Function at 0x1005e30
Capabilities:
Check if file exists
Delete registry key
Unmount volume via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
cmp dword [ebp + 0x14], 0
mov eax, dword [0x100457c]
mov cx, word [0x1004580]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push edi
mov dword [ebp - 0x10], eax
mov word [ebp - 0xc], cx
je 0x1005ea4
push 0x1004564
call dword [sym.imp.msvcrt.dll_puts]
mov edx, dword [ebp + 8]
add esp, 4
push edx
push 0
call sub.imdisk.cpl__ImDiskForceRemoveDevice_8
test eax, eax
jne 0x10063df
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1005e8a
mov eax, 0x1004558
push eax
call fcn.01005400
mov eax, 2
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x448
call fcn.010089f0
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 8], esp
jne 0x1005f3c
mov edi, dword [ebp + 8]
push 0xc0000000
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByNumber_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
push 0x80000000
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByNumber_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
push 0x80
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByNumber_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10061f1
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
push ecx
push 0x1004544
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
mov eax, 1
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005f41
sub eax, edx
sar eax, 1
cmp eax, 2
jne 0x1005f61
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x1005fba
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005f66
sub eax, edx
sar eax, 1
cmp eax, 3
jne 0x10060e7
mov ecx, 0x1003f64
lea eax, [ebx + 2]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005fac
test dx, dx
je 0x1005fa8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005fac
add eax, 4
add ecx, 4
test dx, dx
jne 0x1005f86
xor eax, eax
jmp 0x1005fb1
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
je 0x10060e7
mov eax, dword [0x1004538]
mov edx, dword [0x1004534]
mov ecx, dword [0x100453c]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebx]
mov dword [ebp - 0x20], edx
movzx edx, word [0x1004540]
mov dword [ebp - 0x18], ecx
mov cx, 0x5a
cmp cx, ax
mov word [ebp - 0x14], dx
sbb edx, edx
add edx, 1
cmp ax, 0x41
mov word [ebp - 0x18], ax
sbb eax, eax
add eax, 1
test eax, edx
je 0x100607e
xor eax, eax
push 0x1004518
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.msvcrt.dll_puts]
movzx ecx, word [ebx]
add esp, 4
lea eax, [ebp + 8]
push eax
push 0xfa0
sub ecx, 0x41
push 3
mov edx, 1
shl edx, cl
lea ecx, [ebp - 0x34]
push ecx
push 0x8001
push 0x219
push 0xffff
mov dword [ebp - 0x28], edx
call esi
lea edx, [ebp + 8]
push edx
push 0xfa0
push 3
lea eax, [ebp - 0x34]
push eax
push 0x8003
push 0x219
push 0xffff
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x20]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
push 0
push 0x20000000
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0x20]
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
push 0
push 0x20000000
push 3
push 0
push 3
push 0x80
lea eax, [ebp - 0x20]
push eax
call edi
jmp 0x1005ef6
push 0xc0000000
push ebx
call sub.imdisk.cpl__ImDiskOpenDeviceByMountPoint_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
push 0x80000000
push ebx
call sub.imdisk.cpl__ImDiskOpenDeviceByMountPoint_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
push 0x80
push ebx
call sub.imdisk.cpl__ImDiskOpenDeviceByMountPoint_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x100620f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
ja 0x100619e
je 0x10061c6
sub eax, 1
je 0x1006172
sub eax, 0x56
jne 0x10061ac
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
push ecx
push 0x1003e38
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
mov eax, 9
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
push edx
push 0x1003da4
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
mov eax, 9
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x10b
je 0x10061c6
cmp eax, 0x1126
je 0x10061c6
push ebx
call fcn.01005400
mov eax, 9
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
add eax, 0x40
push 0x10044f8
push eax
call fcn.01005380
add esp, 0xc
mov eax, 9
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x1003bd4
call fcn.01005400
mov eax, 2
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call fcn.01005470
test eax, eax
jne 0x1006234
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 5
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea edx, [ebp + 0x14]
push edx
push 0x448
push eax
push 0
push 0
push 0x83722008
push esi
call edi
test eax, eax
jne 0x100628b
push ebx
call fcn.01005400
mov ecx, dword [sym.imp.msvcrt.dll__iob]
push ebx
add ecx, 0x40
push 0x10044c8
push ecx
call fcn.01005380
add esp, 0xc
mov eax, 2
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 0x36
jae 0x10062bd
mov edx, dword [sym.imp.msvcrt.dll__iob]
push ebx
add edx, 0x40
push 0x10044c8
push edx
call fcn.01005380
add esp, 0xc
mov eax, 2
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x2c]
xor ecx, ecx
test ax, ax
setne cl
xor edx, edx
test ebx, ebx
sete dl
test edx, ecx
je 0x10062e1
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov ebx, dword [sym.imp.msvcrt.dll_puts]
push 0x10044ac
call ebx
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x1004498
call ebx
add esp, 4
push 0
lea ecx, [ebp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0x90018
push esi
call edi
test eax, eax
jne 0x100635d
cmp dword [ebp + 0x10], eax
je 0x1005e7e
push 0x100447c
call ebx
add esp, 4
push 0
lea edx, [ebp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0x90020
push esi
call edi
push 0
lea eax, [ebp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push esi
call edi
jmp 0x1006385
push 0x1004460
call ebx
add esp, 4
push 0
lea ecx, [ebp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0x90020
push esi
call edi
test eax, eax
je 0x1005e7e
push 0x100444c
call ebx
add esp, 4
push 0
lea edx, [ebp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0x2d4808
push esi
call edi
test eax, eax
jne 0x10063c2
cmp dword [ebp + 0x10], eax
je 0x10063c2
push eax
push esi
call sub.imdisk.cpl__ImDiskForceRemoveDevice_8
neg eax
sbb eax, eax
add eax, 1
jne 0x1005e7e
push 0
lea eax, [ebp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10065b5
push 0x1004434
call dword [sym.imp.msvcrt.dll_puts]
mov eax, ebx
add esp, 4
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006400
sub eax, edx
sar eax, 1
cmp eax, 2
jne 0x1006420
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x1006479
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006425
sub eax, edx
sar eax, 1
cmp eax, 3
jne 0x100652d
mov ecx, 0x1003f64
lea eax, [ebx + 2]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100646b
test dx, dx
je 0x1006467
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100646b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006445
xor eax, eax
jmp 0x1006470
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
je 0x100652d
mov edx, dword [0x100457c]
mov ax, word [0x1004580]
mov ecx, 0x20
mov esi, 0x10043b0
lea edi, [ebp - 0xb8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 8], edx
push 0
lea edx, [ebp - 8]
mov ecx, 0x21
mov esi, 0x1004328
lea edi, [ebp - 0x13c]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebx]
push edx
push 2
mov word [ebp - 4], ax
mov word [ebp - 8], cx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x10064d9
push ebx
call fcn.01005400
movzx eax, word [ebx]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov word [ebp - 0x3a], ax
mov word [ebp - 0xbc], ax
lea eax, [ebp - 0xb8]
push eax
push 0x80000001
call esi
lea ecx, [ebp - 0x13c]
push ecx
push 0x80000001
call esi
lea edx, [ebp + 0xc]
push edx
push 0xfa0
push 3
push 0
push 7
push 0x219
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x10065b5
push ebx
call sub.imdisk.cpl__ImDiskRemoveMountPoint_4
test eax, eax
jne 0x10065b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
ja 0x1006587
je 0x100659d
sub eax, 1
je 0x100656d
sub eax, 0x56
jne 0x1006595
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x1003e38
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
jmp 0x10065b5
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
push ecx
push 0x10042e0
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
jmp 0x10065b5
cmp eax, 0x10b
je 0x100659d
cmp eax, 0x1126
je 0x100659d
push ebx
call fcn.01005400
jmp 0x10065b5
mov edx, dword [sym.imp.msvcrt.dll__iob]
push ebx
add edx, 0x40
push 0x10044f8
push edx
call fcn.01005380
add esp, 0xc
push 0x10042d8
call dword [sym.imp.msvcrt.dll_puts]
add esp, 4
xor eax, eax
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10