Function at 0x10109730
Capabilities:
Delete directory
Delete file
Get disk information
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10135d8b
mov eax, dword fs:[0]
push eax
sub esp, 0xc40
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xc3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0xc54]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xc64]
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
xor ebx, ebx
mov esi, ecx
lea eax, [esp + 0x842]
xor ecx, ecx
xor edx, edx
push ebx
push eax
mov word [esp + 0x22], cx
mov word [esp + 0x848], dx
call fcn.10116880
push 0x208
lea edx, [esp + 0xa56]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xa5c], cx
call fcn.10116880
push 0x206
lea ecx, [esp + 0x242]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x248], ax
call fcn.10116880
push 0x206
lea eax, [esp + 0x65e]
xor edx, edx
push ebx
push eax
mov word [esp + 0x664], dx
call fcn.10116880
add esp, 0x30
cmp ebp, ebx
je 0x10109802
mov byte [ebp], bl
cmp esi, ebx
je 0x10109cda
movzx eax, word [esi]
cmp ax, bx
je 0x10109cda
movzx ecx, ax
push ecx
mov word [esp + 0x18], ax
call fcn.10110cf8
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x1c], ax
lea eax, [esp + 0x844]
push 0x104
push eax
call fcn.1011114c
lea eax, [esp + 0x84c]
add esp, 0x10
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x10109850
mov ecx, dword [0x10167cb8]
mov dx, word [0x10167cbc]
push 0x105
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 0xa48]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x858]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x101098b5
cmp ebp, ebx
je 0x10109cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_Getting_volumn_information__Immunize___Error_Code:__d
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x10109cec
xor eax, eax
jmp 0x101098c0
movzx ecx, word [esp + eax + 0x14]
mov word [esp + eax + 0x224], cx
add eax, 2
cmp cx, bx
jne 0x101098c0
lea edi, [esp + 0x224]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x101098e0
mov ecx, 7
mov esi, str.:_autorun.inf
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10109900
lea edi, [esp + 0x634]
sub eax, edx
add edi, 0xfffffffe
jmp 0x10109920
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x10109920
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x634]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x10109946
mov ecx, 7
mov esi, str.:_autorun_.inf
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x224]
push ebx
push edx
movsw word es:[edi], word [esi]
call fcn.10113404
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 8
cmp eax, 0xffffffff
je 0x101099d8
push 0x80
lea eax, [esp + 0x228]
push eax
call edi
lea ecx, [esp + 0x634]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x634]
push edx
lea eax, [esp + 0x228]
push eax
call fcn.1011341c
add esp, 8
test eax, eax
je 0x101099d8
cmp ebp, ebx
je 0x10109cec
call fcn.101124cd
mov ecx, dword [eax]
push ecx
push str.Error_in_Backing_up_Old_File__Error_Code:__d
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x10109cec
mov edx, str.NTFS
lea ecx, [esp + 0xa44]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x10109a0a
cmp ax, bx
je 0x10109a06
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x10109a0a
add ecx, 4
add edx, 4
cmp ax, bx
jne 0x101099e4
xor eax, eax
jmp 0x10109a0f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10109bb8
push 0x103
lea edx, [esp + 0x535]
push ebx
push edx
mov byte [esp + 0x53c], bl
call fcn.10116880
push 1
lea edx, [esp + 0x540]
lea ecx, [esp + 0x24]
call fcn.1010a660
add esp, 0x10
test eax, eax
je 0x10109b95
push 0x103
lea eax, [esp + 0x431]
push ebx
push eax
mov byte [esp + 0x438], bl
call fcn.10116880
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [esp + 0x42c]
lea ecx, [esp + 0x14]
call fcn.1010ad70
test eax, eax
je 0x10109b72
mov ecx, dword [str.._]
mov edx, dword [0x1014aa28]
mov ax, word [0x1014aa2c]
push 0x1fe
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x2a]
push 0
push ecx
mov dword [esp + 0x2c], edx
mov word [esp + 0x30], ax
call fcn.10116880
push str._n_Vaccine_Activated_Successfully
call fcn.1010de46
push 1
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push 0x104
push eax
call fcn.10111998
push 0xb
push str.:_found.000
lea ecx, [esp + 0x44]
push 0x104
push ecx
call fcn.10111998
add esp, 0x30
push 0x80
lea edx, [esp + 0x20]
push edx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x1c]
push eax
call esi
push 4
push str.._
lea ecx, [esp + 0x24]
push 0x104
push ecx
call fcn.101112c7
push 1
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push 0x104
push eax
call fcn.10111998
push 0xb
push str.:System_Volume_Information
lea ecx, [esp + 0x44]
push 0x104
push ecx
call fcn.10111998
add esp, 0x30
push 0x80
lea edx, [esp + 0x20]
push edx
call edi
lea eax, [esp + 0x1c]
push eax
call esi
mov eax, 1
jmp 0x10109cee
test ebp, ebp
je 0x10109cec
lea ecx, [esp + 0x42c]
push ecx
push str.Fix_Index_Using_ChkDsk_Failed._Immunize___s
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x10109cec
cmp ebp, ebx
je 0x10109cec
lea edx, [esp + 0x530]
push edx
push str.Vaccinate_NTFS_Drive_Failed._Immunize___s
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x10109cec
mov ecx, str.FAT32
lea eax, [esp + 0xa44]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10109bea
cmp dx, bx
je 0x10109be6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10109bea
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x10109bc4
xor eax, eax
jmp 0x10109bef
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10109cc3
push ebx
push 0xa0000000
push 2
push ebx
push 1
push 0x40000000
lea eax, [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10109c2e
cmp ebp, ebx
je 0x10109cec
push str.File_Creation_Failed:
jmp 0x10109ce3
push str._n_File_Created_Successfully:
call fcn.1010de46
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x103
lea ecx, [esp + 0x21]
push ebx
push ecx
mov byte [esp + 0x28], bl
call fcn.10116880
push 4
call fcn.1010ccc2
lea edx, [esp + 0x24]
push edx
mov esi, eax
push 2
push esi
call fcn.1011114c
add esp, 0x1c
push esi
lea esi, [esp + 0x1c]
call fcn.1000a570
push 1
lea esi, [esp + 0x20]
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc60], ebx
call fcn.1000a780
test eax, eax
jne 0x10109cb3
cmp ebp, ebx
je 0x10109ca8
mov eax, esi
push eax
push str.Vaccinate_FAT_Drive_Failed._Immunize___s
push ebp
call fcn.1010d6a8
add esp, 0xc
lea edi, [esp + 0x18]
call fcn.1000a5a0
jmp 0x10109cec
lea edi, [esp + 0x18]
call fcn.1000a5a0
mov eax, 1
jmp 0x10109cee
cmp ebp, ebx
je 0x10109cd5
push str.Unrecognized_File_System__Immunize_...
push ebp
call fcn.1010d6a8
add esp, 8
or eax, 0xffffffff
jmp 0x10109cee
cmp ebp, ebx
je 0x10109cec
push str.Invalid_Drive_Letter
push ebp
call fcn.1010d6a8
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0xc54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc3c]
xor ecx, esp
call fcn.1010d699
add esp, 0xc4c
ret 4