
push str._recycle.
push eax
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
jne 0x10002d7d
lea ecx, [esp + 0x10]
push 0x101431bc
push ecx
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
jne 0x10002d7d
lea edx, [esp + 0x10]
push str.RECYCLER
push edx
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
jne 0x10002d7d
lea eax, [esp + 0x10]
push str..Trashes
push eax
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
je 0x10002cdf
push str.New_Heur.FFD_Trashes_
jmp 0x10002ac7
lea ecx, [esp + 0x10]
push 0x10143208
push ecx
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
je 0x10002d4e
lea edx, [esp + 0x10]
push 0x1014320c
push edx
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
je 0x10002d4e
lea eax, [esp + 0x10]
push 0x10143210
push eax
mov eax, 0x104
call fcn.10007ce0
add esp, 8
test eax, eax
je 0x10002d4e
test esi, esi
je 0x10002d4e
mov ecx, 0x104
mov eax, esi
jmp 0x10002d40
cmp word [eax], 0
je 0x10002d63
add eax, 2
sub ecx, 1
jne 0x10002d40
push esi
call ebx
test edi, edi
je 0x10002d9a
test al, 6
je 0x10002d9a
push str.New_Heur.FFD_Hidden_root_
jmp 0x10002ac7
test ecx, ecx
je 0x10002d4e
mov eax, 0x104
sub eax, ecx
cmp eax, 0x52
jne 0x10002d4e
push str.New_Heur.FFD_Hexa_
jmp 0x10002ac7
push str.New_Heur.FFD_Recycler_
jmp 0x10002ac7
cmp ebp, 4
jne 0x10002d9a
test edi, edi
je 0x10002d9a
push str.New_Heur.FFD_Link_
jmp 0x10002ac7
mov ecx, dword [esp + 0x8a8]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1012fc12
add esp, 0x8a0
ret