Function at 0x1002e2d
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x100c02c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
push esi
mov dword [ebp - 0x468], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + eax*2]
mov edi, ebx
sub edi, esi
sar edi, 1
cmp edi, 0xffc
mov dword [ebp - 0x46c], ebx
jae 0x10030aa
push 0x1001314
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x45c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x460], eax
je 0x1002f85
push 0x1001318
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1002f5e
push 0x100131c
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1002f5e
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, edi
cmp eax, 0x1000
jge 0x1002f5e
test byte [ebp - 0x45c], 0x10
jne 0x1002f5e
test byte [ebp - 0x45b], 0x40
je 0x1002f5e
lea eax, [ebp - 0x430]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp byte [0x100c071], 0
je 0x1002f17
push esi
push 0x18
call fcn.0100187f
jmp 0x1002f5c
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x464], eax
je 0x1002f4f
push esi
push 0x21
call fcn.0100187f
pop ecx
pop ecx
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002f5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.010019e8
pop ecx
pop ecx
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1002e9a
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0xffc
jae 0x10030aa
push 0x1001314
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x45c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x460], eax
je 0x10030aa
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x1001318
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
je 0x1003083
push 0x100131c
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
je 0x1003083
test byte [ebp - 0x45c], 0x10
je 0x1003083
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x1001310
call ebx
lea ecx, [ebp - 0x430]
push ecx
mov dword [ebp - 0x464], eax
call ebx
mov ecx, dword [ebp - 0x464]
add ecx, edi
add eax, ecx
cmp eax, 0x1000
jge 0x1003083
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1001310
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x1003077
push dword [ebp - 0x468]
lea eax, [ebp - 0x20c]
push eax
call fcn.01002d70
test eax, eax
jne 0x1003083
push dword [ebp - 0x468]
push esi
call fcn.01002e2d
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1002fba
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010058ab
leave
ret 8