Function at 0x1033b35
Capabilities:
Delete file
Get disk information
Set file attributes

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077798
sub esp, 0x464
mov eax, dword [0x10de03c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x420], ebx
push dword [esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x43c], 0xdd7
mov dword [ebp - 0x438], ebx
call fcn.0102595b
test eax, eax
je 0x1034022
lea ecx, [ebp - 0x428]
call fcn.01075e60
push dword [esi]
mov dword [ebp - 4], ebx
call fcn.010337cd
push eax
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.010765c8
push eax
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call fcn.01075e30
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], bl
call fcn.01075e24
push 0x1004528
lea ecx, [ebp - 0x428]
call fcn.01076568
cmp eax, 0xffffffff
jne 0x1033fcd
push 0x1005af8
lea ecx, [ebp - 0x428]
call fcn.010765a4
cmp eax, 0xffffffff
jne 0x1033fcd
push 0x5c
lea ecx, [ebp - 0x428]
call fcn.01076364
cmp eax, 0xffffffff
je 0x1033fcd
lea ecx, [ebp - 0x42c]
call fcn.01075e60
push 0x5c
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 2
call fcn.01076238
inc eax
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x428]
call fcn.010765c8
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
call fcn.01075e30
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 2
call fcn.01075e24
lea ecx, [ebp - 0x42c]
call fcn.0107655c
lea ecx, [ebp - 0x42c]
call fcn.01076370
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 8], ebx
je 0x1033cb6
mov eax, dword [esi]
cmp dword [eax - 8], 0x1f4
jge 0x1033cb6
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x42c]
call fcn.01076220
mov eax, dword [eax]
push 0x1005af4
push eax
mov dword [ebp - 0x420], edi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
mov byte [ebp - 0x415], 1
jne 0x1033cbc
mov byte [ebp - 0x415], bl
test byte [ebp - 0x420], 1
je 0x1033cd0
lea ecx, [ebp - 0x414]
call fcn.01075e24
cmp byte [ebp - 0x415], bl
je 0x1033fb5
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1033e8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x1033d8f
push esi
lea ecx, [ebp - 0x424]
call fcn.010761cc
push 0x5c
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 4
call fcn.01076364
cmp eax, 0xffffffff
lea ecx, [ebp - 0x424]
je 0x1033d61
push 0x5c
call fcn.01076364
inc eax
push eax
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x424]
call fcn.01076220
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 5
call fcn.01075e30
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 4
call fcn.01075e24
jmp 0x1033d6b
push 0x1004204
call fcn.010761f0
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1033f23
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.01075e24
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1033f46
lea ecx, [ebp - 0x41c]
call fcn.01075e60
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 6
call fcn.01075e60
push dword [esi]
lea eax, [ebp - 0x410]
push eax
mov byte [ebp - 4], 7
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x410]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
add esp, 0x10
test eax, eax
je 0x1033f65
lea eax, [ebp - 0x410]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
push 0x2805
lea ecx, [ebp - 0x420]
mov word [eax], bx
call fcn.01075e90
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
call fcn.01075e84
add esp, 0xc
call fcn.01021462
cmp word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 2
je 0x1033e54
push 1
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x41c]
push 0x2806
call fcn.01054b83
cmp eax, 6
jne 0x1033f65
lea eax, [ebp - 0x410]
push eax
call fcn.01033add
test eax, eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 6
je 0x1033f6f
call fcn.01075e24
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 2
call fcn.01075e24
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x414], eax
je 0x1033cee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1033ec7
mov dword [ebp - 0x438], 1
mov edi, dword [ebp - 0x414]
cmp edi, 0xffffffff
je 0x1033fbf
lea eax, [ebp - 0x470]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1033f88
test byte [ebp - 0x470], 0x10
jne 0x1033f88
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push 0x2000
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x438], ebx
je 0x1033f1e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
jmp 0x1033f91
push dword [ebp - 0x424]
push 0xa8
call fcn.010815f2
pop ecx
pop ecx
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.01075e24
jmp 0x1033f8f
mov eax, dword [esi]
push ebx
push 0x80
push 4
push ebx
push ebx
push WaitForSingleObject
push eax
call edi
mov dword [ebp - 0x414], eax
jmp 0x1033ec7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x420]
call fcn.01075e24
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 2
call fcn.01075e24
jmp 0x1033ec7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], bl
call fcn.01075e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.01075e24
mov eax, esi
jmp 0x10340e2
mov dword [ebp - 0x43c], 0x80f7
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], bl
call fcn.01075e24
lea ecx, [ebp - 0x430]
call fcn.01075e60
push dword [esi]
lea eax, [ebp - 0x430]
push dword [ebp - 0x43c]
mov byte [ebp - 4], 8
push eax
call fcn.01076214
add esp, 0xc
push 1
push ebx
push 0x30
push ebx
push dword [ebp - 0x430]
push 0xfa6
call fcn.01054b83
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], bl
call fcn.01075e24
lea ecx, [ebp - 0x428]
jmp 0x10340d7
lea ecx, [ebp - 0x414]
call fcn.01075e60
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 9
call fcn.01075e60
push dword [esi]
mov byte [ebp - 4], 0xa
call fcn.010337cd
test eax, eax
je 0x103409f
push dword [esi]
call fcn.010337cd
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.01076220
push eax
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0xb
call fcn.01075e30
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0xa
call fcn.01075e24
push dword [ebp - 0x414]
lea eax, [ebp - 0x41c]
push 0xa7
push eax
call fcn.01076214
add esp, 0xc
jmp 0x10340ac
push 0x63
lea ecx, [ebp - 0x41c]
call fcn.01075e90
push 1
push ebx
push 0x30
push ebx
push dword [ebp - 0x41c]
push 0xfa6
call fcn.01054b83
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 9
call fcn.01075e24
lea ecx, [ebp - 0x414]
or dword [ebp - 4], 0xffffffff
call fcn.01075e24
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01075aef
leave
ret 4