Function at 0x10021753
Capabilities:
Check mutex on windows
Create thread
Get disk information

Disassembly:
mov eax, 0x10044e1c
call fcn.10033d28
sub esp, 0x4dc
mov eax, dword [0x1005392c]
push esi
mov dword [ebp - 0x10], eax
push 1
lea eax, [ebp - 0x4e8]
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10021a49
push ebx
xor ebx, ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x10021a48
push edi
push 0xc
pop edi
lea eax, [ebp - 0x4e8]
push str.Global
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c8], edi
call fcn.10001cde
push 0x10047dc4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.10001bb8
push str._lock_back
lea ecx, [ebp - 0x2c]
call fcn.10001bb8
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x100217f3
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x4cc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10021827
push dword [ebp - 0x4cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10021a3c
lea eax, [ebp - 0x4b4]
push eax
push ebx
push esi
push 0x1001fe1f
push ebx
push ebx
mov dword [ebp - 0x4b4], ebx
mov dword [ebp - 0x4bc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x4b8]
push eax
push edi
push ebx
push 0x10047c84
mov dword [ebp - 0x4b8], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0x4b8]
lea eax, [ebp - 0xac]
push str.Global_
push str._s_u
push eax
call fcn.10034fea
lea eax, [ebp - 0xac]
push eax
call fcn.100330a0
add esp, 0x14
test eax, eax
jne 0x100218d0
push 0x10047da4
push 0x10047da0
push str.rosof
push 0x10047d94
push 0x10047d90
push 0x10047d8c
push 0x10047d88
lea eax, [ebp - 0xac]
push str._s_s_s_s_s_s_s
push eax
call fcn.10034fea
add esp, 0x24
lea eax, [ebp - 0xac]
push eax
push ebx
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea ecx, [ebp - 0x4b0]
mov dword [esi + 0xc], eax
call fcn.10024ab4
xor eax, eax
mov byte [ebp - 0x4ac], bl
mov ecx, 0xff
lea edi, [ebp - 0x4ab]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x24
stosb byte es:[edi], al
lea eax, [ebp - 0x4ac]
push 0x10047ce0
push eax
mov byte [ebp - 4], 1
call fcn.10033130
add esp, 0xc
push 0x10047d24
push 0x24
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.10024ac4
push str.Global_
lea ecx, [ebp - 0x48]
call fcn.10001cde
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10001bb8
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x1002196a
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x64
push eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0xc]
push 0xffffffffffffffff
mov dword [esi + 0x10], eax
mov dword [ebp - 0x4d0], eax
push ebx
lea eax, [ebp - 0x4d4]
push eax
push 2
mov dword [ebp - 0x4d4], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
jne 0x100219de
push dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0xc]
call edi
push dword [esi + 0x14]
call edi
mov esi, dword [esi + 0x18]
cmp esi, ebx
je 0x10021a23
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10021a23
mov ecx, esi
call fcn.10021410
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x4b4]
push eax
push ebx
push esi
push 0x10021747
push ebx
push ebx
call edi
mov dword [esi + 4], eax
lea eax, [ebp - 0x4bc]
push eax
push ebx
push esi
push 0x10020202
push ebx
push ebx
call edi
mov ecx, esi
mov dword [esi + 8], eax
call fcn.10020c11
mov ecx, esi
call fcn.10020063
push ebx
lea ecx, [ebp - 0x48]
push 1
call fcn.1000151f
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], bl
call fcn.10024abd
push ebx
lea ecx, [ebp - 0x2c]
push 1
call fcn.1000151f
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.100341e0
leave
ret