Function at 0x405bb0
Capabilities:
Get disk information
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4b74
call fcn.0041ddb0
mov eax, dword [0x4527b8]
push ebx
push esi
push edi
mov dword [esp + 0x4b7c], eax
xor eax, eax
push eax
mov ecx, 0xd9d
lea edi, [esp + 0x104]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xcc]
push eax
mov eax, dword [0x4506d8]
push 0x3674
lea ecx, [esp + 0x10c]
push ecx
push 0x3674
mov edx, ecx
push edx
push 0x72004
push eax
mov dword [esp + 0x80], 0x43f3d4
mov dword [esp + 0x84], 0x43f3d0
mov dword [esp + 0x88], 0x43f3cc
mov dword [esp + 0x8c], 0x43f3c8
mov dword [esp + 0x90], 0x43f3c4
mov dword [esp + 0x94], 0x43f3c0
mov dword [esp + 0x98], 0x43f3bc
mov dword [esp + 0x9c], 0x43f3b8
mov dword [esp + 0xa0], 0x43f3b4
mov dword [esp + 0xa4], 0x43f3b0
mov dword [esp + 0xa8], 0x43f3ac
mov dword [esp + 0xac], 0x43f3a8
mov dword [esp + 0xb0], 0x43f3a4
mov dword [esp + 0xb4], 0x43f3a0
mov dword [esp + 0xb8], 0x43f39c
mov dword [esp + 0xbc], 0x43f398
mov dword [esp + 0xc0], 0x43f394
mov dword [esp + 0xc4], 0x43f390
mov dword [esp + 0xc8], 0x43f38c
mov dword [esp + 0xcc], 0x43f388
mov dword [esp + 0xd0], 0x43f384
mov dword [esp + 0xd4], 0x43f380
mov dword [esp + 0xd8], 0x43f37c
mov dword [esp + 0xdc], 0x43f378
mov dword [esp + 0xe0], 0x43f374
mov dword [esp + 0xe4], 0x43f370
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov ebx, dword [ebp + 8]
mov ecx, 0xd9d
lea esi, [esp + 0x100]
mov edi, 0x456898
rep movsd dword es:[edi], dword [esi]
jne 0x405d62
push ebx
call fcn.00411070
add esp, 4
mov dword [esp + 0x100], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
mov dword [esp + 0x5c], eax
mov dword [0x459f10], eax
jne 0x405d82
push str.DRIVELETTERS
call fcn.00410a40
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x405d99
push 0
push 0
push 0x1009
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x35e4]
lea edx, [esp + 0x514]
mov dword [esp + 0xc], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], 0x18
mov eax, dword [ebp + 0xc]
test eax, eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x20], 0
jle 0x405e24
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0xcc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xcc]
push eax
push 0
push 0x1005
push ebx
mov dword [esp + 0xdc], 4
mov dword [esp + 0xe0], esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x405e24
mov eax, dword [esp + 0xec]
shr eax, 0x10
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov eax, 1
shl eax, cl
test dword [esp + 0x100], eax
je 0x40608e
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x2c], esi
inc esi
test eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x44], 1
mov dword [esp + 0x18], esi
jle 0x405e73
cmp eax, dword [esp + 0x20]
jne 0x4061a8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040e020
mov esi, dword [esp + 0x14]
add esp, 4
mov ecx, 7
mov edi, str.Device
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x405ea8
mov eax, dword [esp + 0x10]
push eax
push 0x43f354
lea ecx, [esp + 0x3780]
push ecx
jmp 0x405ebd
mov edx, dword [esp + 0x10]
add edx, 4
push edx
push 0x43f354
lea eax, [esp + 0x3780]
push eax
call fcn.0041d3d4
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + esi + 0x74]
add edx, 0x41
movzx eax, dx
shl eax, 0x10
or eax, 1
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
mov dword [esp + 0x3c], ecx
jne 0x405f03
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x1007
push ebx
call edi
jmp 0x405f1c
lea edx, [esp + 0x28]
push edx
push 0
push 0x1006
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x28]
push edx
push 0
mov eax, 1
push 0x1006
lea ecx, [esp + 0x3784]
push ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x40], eax
call edi
lea eax, [esp + 0x4378]
push eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
call fcn.0040ecf0
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x4384]
push eax
push 2
push ecx
push ebx
call fcn.004108b0
mov edx, dword [esp + esi + 0x36c8]
push edx
lea eax, [esp + 0x3798]
push eax
call fcn.0040c470
add esp, 0x24
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x1006
push ebx
mov dword [esp + 0x40], 3
call edi
mov eax, dword [esp + esi + 0x3714]
cmp eax, 3
ja case.default.0x405fab
jmp dword [eax*4 + 0x4061f8]
push str.NORMAL
call fcn.00417ce0
add esp, 4
jmp 0x405ff3
push str.HIDDEN
call fcn.00417ce0
add esp, 4
jmp 0x405ff3
push str.OUTER
call fcn.00417ce0
add esp, 4
jmp 0x405ff3
push str.OUTER_VOL_WRITE_PREVENTED
call fcn.00417ce0
add esp, 4
jmp 0x405ff3
mov eax, 0x43f31c
mov edx, dword [esp + 0x2c]
push eax
push 4
push edx
push ebx
call fcn.004108b0
mov eax, dword [esp + esi + 0x3724]
add esp, 0x10
cmp eax, 3
jne 0x40607f
mov eax, dword [esi + 0x459f20]
test eax, eax
jne 0x4061a8
mov eax, dword [esp + 0xc]
add eax, 0x41
push eax
push str.DAMAGE_TO_HIDDEN_VOLUME_PREVENTED
mov dword [esi + 0x459f20], 1
call fcn.00417ce0
add esp, 4
push eax
lea ecx, [esp + 0x3b80]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.USER32.dll_GetParent]
add esp, 0xc
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x466b78]
push 0x30
push edx
lea eax, [esp + 0x3b80]
push eax
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4061a8
mov dword [esi + 0x459f20], 0
jmp 0x4061a8
mov edx, dword [esp + 0x5c]
test edx, eax
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x459f20], 0
jne 0x4061a8
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x4060c9
push ebx
call fcn.00404200
shr eax, 0x10
add esp, 4
cmp edi, eax
je 0x4060c9
inc esi
mov dword [esp + 0x18], esi
jmp 0x4061a8
mov edx, dword [esp + 0xc]
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax + 0x68]
add edx, 0x41
movzx eax, dx
shl eax, 0x10
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x2c], esi
inc esi
test eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x18], esi
mov dword [esp + 0x3c], ecx
jne 0x406126
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x1007
push ebx
call esi
jmp 0x40613f
lea edx, [esp + 0x28]
push edx
push 0
push 0x1006
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x1006
push ebx
mov dword [esp + 0x4c], 0x43e976
call esi
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x1006
push ebx
mov dword [esp + 0x40], 2
call esi
lea edx, [esp + 0x28]
push edx
push 0
push 0x1006
push ebx
mov dword [esp + 0x40], 3
call esi
lea eax, [esp + 0x28]
push eax
push 0
push 0x1006
push ebx
mov dword [esp + 0x40], 4
call esi
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edi
add esi, 0x208
add edx, 8
add ecx, 4
dec eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
jne 0x405dc7
mov ecx, dword [esp + 0x4b7c]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret