Function at 0x417b0b
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x2bc
mov eax, dword [ebp + 0x78]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x48], ebx
je 0x417b4c
mov dx, word [eax]
cmp dx, bx
je 0x417b4c
cmp word [eax + 2], 0x3a
jne 0x417b4c
mov cx, word [eax + 4]
cmp cx, bx
je 0x417b49
cmp cx, 0x5c
jne 0x417b4c
cmp word [eax + 6], bx
jne 0x417b4c
mov dword [ebp + 0x48], edx
push dword [ebp + 0x7c]
mov word [ebp + 0x60], 0xff
mov word [ebp + 0x62], 0x3a
mov word [ebp + 0x64], bx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 0x22]
add eax, 0x28
push eax
lea ecx, [ebp + 0x50]
call fcn.00433b18
mov eax, dword [ebp + 0x50]
push 0x10
pop ecx
mov dword [ebp + 0x68], eax
xor eax, eax
mov dword [ebp - 0x48], 0x44
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
or dword [ebp - 0x1c], 1
mov esi, str..D:
lea edi, [ebp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.ImDiskFormat
movsd dword es:[edi], dword [esi]
push ebx
push ebx
mov word [ebp - 0x18], bx
mov dword [ebp + 0x58], 8
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp + 0x48]
cmp si, bx
mov dword [ebp + 0x4c], eax
je 0x417bc5
mov word [ebp + 0x60], si
jmp 0x417bf1
push dword [ebp + 0x78]
call fcn.0040f51a
cmp eax, ebx
pop ecx
mov dword [ebp + 0x74], eax
jge 0x417be7
lea ecx, [ebp + 0x50]
call fcn.0042eb98
mov eax, dword [ebp + 0x74]
neg eax
jmp 0x417f13
call dword [0x4a6ec0]
mov word [ebp + 0x60], ax
push dword [ebp + 0x74]
lea eax, [ebp - 0x250]
push str.DeviceImDisk_u
push 0x103
push eax
call fcn.0047c148
add esp, 0x10
cmp word [ebp + 0x60], bx
je 0x417c2f
cmp si, bx
jne 0x417c3b
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp + 0x60]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x417c3b
mov dword [ebp + 0x58], 8
jmp 0x417eef
push str.format.com
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x68]
call esi
push 0x490120
push dword [ebp + 0x68]
call esi
mov edi, dword [ebp + 0x7c]
cmp word [edi], 0x22
jne 0x417c85
inc edi
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x417c85
lea eax, [edi + eax*2 - 2]
cmp word [eax], 0x22
jne 0x417c85
mov word [eax], bx
push edi
push dword [ebp + 0x68]
call esi
push 0x492520
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x417ca5
push 0x492514
push dword [ebp + 0x68]
call esi
push 0x492520
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x417cbf
push 0x492508
push dword [ebp + 0x68]
call esi
mov ax, word [ebp + 0x60]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [ebp + 0xc], ax
mov dword [ebp + 0x5c], 0x12b
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x417d9a
mov dword [ebp + 0x78], ebx
call edi
mov esi, eax
add esi, 0x64
call edi
mov ecx, esi
sub ecx, eax
cmp ecx, ebx
jle 0x417d8f
cmp byte [0x4a5290], bl
jle 0x417d8f
cmp ecx, ebx
jbe 0x417d7f
cmp ecx, 0x7d0
jbe 0x417d25
mov ecx, 0x3e8
jmp 0x417d2d
cmp ecx, 0x64
jbe 0x417d2d
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp + 0x40]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x417d7f
cmp dword [ebp + 0x78], ebx
jg 0x417d50
call edi
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x417d87
push 3
push ebx
push ebx
push ebx
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x417d87
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp + 0x78], ebx
jle 0x417d7f
dec dword [ebp + 0x78]
cmp byte [0x4a5290], bl
jg 0x417d41
mov dword [ebp + 0x78], ebx
jmp 0x417cfc
dec dword [ebp + 0x5c]
jns 0x417cd4
jmp 0x417da1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x44], 2
mov dword [ebp + 0x5c], 0x1d
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 0x68]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x417de4
push str.Cannot_format_drive:
call fcn.0040f433
dec dword [ebp + 0x44]
pop ecx
jns 0x417e1e
push 8
pop esi
jmp 0x417f09
push dword [ebp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x54], ebx
call esi
push 0xffffffffffffffff
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp + 0x54]
push dword [ebp + 0x30]
mov dword [ebp + 0x58], eax
call esi
cmp dword [ebp + 0x54], ebx
je 0x417ec4
mov dword [ebp + 0x78], ebx
call edi
mov esi, eax
add esi, 0x64
call edi
mov ecx, esi
sub ecx, eax
cmp ecx, ebx
jle 0x417ebb
cmp byte [0x4a5290], bl
jle 0x417ebb
cmp ecx, ebx
jbe 0x417eab
cmp ecx, 0x7d0
jbe 0x417e51
mov ecx, 0x3e8
jmp 0x417e59
cmp ecx, 0x64
jbe 0x417e59
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x417eab
cmp dword [ebp + 0x78], ebx
jg 0x417e7c
call edi
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x417eb3
push 3
push ebx
push ebx
push ebx
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x417eb3
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp + 0x78], ebx
jle 0x417eab
dec dword [ebp + 0x78]
cmp byte [0x4a5290], bl
jg 0x417e6d
mov dword [ebp + 0x78], ebx
jmp 0x417e28
dec dword [ebp + 0x5c]
jns 0x417daf
cmp word [ebp + 0x48], bx
jne 0x417edd
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp + 0x60]
push eax
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push ebx
push 0x10000
push ebx
push dword [ebp + 0x74]
call fcn.0040fecb
add esp, 0x10
cmp dword [ebp + 0x4c], ebx
je 0x417f06
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 0x58]
lea ecx, [ebp + 0x50]
call fcn.0042eb98
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret