Function at 0x100027d0
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x690
mov eax, dword [0x10019004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov bl, byte [ebp + 8]
lea eax, [ebp - 0x220]
push esi
push edi
push 0x1fc
push 0
push eax
mov dword [ebp - 0x68c], 0
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x434]
push 0x208
push 0
push eax
call fcn.10006250
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor eax, eax
add esp, 0xc
movsx di, bl
mov word [ebp - 0x12], ax
mov word [ebp - 0x1c], ax
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
push eax
mov word [ebp - 0x686], di
mov word [ebp - 0x18], di
mov dword [ebp - 0x16], 0x5c003a
mov dword [ebp - 0x24], 0x65002e
mov dword [ebp - 0x20], 0x650078
mov word [ebp - 0x22c], di
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.100024b0
test eax, eax
je 0x10002d7d
push 0
push 0
push 0
push 0
push 0
mov eax, 0x3a
mov word [ebp - 0x10], di
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x434]
push 0x104
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0x104
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.10006250
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
lea eax, [ebp - 0x22c]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
call edi
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0xc], 0
call fcn.100024b0
test eax, eax
jne 0x10002a3e
push 0x104
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x22c]
push eax
call ebx
push 0x10016c28
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002d7d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x658]
push eax
push 0x10016c2c
call esi
test eax, eax
je 0x10002a0c
lea eax, [ebp - 0x658]
push eax
push 0x10016c30
call esi
test eax, eax
je 0x10002a0c
push 0x208
lea eax, [ebp - 0x434]
push 0
push eax
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x434]
push eax
call edi
lea ecx, [ebp - 0x434]
call fcn.10001fb0
test eax, eax
jne 0x10002a20
lea eax, [ebp - 0x684]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100029a2
jmp 0x10002a27
mov dword [ebp - 0xc], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0xc], 0
je 0x10002d7d
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10006250
mov bx, word [ebp - 0x686]
xor eax, eax
add esp, 0xc
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
mov word [ebp - 0x22c], bx
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x22c]
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200c
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.100024b0
test eax, eax
je 0x10002d7d
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10006250
xor eax, eax
mov word [ebp - 0x22c], bx
add esp, 0xc
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x22c]
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200f
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.100024b0
test eax, eax
je 0x10002d7d
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10006250
xor eax, eax
mov word [ebp - 0x22c], bx
add esp, 0xc
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x22c]
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200e
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.100024b0
test eax, eax
je 0x10002d7d
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10006250
xor eax, eax
mov word [ebp - 0x22c], bx
add esp, 0xc
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x22c]
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200e
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.10002590
test eax, eax
je 0x10002d7d
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10006250
xor eax, eax
mov word [ebp - 0x22c], bx
add esp, 0xc
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x22c]
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200f
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.10002590
test eax, eax
je 0x10002d7d
push pe_nt_image_headers32
lea eax, [ebp - 0x220]
mov dword [ebp - 0x68c], 1
push 0
push eax
call fcn.10006250
xor eax, eax
mov word [ebp - 0x22c], bx
add esp, 0xc
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22a], 0x5c003a
mov dword [ebp - 0x226], 0x5c200c
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200d
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x22c]
push eax
call esi
xor ecx, ecx
mov dword [ebp + eax*2 - 0x22c], 0x5c200c
mov word [ebp + eax*2 - 0x228], cx
lea ecx, [ebp - 0x22c]
call fcn.10002590
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x68c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10004cce
mov esp, ebp
pop ebp
ret 4