Function at 0x401a3c
Capabilities:
Create process on windows
Delete file
Read .ini file

Disassembly:
sub esp, 0xe64
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xe5c], eax
push ebx
push ebp
mov eax, 0x41a
push esi
push edi
cmp ecx, eax
jg 0x401fb4
je 0x401d8e
lea ebx, [eax - 0x22]
cmp ecx, ebx
jg 0x401c71
je 0x401c3f
sub ecx, 0x3ef
je 0x401b92
sub ecx, 1
je 0x401b8b
sub ecx, 1
je 0x401b81
sub ecx, 1
je 0x401aba
sub ecx, 1
jne 0x40215b
push ecx
push 0x404864
push dword [0x4443bc]
push str.REMOVE_DISK
jmp 0x401bae
push 0x3ee
push dword [0x4443bc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
call edi
push 0x7fc
xor ebx, ebx
mov esi, eax
lea eax, [esp + 0x260]
mov dword [esp + 0x25c], ebx
push ebx
push eax
call fcn.00416380
add esp, 0xc
mov dword [esp + 0x50], ebx
lea eax, [esp + 0x54]
push 0x204
push ebx
push eax
call fcn.00416380
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call ebp
cmp eax, 0xffffffff
jne 0x401d98
mov edx, 0x435660
mov ecx, 0x4357bc
call fcn.00414a7a
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x258]
mov edx, 0x4357c4
push 0x30
push eax
mov ecx, 0x4355f8
call fcn.00414a7a
jmp 0x401fa2
mov edx, 0x435890
call fcn.00414a7a
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x30
mov edx, 0x435898
jmp 0x401f93
call fcn.00407e4b
jmp 0x40215b
push 8
jmp 0x402149
mov eax, dword [0x44497c]
cmp eax, 1
jne 0x401bbf
push 0
push 0x413ce2
push dword [0x4443bc]
push str.NAGSCREEN
push dword [0x4443c0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x40215b
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
xor ebx, ebx
cmp eax, 0xe7
jl 0x401bd5
cmp eax, 0xe9
jle 0x401bee
push ebx
push 0x413ce2
push dword [0x4443bc]
push str.NAGSCREEN
push dword [0x4443c0]
call esi
push ebx
push 0x4022ca
push dword [0x4443bc]
push str.IDD_NEW_CD
push dword [0x4443c0]
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0xb
push eax
push ebx
push 0x102b
push 0x3f7
push dword [0x4443bc]
mov dword [esp + 0x34], 3
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40215b
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push ebx
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
call fcn.004078ab
push 1
push ebx
push dword [0x4443bc]
call edi
push eax
call esi
jmp 0x40215b
sub ecx, 0x3f9
je 0x4020b6
sub ecx, 1
je 0x401cfd
sub ecx, 0x1d
je 0x401ca6
sub ecx, 1
je 0x401c9f
sub ecx, 1
jne 0x40215b
call fcn.00408026
jmp 0x40215b
push 0xa
jmp 0x402149
cmp dword [0x444978], 1
je 0x401b9c
mov eax, dword [0x44497c]
xor ebx, ebx
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 0xe7
jl 0x401cce
cmp eax, 0xe9
jle 0x401ce7
push ebx
push 0x413ce2
push dword [0x4443bc]
push str.NAGSCREEN
push dword [0x4443c0]
call esi
push ebx
push 0x406044
push dword [0x4443bc]
push str.IDD_NEW_VD
jmp 0x401bff
mov esi, 0x435738
lea edi, [esp + 0x50]
push 0xba
xor ebx, ebx
lea eax, [esp + 0x62]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00416380
add esp, 0xc
push 0x3f6
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call esi
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x1073
push edi
mov dword [esp + 0x3c], 0x64
call esi
push 0x5c
pop eax
push ecx
mov word [esp + 0x5c], ax
lea ecx, [esp + 0x58]
xor eax, eax
xor edx, edx
push str.properties
mov word [esp + 0x62], ax
call fcn.00414ac9
pop ecx
pop ecx
jmp 0x40215b
push 0x41c
jmp 0x401abf
lea ecx, [esp + 0x50]
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x1073
push esi
mov dword [esp + 0x2c], 3
call ebp
lea eax, [esp + 0x50]
mov ebp, 0x4355f8
push eax
mov edx, 0x4357cc
mov ecx, ebp
call fcn.00414a7a
push eax
push str._s_n_n_s
lea eax, [esp + 0x264]
push 0x3fc
push eax
call fcn.0040b4a0
add esp, 0x14
mov edx, 0x4357e4
mov ecx, str.FLDR
push 0x24
call fcn.00414a7a
push eax
lea eax, [esp + 0x260]
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40215b
push str.w__ccsUTF_8
mov esi, 0x443da0
lea eax, [esp + 0x14]
push esi
push eax
call fcn.004193e2
add esp, 0xc
test eax, eax
jne 0x40215b
cmp dword [esp + 0x10], ebx
je 0x40215b
lea eax, [esp + 0x50]
push eax
push str.select_vdisk_file__s__n
push dword [esp + 0x18]
call fcn.0040b450
add esp, 0xc
push str.detach_vdisk_n
push dword [esp + 0x14]
call fcn.0040b450
push dword [esp + 0x18]
call fcn.004194a0
add esp, 0xc
xor eax, eax
mov word [esp + 0xa58], ax
lea eax, [esp + 0xa5a]
push 0x40e
push ebx
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0xa58]
push esi
push str._s___s_
push 0x208
push eax
call fcn.0040b4a0
mov eax, dword [0x4443bc]
add esp, 0x10
mov dword [esp + 0x1c], eax
xorps xmm0, xmm0
lea eax, [esp + 0xa58]
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x28], eax
mov eax, dword [0x4443c0]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x440
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], str.diskpart.exe
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [esp + 0x4c], ebx
je 0x401f30
push 0xffffffffffffffff
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x3f6
push dword [0x4443bc]
call edi
push ebx
push ebx
push 0x1004
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
call fcn.004053de
push ebx
push ebx
push 0x1004
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebp
cmp esi, eax
jle 0x401b5c
mov edx, 0x435880
call fcn.00414a7a
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x40
mov edx, 0x435888
mov ecx, ebp
call fcn.00414a7a
push eax
lea eax, [esp + 0x260]
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40215b
mov eax, 0x425
cmp ecx, eax
jg 0x402094
je 0x40208a
sub ecx, 0x41b
je 0x40207e
sub ecx, 3
je 0x402003
sub ecx, 4
je 0x4020c0
sub ecx, 1
je 0x401ff9
sub ecx, 1
jne 0x40215b
call fcn.0040ae01
jmp 0x40215b
call fcn.0040ab2d
jmp 0x40215b
mov esi, 0x4441b0
xor ebx, ebx
push esi
push ebx
mov ebp, str.StartVirtual
mov edi, str.OPTIONS
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x402061
push esi
push 0x435730
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebx
push ebx
push 0xf0
push 0x427
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x40215b
call fcn.00408b2e
jmp 0x40215b
call fcn.00408b2e
push esi
push 0x435734
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.004089ce
jmp 0x40215b
push 0
push 0x404dd9
jmp 0x401aaa
call fcn.0040b024
jmp 0x40215b
sub ecx, 0x426
je 0x402147
sub ecx, 1
je 0x402105
sub ecx, 0x2321
je 0x4020c0
sub ecx, 1
jne 0x40215b
call fcn.004053de
jmp 0x40215b
cmp dword [0x444974], 1
je 0x401b9c
mov eax, dword [0x44497c]
cmp eax, 0xe7
jl 0x4020e0
cmp eax, 0xe9
jle 0x4020fe
push 0
push 0x413ce2
push dword [0x4443bc]
push str.NAGSCREEN
push dword [0x4443c0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.0040b19c
jmp 0x40215b
mov esi, 0x4441b0
xor ebx, ebx
push esi
push ebx
mov ebp, str.StartSubst
mov edi, str.OPTIONS
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x402061
push esi
push 0x435730
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebx
push ebx
push 0xf0
push 0x41e
jmp 0x40203c
push 0xc
push 0xf
push 0x443fa8
push dword [0x4443bc]
call fcn.00415653
mov ecx, dword [esp + 0xe6c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
inc eax
call fcn.00415746
add esp, 0xe64
ret