Function at 0x4292c0
Capabilities:
Get disk information
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a1895
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x4d4028]
xor eax, esp
mov dword [esp + 0x17c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x194]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call dword [0x4a2ef4]
xor ebx, ebx
push 0x426
mov ecx, esi
mov dword [esp + 0x1a0], ebx
call fcn.00490168
mov ecx, eax
call fcn.0049047a
test eax, eax
jne 0x4294ae
push 0x963
lea ecx, [esp + 0x18]
call dword [0x4a2eb8]
lea ecx, [esp + 0x24]
call dword [0x4a2ef4]
push 0x1c
lea eax, [esp + 0x78]
push eax
mov byte [esp + 0x1a4], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x4d6674
call esi
neg eax
sbb eax, eax
and eax, dword [esp + 0x78]
push 0x8fc
push eax
lea ecx, [esp + 0x2c]
call dword [0x4a2ec8]
lea ecx, [esp + 0x28]
call dword [0x4a2ef4]
push 0x1c
lea ecx, [esp + 0xb0]
push ecx
push 0x4d6674
mov byte [esp + 0x1a8], 3
call esi
neg eax
sbb eax, eax
and eax, dword [esp + 0xb0]
push 0x8fb
push eax
lea ecx, [esp + 0x30]
call dword [0x4a2ec8]
lea ecx, [esp + 0x2c]
call dword [0x4a2ef4]
push 0x1c
lea edx, [esp + 0x94]
push edx
push 0x4d6674
mov byte [esp + 0x1a8], 5
call esi
neg eax
sbb eax, eax
and eax, dword [esp + 0x94]
push 0x8e9
push eax
lea ecx, [esp + 0x34]
call dword [0x4a2ec8]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
mov ebx, 0x4a6a78
mov byte [esp + 0x1a0], 6
call fcn.0040ec10
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x48]
push edx
mov ecx, eax
mov byte [esp + 0x1a8], 7
call fcn.00402df0
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x58]
push edx
mov ecx, eax
mov byte [esp + 0x1b0], 8
call fcn.00402df0
add esp, 0x14
mov byte [esp + 0x19c], 9
push eax
lea ecx, [esp + 0x18]
call dword [0x4a2db0]
lea ecx, [esp + 0x48]
call dword [0x4a2ee8]
lea ecx, [esp + 0x40]
call dword [0x4a2ee8]
lea ecx, [esp + 0x30]
call dword [0x4a2ee8]
lea ecx, [esp + 0x2c]
call dword [0x4a2ee8]
lea ecx, [esp + 0x28]
call dword [0x4a2ee8]
lea ecx, [esp + 0x24]
mov byte [esp + 0x19c], 0
call dword [0x4a2ee8]
mov eax, dword [esp + 0x14]
push 0
push 0x30
push eax
call fcn.004900cc
jmp 0x4297e0
mov ecx, dword [esi + 0x2924]
push ecx
push str.ImportSession__device_s__n
mov eax, 0x80
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
call fcn.004900d8
mov ecx, dword [eax + 4]
call fcn.004900c0
lea ebp, [esi + 0x1e80]
mov byte [ebp + 0x2c], 0
mov dl, byte [ebp + 0x2e]
test dl, dl
mov dword [ebp + 0x1c], ebx
je 0x429555
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x68]
push eax
call edi
test eax, eax
je 0x42954c
lea esp, [esp]
cmp dword [esp + 0x5c], 0x12
je 0x42954c
lea ecx, [esp + 0x58]
push ecx
call ebx
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x68]
push eax
call edi
test eax, eax
jne 0x429520
mov cl, byte [ebp + 0x2e]
test cl, cl
jne 0x429500
xor ebx, ebx
mov dl, byte [esi + 0x1eac]
test dl, dl
je 0x429580
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [esi + 0x20]
call fcn.00461e18
push 0x1f4
call edi
mov al, byte [esi + 0x1eac]
test al, al
jne 0x429565
xor ebx, ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x19c], 0xb
mov eax, dword [esi + 0x2920]
mov edx, eax
mov ecx, eax
shr ecx, 0x18
shr edx, 0x10
push ebx
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], dl
push ebx
mov ecx, eax
lea edx, [esp + 0x3c]
mov byte [esp + 0x23], al
push edx
lea eax, [esp + 0x24]
shr ecx, 8
push eax
mov byte [esp + 0x2a], cl
call fcn.00462dd4
cmp dword [esp + 0x34], ebx
jne 0x4295f3
mov ecx, dword [esi + 0x2920]
push ecx
push str.Couldnt_get_instance_of_device_with_id__0x_x_n
mov eax, 0x80
mov ecx, 0x7f6050
call fcn.004012c0
add esp, 8
jmp 0x4297c2
lea ecx, [esp + 0x44]
call dword [0x4a2ef4]
lea ecx, [esp + 0x1c]
call dword [0x4a2ef4]
lea eax, [esi + 0x2924]
push eax
lea edx, [esp + 0x24]
push edx
mov edi, 0x4a6f18
mov byte [esp + 0x1a4], 0xd
call fcn.0040a1d0
add esp, 8
push 0x64
mov byte [esp + 0x1a0], 0xe
mov edi, dword [eax]
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x64]
push eax
push 0x104
push 0x104
lea ecx, [esp + 0x38]
call dword [0x4a2bd0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea ecx, [esp + 0x20]
mov byte [esp + 0x19c], 0xd
call dword [0x4a2ee8]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call dword [0x4a2bcc]
mov ecx, dword [esi + 0x1fec]
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x110a
push ecx
call ebx
test eax, eax
je 0x4296d9
mov edx, dword [esi + 0x1fec]
push 0
push 0
push 0x110a
push edx
call ebx
push eax
mov eax, dword [esi + 0x1fec]
push 9
push 0x110b
push eax
call ebx
call fcn.00425250
mov ecx, dword [esi + 0x1ef0]
push 0
push 0
push 0x1009
push ecx
call ebx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.idoc
mov dword [esi + 0x1fc0], 0x4291b0
call dword [0x4a2ed8]
lea edx, [esi + 0x1fcc]
push edx
push esi
push ecx
mov byte [esp + 0x1ac], 0xf
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call dword [0x4a2ec0]
push ebp
mov byte [esp + 0x1b0], 0xd
call fcn.00473133
call fcn.004900d8
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xa4]
push 1
call eax
push 1
push 0
push ecx
mov ecx, esp
lea eax, [esi + 0x2924]
mov dword [esp + 0x2c], esp
push eax
push ecx
mov edi, 0x4a6f18
call fcn.0040a1d0
add esp, 8
push ebp
call fcn.00476252
mov edx, dword [esi + 0x1fec]
push 0
push 0
push 0x110a
push edx
call ebx
push eax
mov eax, dword [esi + 0x1fec]
push 9
push 0x110b
push eax
call ebx
mov ecx, dword [esi + 0x1fec]
push 0
push 0
push 0x110a
push ecx
call ebx
mov edx, dword [esi + 0x1fec]
push eax
push 2
push 0x1102
push edx
call ebx
lea ecx, [esp + 0x1c]
mov byte [esi + 0x3288], 1
call dword [0x4a2ee8]
lea ecx, [esp + 0x44]
call dword [0x4a2ee8]
lea eax, [esp + 0x34]
mov byte [esp + 0x19c], 0xa
call fcn.00403bb0
mov byte [esp + 0x19c], 0
call fcn.004039a0
lea ecx, [esp + 0x14]
call dword [0x4a2ee8]
mov ecx, dword [esp + 0x194]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x17c]
xor ecx, esp
call fcn.00490f79
add esp, 0x18c
ret