Function at 0x100027c0
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
sub esp, 0x8dc
mov eax, dword [0x1001703c]
xor eax, esp
mov dword [esp + 0x8d8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x8e8]
push edi
push esi
push 0x10014e7c
mov ecx, 0x104
lea edi, [esp + 0x54]
call fcn.10001100
add esp, 8
mov edx, esi
call fcn.10004a00
mov ebx, eax
lea eax, [esp + 0x150]
mov ecx, eax
mov edi, 0x12c
sub edx, ecx
mov edi, edi
lea ecx, [edi + 0x7ffffed2]
test ecx, ecx
je 0x10002830
movzx ecx, word [edx + eax]
test cx, cx
je 0x10002830
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x10002810
jmp 0x10002834
test edi, edi
jne 0x10002837
sub eax, 2
xor edx, edx
mov word [eax], dx
lea ecx, [esp + 0x150]
xor eax, eax
push ecx
mov word [esp + 0x15a], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x10002b0d
push 0x10014e80
push ebx
mov eax, 4
call fcn.10004c40
add esp, 8
test eax, eax
jne 0x100028e7
push 0x10014e84
push ebx
mov eax, 4
call fcn.10004c40
add esp, 8
test eax, eax
jne 0x100028e7
push 0x10014e88
push ebx
mov eax, 4
call fcn.10004c40
add esp, 8
test eax, eax
jne 0x100028e7
push 0x10014e8c
push ebx
mov eax, 4
call fcn.10004c40
add esp, 8
test eax, eax
jne 0x100028e7
push 0x10014e90
push ebx
mov eax, 4
call fcn.10004c40
add esp, 8
test eax, eax
jne 0x100028e7
push 0x10014e94
push ebx
mov eax, 4
call fcn.10004c40
add esp, 8
test eax, eax
je 0x10002955
cmp dword [esp + 0x8f0], 0x265000
ja 0x10002955
push ebx
push str.New_Heur.FFD__S_
mov ecx, 0x12c
lea edi, [esp + 0x3b0]
call fcn.10001100
mov edx, edi
push edx
push 0x10014e78
mov ecx, 0x40
lea edi, [esp + 0x1c]
call fcn.10001100
mov eax, edi
push eax
push 0x10014e78
mov ecx, 0x40
mov edi, ebp
call fcn.10001100
add esp, 0x18
pop edi
pop ebp
mov eax, 0x25
pop ebx
mov ecx, dword [esp + 0x8d8]
xor ecx, esp
call fcn.1000536e
add esp, 0x8dc
ret
lea eax, [esp + 0x6dc]
mov ecx, esi
xor ebx, ebx
call fcn.10004a50
test eax, eax
je 0x10002996
xor ecx, ecx
lea edx, [esp + 0x6dc]
mov word [esp + 0x154], cx
push edx
lea eax, [esp + 0x154]
lea ecx, [ebx + 4]
call fcn.10004b70
add esp, 4
test eax, eax
je 0x10002996
mov ebx, 1
lea eax, [esp + 0x4d4]
mov ecx, esi
call fcn.10004ae0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x10002a0d
lea eax, [esp + 0x4d4]
push eax
call edi
cmp eax, 0xffffffff
je 0x10002a0d
test al, 6
je 0x10002a0d
push str.New_Heur.FFD_FakeDir_
push 0x10014e78
mov ecx, 0x40
lea edi, [esp + 0x14]
call fcn.10001100
mov ecx, edi
push ecx
push 0x10014e78
mov ecx, 0x40
mov edi, ebp
call fcn.10001100
add esp, 0x10
pop edi
pop ebp
mov eax, 0x25
pop ebx
mov ecx, dword [esp + 0x8d8]
xor ecx, esp
call fcn.1000536e
add esp, 0x8dc
ret
lea edx, [esp + 0x4c]
push str._recycle.
push edx
mov eax, 0x104
call fcn.10004870
add esp, 8
test eax, eax
jne 0x10002ac1
lea eax, [esp + 0x4c]
push 0x10014ed0
push eax
mov eax, 0x104
call fcn.10004870
add esp, 8
test eax, eax
jne 0x10002ac1
lea ecx, [esp + 0x4c]
push str.RECYCLER
push ecx
mov eax, 0x104
call fcn.10004870
add esp, 8
test eax, eax
jne 0x10002ac1
push esi
call edi
test ebx, ebx
je 0x10002b0d
test al, 6
je 0x10002b0d
push str.New_Heur.FFD_Hidden_root_
push 0x10014e78
mov ecx, 0x40
lea edi, [esp + 0x14]
call fcn.10001100
mov edx, edi
push edx
push 0x10014e78
mov ecx, 0x40
mov edi, ebp
call fcn.10001100
add esp, 0x10
pop edi
pop ebp
mov eax, 0x25
pop ebx
mov ecx, dword [esp + 0x8d8]
xor ecx, esp
call fcn.1000536e
add esp, 0x8dc
ret
push str.New_Heur.FFD_Recycler_
push 0x10014e78
mov ecx, 0x40
lea edi, [esp + 0x14]
call fcn.10001100
mov eax, edi
push eax
push 0x10014e78
mov ecx, 0x40
mov edi, ebp
call fcn.10001100
add esp, 0x10
pop edi
pop ebp
mov eax, 0x25
pop ebx
mov ecx, dword [esp + 0x8d8]
xor ecx, esp
call fcn.1000536e
add esp, 0x8dc
ret
mov ecx, dword [esp + 0x8e4]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1000536e
add esp, 0x8dc
ret