Function at 0x10026a76
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x12e0]
mov eax, 0x1360
call fcn.10049f60
mov eax, dword [0x1008bc20]
xor eax, ebp
mov dword [ebp + 0x12dc], eax
mov eax, dword [ebp + 0x12e8]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x12ec]
mov esi, 0x7ff
push esi
mov dword [ebp - 0x7c], eax
xor edi, edi
lea eax, [ebp + 0x8dd]
push edi
push eax
mov dword [ebp - 0x68], ecx
mov byte [ebp + 0x8dc], 0
call fcn.100457d0
push esi
lea eax, [ebp + 0xdd]
push edi
push eax
mov byte [ebp + 0xdc], 0
call fcn.100457d0
lea ebx, [esi + 1]
push ebx
lea eax, [ebp + 0x8dc]
push edi
push eax
call fcn.100457d0
add esp, 0x24
lea eax, [ebp + 0x10dc]
push eax
push 0x1ff
mov byte [ebp + 0x10dc], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x10026d0d
mov esi, 0x1006a0b8
lea edi, [ebp - 0x74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp + 0x10dc]
mov dword [ebp - 0x6c], eax
mov cl, byte [eax]
push eax
mov byte [ebp - 0x74], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x10026cb5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x8dc]
push ebx
push eax
call fcn.1004a640
push dword [ebp - 0x7c]
lea eax, [ebp + 0x8dc]
push ebx
push eax
call fcn.1004a5cc
mov eax, dword [ebp - 0x68]
add esp, 0x18
add eax, 0x140
push eax
lea eax, [ebp + 0x8dc]
push eax
call edi
mov dword [ebp - 0x70], eax
cmp eax, 0xffffffff
je 0x10026cb5
mov eax, dword [ebp - 0x68]
add eax, 0x140
test byte [eax], 0x10
je 0x10026c96
mov eax, dword [ebp - 0x68]
add eax, 0x16c
push 0x100686f8
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x10026c96
mov eax, dword [ebp - 0x68]
add eax, 0x16c
push 0x1006a0b4
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x10026c96
lea eax, [ebp + 0x8dc]
push eax
lea eax, [ebp + 0xdc]
push ebx
push eax
call fcn.1004a640
lea eax, [ebp + 0xdc]
push eax
call fcn.100465b0
lea ecx, [ebp + 0xdc]
dec ecx
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x68]
add eax, 0x16c
push eax
lea eax, [ebp + 0xdc]
push ebx
push eax
call fcn.1004a5cc
push 0x1006a0b0
lea eax, [ebp + 0xdc]
push ebx
push eax
call fcn.1004a5cc
add esp, 0x28
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0xdc]
push eax
call edi
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x10026c96
test byte [ebp - 0x64], 0x10
je 0x10026c80
lea eax, [ebp - 0x38]
push 0x100686f8
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x10026c80
lea eax, [ebp - 0x38]
push 0x1006a0b4
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x10026c80
push dword [ebp - 0x80]
lea eax, [ebp - 0x38]
push eax
call fcn.10046520
pop ecx
pop ecx
test eax, eax
jne 0x10026cce
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10026c40
push dword [ebp - 0x78]
call esi
mov eax, dword [ebp - 0x68]
add eax, 0x140
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10026b8a
push dword [ebp - 0x70]
call esi
mov eax, dword [ebp - 0x6c]
mov al, byte [eax]
inc dword [ebp - 0x6c]
test al, al
jne 0x10026cb5
mov eax, dword [ebp - 0x6c]
cmp byte [eax], 0
je 0x10026d0d
jmp 0x10026b33
lea eax, [ebp + 0x8dc]
push eax
call fcn.100465b0
lea ecx, [ebp + 0x8dc]
dec ecx
mov byte [eax + ecx], 0
lea eax, [ebp + 0x8dc]
push eax
mov eax, dword [ebp - 0x68]
add eax, 0x28c
push ebx
push eax
call fcn.1004a640
add esp, 0x10
push dword [ebp - 0x78]
call esi
push dword [ebp - 0x70]
call esi
xor eax, eax
inc eax
jmp 0x10026d0f
xor eax, eax
mov ecx, dword [ebp + 0x12dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045c30
add ebp, 0x12e0
leave
ret 8