Function at 0x10033860
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x898
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x894], eax
mov eax, dword [esp + 0x8a0]
mov edx, dword [esp + 0x8a8]
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
add ecx, 8
push ecx
push str.Win32_EncryptableVolume.DeviceID_s
mov dword [esp + 0x20], eax
lea eax, [esp + 0x6a0]
push 0x104
push eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.10003980
mov edi, dword [esp + 0x8b8]
lea eax, [esp + 0x4a0]
mov edx, edi
mov ecx, eax
add esp, 0x10
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x10033900
movzx ecx, word [edx + eax]
test cx, cx
je 0x10033900
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x100338e0
jmp 0x10033904
test esi, esi
jne 0x10033907
sub eax, 2
push str..BEK
push 0x104
lea edx, [esp + 0x498]
push edx
mov word [eax], 0
call fcn.10006750
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10033b2b
lea eax, [esp + 0x288]
mov esi, edi
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x10033973
movzx ecx, word [esi + eax]
test cx, cx
je 0x10033973
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10033953
jmp 0x10033977
test edx, edx
jne 0x1003397a
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x288]
lea esi, [esp + 0x64]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x100339b3
movzx ecx, word [esi + eax]
test cx, cx
je 0x100339b3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10033993
jmp 0x100339b7
test edx, edx
jne 0x100339ba
sub eax, 2
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov word [eax], 0
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x69c]
push edx
call eax
test eax, eax
jl 0x10033b24
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0xac]
push str.GetExternalKeyFromFile
call eax
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov esi, eax
test esi, esi
jl 0x10033a98
mov edx, dword [edx + 0x88]
lea eax, [esp + 0x288]
push eax
push str.PathWithFileName
call edx
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jl 0x10033a96
mov eax, dword [ecx]
mov eax, dword [eax + 0xb0]
lea edx, [esp + 0x10]
push edx
call eax
mov esi, eax
test esi, esi
jl 0x10033a92
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
lea eax, [esp + 0x20]
push eax
push str.ReturnValue
call edx
mov esi, eax
test esi, esi
jl 0x10033aa3
cmp dword [esp + 0x20], 0
je 0x10033ac2
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xb8]
call edx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0xb8]
call edx
lea eax, [esp + 0x38]
push eax
push ebp
call edi
test eax, eax
jne 0x100339c5
jmp 0x10033b24
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0xb8]
call eax
push esi
jmp 0x10033b1e
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0xb8]
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0xb8]
call eax
push esi
jmp 0x10033b1e
mov edx, dword [esp + 0x8b0]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x288]
push ecx
push edx
push eax
call fcn.10002030
mov esi, dword [esp + 0x24]
test esi, esi
mov dword [esp + 0x14], 1
je 0x10033b1c
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov edx, dword [edx + 0x54]
lea eax, [esp + 0x28]
push eax
push str.ExternalKey
call edx
test eax, eax
jne 0x10033b11
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x8a0]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1003c13d
add esp, 0x898
ret 0x10