Function at 0x1010a030
Capabilities:
Delete file
Get disk information
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10135d0b
mov eax, dword fs:[0]
push eax
sub esp, 0xb3c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xb38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0xb50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xb60]
xor eax, eax
push 0x208
mov word [esp + 0x18], ax
xor ebx, ebx
mov esi, ecx
lea eax, [esp + 0x946]
xor ecx, ecx
xor edx, edx
push ebx
push eax
mov word [esp + 0x22], cx
mov word [esp + 0x94c], dx
call fcn.10116880
push 0x206
lea edx, [esp + 0x74a]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x750], cx
call fcn.10116880
push 0x206
lea ecx, [esp + 0x54e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x554], ax
call fcn.10116880
push 0x206
lea eax, [esp + 0x46]
xor edx, edx
push ebx
push eax
mov word [esp + 0x4c], dx
call fcn.10116880
add esp, 0x30
cmp ebp, ebx
je 0x1010a0fc
mov byte [ebp], bl
cmp esi, ebx
je 0x1010a51f
movzx eax, word [esi]
cmp ax, bx
je 0x1010a51f
movzx ecx, ax
push ecx
mov word [esp + 0x18], ax
call fcn.10110cf8
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x1c], ax
lea eax, [esp + 0x740]
push 0x104
push eax
call fcn.1011114c
lea eax, [esp + 0x748]
add esp, 0x10
add eax, 0xfffffffe
jmp 0x1010a150
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x1010a150
mov ecx, dword [0x10167cb8]
mov dx, word [0x10167cbc]
push 0x105
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 0x944]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x754]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1010a1b5
cmp ebp, ebx
je 0x1010a531
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_Getting_volumn_information__UnImmunize___Error_Code:__d
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x1010a531
lea eax, [esp + 0x14]
mov edx, eax
jmp 0x1010a1c0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1010a1c0
lea edi, [esp + 0x530]
sub eax, edx
add edi, 0xfffffffe
jmp 0x1010a1e0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1010a1e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x530]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x1010a206
mov ecx, 7
mov esi, str.:_autorun.inf
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1010a224
lea edi, [esp + 0x1c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x1010a240
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1010a240
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x1010a263
mov ecx, 7
mov esi, str.:_autorun_.inf
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, str.NTFS
lea eax, [esp + 0x940]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1010a2b6
cmp dx, bx
je 0x1010a2b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1010a2b6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1010a290
xor eax, eax
jmp 0x1010a2bb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1010a3e2
push 0x103
lea edx, [esp + 0x431]
push ebx
push edx
mov byte [esp + 0x438], bl
call fcn.10116880
push 2
lea edx, [esp + 0x43c]
lea ecx, [esp + 0x24]
call fcn.1010a660
add esp, 0x10
test eax, eax
je 0x1010a3bf
push 0x103
lea eax, [esp + 0x32d]
push ebx
push eax
mov byte [esp + 0x334], bl
call fcn.10116880
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [esp + 0x328]
lea ecx, [esp + 0x14]
call fcn.1010ad70
test eax, eax
je 0x1010a39c
push str._n_Vaccine_Deacivated_Successfully
call fcn.1010de46
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.10113404
add esp, 0xc
cmp eax, 0xffffffff
je 0x1010a392
push 0x80
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x530]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.1011341c
add esp, 8
test eax, eax
je 0x1010a392
call fcn.101124cd
mov edx, dword [eax]
push edx
push str.Error_in_Restoring_up_last_backup_File__Error_Code:__d
call fcn.1010e391
add esp, 8
mov eax, 1
jmp 0x1010a533
test ebp, ebp
je 0x1010a531
lea eax, [esp + 0x328]
push eax
push str.Fix_Index_Using_ChkDsk_Failed._UnImmunize___s
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x1010a531
cmp ebp, ebx
je 0x1010a531
lea ecx, [esp + 0x42c]
push ecx
push str.Vaccinate_NTFS_Drive_Failed._UnImmunize___s
push ebp
call fcn.1010d6a8
add esp, 0xc
jmp 0x1010a531
mov ecx, str.FAT32
lea eax, [esp + 0x940]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1010a416
cmp dx, bx
je 0x1010a412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1010a416
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1010a3f0
xor eax, eax
jmp 0x1010a41b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1010a508
push 0x103
lea edx, [esp + 0x229]
push ebx
push edx
mov byte [esp + 0x230], bl
call fcn.10116880
push 4
call fcn.1010ccc2
mov esi, eax
lea eax, [esp + 0x24]
push eax
push 2
push esi
call fcn.1011114c
add esp, 0x1c
push esi
lea esi, [esp + 0x1c]
call fcn.1000a570
push 2
lea esi, [esp + 0x228]
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb5c], ebx
call fcn.1000a780
test eax, eax
jne 0x1010a4a0
cmp ebp, ebx
je 0x1010a492
mov ecx, esi
push ecx
push str.Vaccinate_FAT_Drive_Failed._UnImmunize___s
push ebp
call fcn.1010d6a8
add esp, 0xc
lea edi, [esp + 0x18]
call fcn.1000a5a0
jmp 0x1010a531
lea edi, [esp + 0x18]
call fcn.1000a5a0
lea edx, [esp + 0x530]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.10113404
add esp, 8
cmp eax, 0xffffffff
je 0x1010a392
push 0x80
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x530]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.1011341c
add esp, 8
test eax, eax
je 0x1010a392
call fcn.101124cd
mov ecx, dword [eax]
push ecx
jmp 0x1010a385
cmp ebp, ebx
je 0x1010a51a
push str.Unrecognized_File_System__Immunize_...
push ebp
call fcn.1010d6a8
add esp, 8
or eax, 0xffffffff
jmp 0x1010a533
cmp ebp, ebx
je 0x1010a531
push str.Invalid_Drive_Letter
push ebp
call fcn.1010d6a8
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0xb50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb38]
xor ecx, esp
call fcn.1010d699
add esp, 0xb48
ret