Function at 0x408e0f
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0xa74
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa6c], eax
push ebx
push ebp
push esi
push edi
push 0x3f6
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
push edi
push edi
mov ebx, eax
push 0x1004
push ebx
call ebp
mov dword [esp + 0x10], eax
mov esi, 0x206
xor eax, eax
push esi
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push edi
push eax
call fcn.00416380
add esp, 0xc
xor eax, eax
mov word [esp + 0x460], ax
lea eax, [esp + 0x462]
push esi
push edi
push eax
call fcn.00416380
add esp, 0xc
xor eax, eax
mov word [esp + 0x258], ax
lea eax, [esp + 0x25a]
push esi
push edi
push eax
call fcn.00416380
mov esi, edi
add esp, 0xc
cmp dword [esp + 0x10], esi
jle 0x4091ca
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x3c], 0x104
call ebp
mov edx, 0x436324
mov ecx, 0x435f1c
call fcn.00414a7a
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x408f13
mov edx, 0x4362cc
mov ecx, 0x435f1c
call fcn.00414a7a
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x408f14
inc esi
inc edi
cmp edi, dword [esp + 0x10]
jl 0x408eaf
test esi, esi
je 0x4091ca
push esi
mov edx, 0x4365b8
mov ecx, 0x4355f8
call fcn.00414a7a
push eax
lea eax, [esp + 0x260]
push 0x104
push eax
call fcn.0040b4a0
add esp, 0x10
mov edx, 0x4357e4
mov ecx, str.FLDR
push 0x24
call fcn.00414a7a
push eax
lea eax, [esp + 0x260]
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40920d
xor ecx, ecx
call fcn.00408dc7
mov esi, dword [esp + 0x10]
xor edi, edi
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x3c], 0x104
call ebp
mov edx, 0x436324
mov ecx, 0x435f1c
call fcn.00414a7a
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x408ffa
and dword [esp + 0x1c], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x3c], 0x104
call ebp
mov ecx, dword [esp + 0x54]
call fcn.00408bf7
jmp 0x40916c
mov edx, 0x4362cc
mov ecx, 0x435f1c
call fcn.00414a7a
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x40916c
lea eax, [esp + 0x460]
mov dword [esp + 0x1c], 5
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x3c], 0x104
call ebp
push str.w__ccsUTF_8
lea eax, [esp + 0x14]
push 0x443da0
push eax
call fcn.004193e2
add esp, 0xc
test eax, eax
jne 0x40916c
cmp dword [esp + 0x10], eax
je 0x40916c
lea eax, [esp + 0x460]
push eax
push str.select_vdisk_file__s__n
push dword [esp + 0x18]
call fcn.0040b450
add esp, 0xc
push str.detach_vdisk_n
push dword [esp + 0x14]
call fcn.0040b450
push dword [esp + 0x18]
call fcn.004194a0
add esp, 0xc
xor eax, eax
mov word [esp + 0x668], ax
push 0x40e
push eax
lea eax, [esp + 0x672]
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0x668]
push 0x443da0
push str._s___s_
push 0x208
push eax
call fcn.0040b4a0
mov eax, dword [0x4443bc]
add esp, 0x10
mov dword [esp + 0x1c], eax
xorps xmm0, xmm0
lea eax, [esp + 0x668]
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x28], eax
xor ecx, ecx
mov eax, dword [0x4443c0]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x440
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], str.diskpart.exe
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [esp + 0x4c], 0
je 0x409161
push 0xffffffffffffffff
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x443da0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, esi
jl 0x408f85
xor ecx, ecx
inc ecx
call fcn.00408dc7
call fcn.004053de
mov esi, 0x4355f8
mov edx, 0x4365c0
mov ecx, esi
call fcn.00414a7a
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x40
mov edx, 0x435888
mov ecx, esi
call fcn.00414a7a
push eax
lea ecx, [esp + 0x260]
push ecx
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
inc eax
jmp 0x40920f
mov esi, 0x4355f8
mov edx, 0x4365b0
mov ecx, esi
call fcn.00414a7a
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x30
mov edx, 0x4357e4
mov ecx, esi
call fcn.00414a7a
push eax
lea eax, [esp + 0x260]
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xa7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415746
add esp, 0xa74
ret