Function at 0x1033b7b
Capabilities:
Delete file
Get disk information
Set file attributes

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077868
sub esp, 0x464
mov eax, dword [0x10de03c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x420], ebx
push dword [esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x43c], 0xdd7
mov dword [ebp - 0x438], ebx
call fcn.010259fb
test eax, eax
je 0x1034068
lea ecx, [ebp - 0x428]
call fcn.01075f2c
push dword [esi]
mov dword [ebp - 4], ebx
call fcn.0103386b
push eax
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.01076694
push eax
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call fcn.01075efc
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], bl
call fcn.01075ef0
push 0x1004528
lea ecx, [ebp - 0x428]
call fcn.01076634
cmp eax, 0xffffffff
jne 0x1034013
push 0x1005af8
lea ecx, [ebp - 0x428]
call fcn.01076670
cmp eax, 0xffffffff
jne 0x1034013
push 0x5c
lea ecx, [ebp - 0x428]
call fcn.01076430
cmp eax, 0xffffffff
je 0x1034013
lea ecx, [ebp - 0x42c]
call fcn.01075f2c
push 0x5c
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 2
call fcn.01076304
inc eax
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x428]
call fcn.01076694
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
call fcn.01075efc
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 2
call fcn.01075ef0
lea ecx, [ebp - 0x42c]
call fcn.01076628
lea ecx, [ebp - 0x42c]
call fcn.0107643c
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 8], ebx
je 0x1033cfc
mov eax, dword [esi]
cmp dword [eax - 8], 0x1f4
jge 0x1033cfc
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x42c]
call fcn.010762ec
mov eax, dword [eax]
push 0x1005af4
push eax
mov dword [ebp - 0x420], edi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
mov byte [ebp - 0x415], 1
jne 0x1033d02
mov byte [ebp - 0x415], bl
test byte [ebp - 0x420], 1
je 0x1033d16
lea ecx, [ebp - 0x414]
call fcn.01075ef0
cmp byte [ebp - 0x415], bl
je 0x1033ffb
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1033ed3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x1033dd5
push esi
lea ecx, [ebp - 0x424]
call fcn.01076298
push 0x5c
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 4
call fcn.01076430
cmp eax, 0xffffffff
lea ecx, [ebp - 0x424]
je 0x1033da7
push 0x5c
call fcn.01076430
inc eax
push eax
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x424]
call fcn.010762ec
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 5
call fcn.01075efc
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 4
call fcn.01075ef0
jmp 0x1033db1
push 0x1004204
call fcn.010762bc
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1033f69
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.01075ef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1033f8c
lea ecx, [ebp - 0x41c]
call fcn.01075f2c
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 6
call fcn.01075f2c
push dword [esi]
lea eax, [ebp - 0x410]
push eax
mov byte [ebp - 4], 7
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x410]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
add esp, 0x10
test eax, eax
je 0x1033fab
lea eax, [ebp - 0x410]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
push 0x2805
lea ecx, [ebp - 0x420]
mov word [eax], bx
call fcn.01075f5c
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
call fcn.01075f50
add esp, 0xc
call fcn.0102150d
cmp word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 2
je 0x1033e9a
push 1
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x41c]
push 0x2806
call fcn.01054b96
cmp eax, 6
jne 0x1033fab
lea eax, [ebp - 0x410]
push eax
call fcn.01086f68
test eax, eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 6
je 0x1033fb5
call fcn.01075ef0
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 2
call fcn.01075ef0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x414], eax
je 0x1033d34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1033f0d
mov dword [ebp - 0x438], 1
mov edi, dword [ebp - 0x414]
cmp edi, 0xffffffff
je 0x1034005
lea eax, [ebp - 0x470]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1033fce
test byte [ebp - 0x470], 0x10
jne 0x1033fce
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push 0x2000
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x438], ebx
je 0x1033f64
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
jmp 0x1033fd7
push dword [ebp - 0x424]
push 0xa8
call fcn.010816e4
pop ecx
pop ecx
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.01075ef0
jmp 0x1033fd5
mov eax, dword [esi]
push ebx
push 0x80
push 4
push ebx
push ebx
push WaitForSingleObject
push eax
call edi
mov dword [ebp - 0x414], eax
jmp 0x1033f0d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x420]
call fcn.01075ef0
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 2
call fcn.01075ef0
jmp 0x1033f0d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], bl
call fcn.01075ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.01075ef0
mov eax, esi
jmp 0x1034128
mov dword [ebp - 0x43c], 0x80f7
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], bl
call fcn.01075ef0
lea ecx, [ebp - 0x430]
call fcn.01075f2c
push dword [esi]
lea eax, [ebp - 0x430]
push dword [ebp - 0x43c]
mov byte [ebp - 4], 8
push eax
call fcn.010762e0
add esp, 0xc
push 1
push ebx
push 0x30
push ebx
push dword [ebp - 0x430]
push 0xfa6
call fcn.01054b96
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], bl
call fcn.01075ef0
lea ecx, [ebp - 0x428]
jmp 0x103411d
lea ecx, [ebp - 0x414]
call fcn.01075f2c
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 9
call fcn.01075f2c
push dword [esi]
mov byte [ebp - 4], 0xa
call fcn.0103386b
test eax, eax
je 0x10340e5
push dword [esi]
call fcn.0103386b
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.010762ec
push eax
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0xb
call fcn.01075efc
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0xa
call fcn.01075ef0
push dword [ebp - 0x414]
lea eax, [ebp - 0x41c]
push 0xa7
push eax
call fcn.010762e0
add esp, 0xc
jmp 0x10340f2
push 0x63
lea ecx, [ebp - 0x41c]
call fcn.01075f5c
push 1
push ebx
push 0x30
push ebx
push dword [ebp - 0x41c]
push 0xfa6
call fcn.01054b96
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 9
call fcn.01075ef0
lea ecx, [ebp - 0x414]
or dword [ebp - 4], 0xffffffff
call fcn.01075ef0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01075bbb
leave
ret 4