Function at 0x57f180
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
sub esp, 0x240
mov eax, dword [0x8a3940]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x24c]
push esi
push edi
mov byte [ebp], 0
mov dword [ebp + 0x128], 0
mov dword [ebp + 0x12c], 0
call fcn.0047d480
mov esi, dword [ebp + 0x140]
xor eax, eax
test byte [ebp + 0x134], 8
mov dword [esp + 0x10], eax
je 0x57f2dc
cmp dword [esi + 0x258], eax
jne 0x57f2dc
xor ebx, ebx
mov dword [esi + 0x258], 1
mov eax, dword [ebp + 0x130]
xor edi, edi
mov dword [esp + 0x14], ebx
test eax, eax
je 0x57f259
cmp byte [eax], bl
je 0x57f259
push eax
call fcn.0057de10
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x57f228
cmp byte [ecx], bl
je 0x57f228
push ecx
call fcn.00579550
mov edi, eax
add esp, 4
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
test eax, eax
je 0x57f24d
mov cl, byte [eax]
test cl, cl
je 0x57f24d
cmp byte [eax + 1], bl
jne 0x57f23e
cmp cl, 0x5c
je 0x57f24d
push eax
call fcn.00493c60
add esp, 4
mov dword [esp + 0x14], eax
mov ebx, eax
push dword [esp + 0x18]
call fcn.004a6790
add esp, 4
push 0
push 0
push 0
push 0
push 0
push 0x108
lea eax, [esp + 0x54]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor ebx, ebx
test eax, eax
setne bl
mov dword [esp + 0x10], ebx
test eax, eax
je 0x57f2b6
push 0x107
lea eax, [esp + 0x40]
push ebp
push eax
call fcn.00493bf0
add esp, 0xc
test edi, edi
je 0x57f2b6
cmp byte [edi], 0
je 0x57f2b6
push edi
push ebp
call fcn.0057d5d0
add esp, 8
test eax, eax
jne 0x57f2b6
xor ebx, ebx
mov byte [ebp], al
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x57f2c7
push eax
call fcn.004a6790
add esp, 4
test edi, edi
je 0x57f2d4
push edi
call fcn.004a6790
add esp, 4
test ebx, ebx
jne 0x57f464
mov eax, dword [ebp + 0x134]
and al, 0x1e
cmp al, 8
je 0x57f464
cmp dword [ebp + 0x138], 0
je 0x57f424
push dword [ebp + 0x130]
call fcn.00493c60
mov edi, dword [ebp + 0x134]
mov ebx, eax
add esp, 4
mov dword [ebp + 0x138], 0
mov ecx, edi
mov eax, edi
and ecx, 0x20
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 2
and al, 2
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 1
and al, 1
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 4
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and al, 0x80
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x4000
and eax, 0x4000
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x100
and eax, 0x100
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x200
and eax, 0x200
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x400
and eax, 0x400
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x800
and eax, 0x800
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x1000
and eax, 0x1000
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x2000
and eax, 0x2000
cmove ecx, edx
mov eax, ecx
or eax, 0x8000
and edi, 0x8000
lea edi, [esi + 4]
push edi
cmove eax, ecx
push ebx
mov dword [esi + 0x254], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebx
mov dword [esi], eax
call fcn.004a6790
add esp, 4
cmp dword [esi], 0xffffffff
je 0x57f424
mov eax, dword [edi]
test al, 0x16
je 0x57f601
and eax, dword [esi + 0x254]
test al, 0x16
jne 0x57f601
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x57f464
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edi, [esi + 4]
push edi
push eax
call ebx
test eax, eax
je 0x57f464
nop dword [eax]
mov ecx, dword [edi]
test cl, 0x16
je 0x57f601
mov eax, dword [esi + 0x254]
and eax, ecx
test al, 0x16
jne 0x57f601
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x57f440
xor ebx, ebx
mov esi, dword [esp + 0x10]
push 0
push esi
call fcn.004edd70
xor edi, edi
add esp, 8
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
test esi, esi
je 0x57f5e1
mov ecx, ebx
mov byte [ebp + 0x107], 0
and ecx, 0x20
mov eax, ebx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 2
and al, 2
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 1
and al, 1
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 4
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and al, 0x80
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x4000
and eax, 0x4000
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x100
and eax, 0x100
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x200
and eax, 0x200
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x400
and eax, 0x400
push dword [esp + 0x10]
cmove edx, ecx
mov eax, ebx
mov ecx, edx
or ecx, 0x800
and eax, 0x800
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x1000
and eax, 0x1000
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x2000
and eax, 0x2000
cmove ecx, edx
mov eax, ecx
or eax, 0x8000
and ebx, 0x8000
mov ebx, dword [esp + 0x2c]
cmove eax, ecx
push ebx
push edi
mov dword [ebp + 0x124], eax
call fcn.00579de0
push dword [esp + 0x2c]
mov dword [ebp + 0x11c], eax
push dword [esp + 0x2c]
push dword [esp + 0x28]
push dword [esp + 0x30]
call fcn.0057a340
push dword [esp + 0x2c]
mov dword [ebp + 0x120], eax
push ebx
lea eax, [ebp + 0x108]
push edi
push eax
call fcn.0057a0e0
push dword [esp + 0x48]
lea ecx, [ebp + 0x111]
mov byte [ebp + 0x110], 0
push dword [esp + 0x44]
push dword [esp + 0x4c]
push str._02d:_02d:_02d
push 9
push ecx
call fcn.0057b8f0
add esp, 0x44
call fcn.0047d480
mov ecx, dword [esp + 0x24c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059bb21
add esp, 0x240
ret
push 0x107
lea eax, [esi + 0x30]
push ebp
push eax
call fcn.00493bf0
add esp, 0xc
test byte [edi], 0x10
je 0x57f62b
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
jmp 0x57f636
mov eax, dword [esi + 0x20]
xor ecx, ecx
add ecx, dword [esi + 0x24]
adc eax, 0
mov dword [ebp + 0x128], ecx
add esi, 0x18
mov dword [ebp + 0x12c], eax
mov eax, 1
mov ebx, dword [edi]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x57f466
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 1
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x57f466
movzx eax, word [esp + 0x2e]
movzx edi, word [esp + 0x2c]
mov dword [esp + 0x28], eax
movzx eax, word [esp + 0x32]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x34]
mov dword [esp + 0x18], eax
movzx eax, word [esp + 0x36]
mov dword [esp + 0x14], eax
movzx eax, word [esp + 0x38]
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x3a]
push 0
push 1
mov dword [esp + 0x28], eax
call fcn.004edd70
add esp, 8
mov esi, 1
jmp 0x57f497