Function at 0x442970
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x490d60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x80], ebx
call fcn.0043aa30
mov ebp, 6
cmp dword [eax + 0x1c], ebp
jl 0x442a4f
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x12
mov esi, 7
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.._sourcesmain.cpp
mov word [ecx + 4], ax
call fcn.0040faf0
mov byte [esp + 0x9c], 1
push 0x871
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 9
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.DeleteSFX
mov word [ecx + 4], dx
call fcn.0040faf0
mov byte [esp + 0xbc], 2
lea eax, [esp + 0x4f]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x64]
push ebp
mov byte [esp + 0x57], bl
mov dword [esp + 0x68], str.Deleting_SFX_archive
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x60], vtable.Nvidia::Logging::ChainLoggable_class_Nvidia::Logging::Chain_char_const_____21___class_Nvidia::Logging::Chain_struct_Nvidia::Logging::NullType__struct_Nvidia::Logging::NullType___.0
mov dword [esp + 0x64], edx
call fcn.0043aa30
mov byte [esp + 0xc4], bl
mov ecx, eax
call fcn.0043a8d0
mov eax, dword [esp + 0x88]
cmp word [eax + 2], 0x3a
jne 0x442f19
movzx ecx, word [eax + 4]
cmp cx, 0x5c
je 0x442a75
cmp cx, 0x2f
jne 0x442f19
mov cx, word [eax]
mov edx, 0x3a
mov word [esp + 0x2e], dx
mov word [esp + 0x2c], cx
lea edx, [esp + 0x2c]
mov eax, 0x5c
xor ecx, ecx
push edx
mov word [esp + 0x34], ax
mov word [esp + 0x36], cx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x442f19
lea ecx, [esp + 0x6c]
push str.7ZSfx_03x.cmd
push ecx
call fcn.0043abe0
add esp, 8
mov byte [esp + 0x80], 3
call fcn.0043aa30
cmp dword [eax + 0x1c], ebp
jl 0x442b92
mov edx, dword [esp + 0x6c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.._sourcesmain.cpp
mov dword [esp + 0x34], edx
call fcn.00413620
mov byte [esp + 0x9c], 4
push 0x881
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push str.DeleteSFX
call fcn.00413620
mov byte [esp + 0xbc], 5
lea eax, [esp + 0x4f]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x88]
lea edx, [esp + 0x50]
lea eax, [esp + 0x80]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x70], edx
push eax
lea ecx, [esp + 0x74]
lea edx, [esp + 0x7c]
push ebp
mov byte [esp + 0x57], bl
mov dword [esp + 0x68], str.Creating
mov dword [esp + 0x80], str.for_deletion_work
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], 0x497b74
mov dword [esp + 0x8c], edx
call fcn.0043aa30
mov byte [esp + 0xc4], 3
mov ecx, eax
call fcn.0043a8d0
mov ecx, dword [esp + 0x6c]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x442e7f
lea ecx, [esp + 0x60]
call fcn.00456260
mov byte [esp + 0x80], 6
push str.:Repeat_r_n
lea ecx, [esp + 0x64]
call fcn.00456860
push str.del__
lea ecx, [esp + 0x64]
call fcn.004568d0
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0x64]
call fcn.004563a0
push 0x498820
lea ecx, [esp + 0x64]
call fcn.004568d0
push str.if_exist__
lea ecx, [esp + 0x64]
call fcn.004568d0
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x64]
call fcn.004563a0
push str.__goto_Repeat_r_n
lea ecx, [esp + 0x64]
call fcn.004568d0
push str.del__
lea ecx, [esp + 0x64]
call fcn.004568d0
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x64]
call fcn.004563a0
push 0x498820
lea ecx, [esp + 0x64]
call fcn.004568d0
call fcn.0043aa30
cmp dword [eax + 0x1c], ebp
jl 0x442d13
mov edx, dword [esp + 0x60]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.._sourcesmain.cpp
mov dword [esp + 0x34], edx
call fcn.00413620
mov byte [esp + 0x9c], 7
push 0x88b
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push str.DeleteSFX
call fcn.00413620
mov byte [esp + 0xbc], 8
lea edx, [esp + 0x50]
mov dword [esp + 0x78], edx
lea eax, [esp + 0x4f]
lea ecx, [esp + 0x88]
lea edx, [esp + 0x70]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x84], ecx
push edx
lea eax, [esp + 0x84]
lea ecx, [esp + 0x7c]
push ebp
mov byte [esp + 0x57], bl
mov dword [esp + 0x88], str.Writing_contents_as
mov dword [esp + 0x84], eax
mov dword [esp + 0x78], vtable.Nvidia::Logging::ChainLoggable_class_Nvidia::Logging::Chain_wchar_t_const__const_const___class_Nvidia::Logging::Chain_char_const_____20___class_Nvidia::Logging::Chain_struct_Nvidia::Logging::NullType__struct_Nvidia::Logging::NullType____.0
mov dword [esp + 0x7c], ecx
call fcn.0043aa30
mov byte [esp + 0xc4], 6
mov ecx, eax
call fcn.0043a8d0
push 1
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.004042b0
add esp, 0xc
mov byte [esp + 0x80], 9
mov ecx, dword [esp + 0x64]
mov eax, dword [eax]
push ebx
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov byte [esp + 0x80], 6
mov edx, dword [esp + 0x54]
push edx
call fcn.0046f7da
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x442ebe
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x64]
jne 0x442ebe
mov ecx, dword [esp + 0x88]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.0043aa30
cmp dword [eax + 0x1c], ebp
jl 0x442e56
mov edx, dword [esp + 0x6c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push str.._sourcesmain.cpp
mov dword [esp + 0x34], edx
call fcn.00413620
mov byte [esp + 0x9c], 0xa
push 0x895
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push str.DeleteSFX
call fcn.00413620
mov byte [esp + 0xbc], 0xb
lea eax, [esp + 0x4f]
mov dword [esp + 0x94], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x7c], eax
lea ecx, [esp + 0x90]
lea edx, [esp + 0x50]
lea eax, [esp + 0x88]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x78], edx
push eax
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x74]
push ebp
mov byte [esp + 0x57], bl
mov dword [esp + 0x88], str.Executing
mov dword [esp + 0x78], str.for_deletion_work
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x90], 0x497b9c
mov dword [esp + 0x94], edx
call fcn.0043aa30
mov byte [esp + 0xc4], 6
mov ecx, eax
call fcn.0043a8d0
mov ecx, dword [esp + 0x6c]
push ebx
push ebx
push ebx
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0x80], 3
mov edx, dword [esp + 0x60]
push edx
call fcn.0046f7da
add esp, 4
mov byte [esp + 0x80], bl
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0046f7da
mov dword [esp + 0x84], 0xffffffff
mov edx, dword [esp + 0x8c]
push edx
call fcn.0046f7da
add esp, 8
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
mov eax, dword [esp + 0x6c]
push eax
call fcn.00404b00
mov byte [esp + 0x84], 3
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0046f7da
mov byte [esp + 0x88], bl
mov edx, dword [esp + 0x74]
push edx
call fcn.0046f7da
mov dword [esp + 0x8c], 0xffffffff
mov eax, dword [esp + 0x94]
push eax
call fcn.0046f7da
add esp, 0x10
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x88]
push eax
call fcn.0046f7da
mov ecx, dword [esp + 0x7c]
add esp, 4
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x74
ret