Function at 0x564aa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575db4
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d4e64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0x430
push 0
push 0x1036
push dword [edi + 0x698]
call ebx
push 0xffffffffffffffff
push 0x8c
push 0
push str.Drive
lea esi, [edi + 0x678]
push 0
mov ecx, esi
call fcn.0040cd7b
push 0xffffffffffffffff
push 0xa0
push 0
push str.Drive_Name
push 1
mov ecx, esi
call fcn.0040cd7b
push 0xffffffffffffffff
push 0x82
push 0
push str.Drive_Type
push 2
mov ecx, esi
call fcn.0040cd7b
push 0xffffffffffffffff
push 0x78
push 0
push str.File_System
push 3
mov ecx, esi
call fcn.0040cd7b
push 0xffffffffffffffff
push 0xb6
push 0
push str.Drive_Status
push 4
mov ecx, esi
call fcn.0040cd7b
mov ecx, esi
call fcn.00563900
push 1
push 0
mov ecx, esi
mov dword [edi + 0x78c], 1
mov dword [edi + 0x790], 1
mov dword [edi + 0x794], 1
mov dword [edi + 0x798], 1
mov dword [edi + 0x79c], 1
call fcn.00563650
mov ecx, esi
call fcn.0040deee
cmp dword [esi + 0x104], 0
mov ecx, eax
jne 0x564bd1
test ecx, ecx
je 0x564bb7
mov ecx, dword [ecx + 0x20]
push ecx
lea ecx, [esi + 0x80]
call fcn.00408b6e
test eax, eax
je 0x564bd1
mov dword [esi + 0x104], 1
push 0
mov ecx, esi
call fcn.0040bca8
push 1
mov ecx, esi
mov dword [esi + 0x100], 0x1c
call fcn.0040bca8
push 0x5adba8
push 0
push 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0x258
push 0
push 0
push 0
push 0xc
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
lea ecx, [edi + 0xac]
call fcn.0040eb0d
mov ecx, esi
call fcn.0040deee
mov edx, eax
lea eax, [edi + 0xac]
test eax, eax
jne 0x564c38
xor ecx, ecx
jmp 0x564c3b
mov ecx, dword [eax + 4]
push 1
push ecx
push 0x30
push dword [edx + 0x20]
call ebx
push 1
push 1
push 0x20
push 0x18
lea ecx, [edi + 0xc4]
push 0x18
call fcn.0040c97e
call fcn.00403835
push 0xa1
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0xffffffffffffffff
push dword [edi + 0xc8]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
lea eax, [edi + 0xc4]
test eax, eax
je 0x564c8a
mov eax, dword [eax + 4]
push eax
push 1
push 0x1003
push dword [edi + 0x698]
call ebx
push eax
call fcn.0040cad6
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x5a702b
push 0
push 3
mov ecx, esi
call fcn.0040cdd0
push 0x5adbb8
push 0
push 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0xd
lea esi, [edi + 0xb4]
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
mov ecx, esi
call fcn.0040eb0d
test esi, esi
jne 0x564cf6
xor eax, eax
jmp 0x564cf9
mov eax, dword [esi + 4]
push 1
push eax
push 0x30
push dword [edi + 0x11d0]
call ebx
test esi, esi
jne 0x564d0e
xor eax, eax
jmp 0x564d11
mov eax, dword [esi + 4]
push 1
push eax
push 0x30
push dword [edi + 0x1320]
call ebx
push ecx
mov ecx, esp
mov byte [edi + 0x1380], 1
push 0x5adbc8
mov dword [edi + 0x1598], 0xffffff
call fcn.00402f30
lea ecx, [edi + 0x11b0]
call fcn.005663f0
lea eax, [edi + 0x11b0]
mov byte [edi + 0x1238], 1
cmp byte [eax + 0x88], 0
je 0x564d73
push 0x3e9
push eax
push str.Get_More_Help_on_Windows_Drive_Hider
lea ecx, [eax + 0x98]
call fcn.0041888e
test esi, esi
jne 0x564d7b
xor eax, eax
jmp 0x564d7e
mov eax, dword [esi + 4]
push 1
push eax
push 0x30
push dword [edi + 0x15c0]
call ebx
push 0x5adc08
push 0
push 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0xe
lea esi, [edi + 0xbc]
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
mov ecx, esi
call fcn.0040eb0d
test esi, esi
jne 0x564dc9
xor eax, eax
jmp 0x564dcc
mov eax, dword [esi + 4]
push 1
push eax
push 0x30
push dword [edi + 0x1470]
call ebx
push ecx
mov ecx, esp
push str.https:__bit.ly_2VcgHcF
call fcn.00402f30
lea esi, [edi + 0x1450]
mov ecx, esi
call fcn.005663f0
mov byte [edi + 0x14d8], 1
mov dword [edi + 0x1598], 0xffffff
mov dword [edi + 0x1594], 0
cmp byte [esi + 0x88], 0
je 0x564e2d
push 0x3e9
push esi
push str.Click_here_to_get_the_New_Version_of_Windows_Drive_Hider
lea ecx, [esi + 0x98]
call fcn.0041888e
push str.Get_New_Version
mov ecx, esi
call fcn.0040bc57
push 1
mov ecx, esi
call fcn.0040bca8
push 0
push 0
push 0x258
push 0xc
push ecx
mov ecx, esp
push 0x5adc7c
call fcn.00402f30
lea esi, [edi + 0x3c0]
mov ecx, esi
call fcn.005680d0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x5a703d
call fcn.00402f30
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push str.Click_here_to_refresh_the_Drive_List_on_your_system...
call fcn.00402f30
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00567690
sub esp, 0x14
mov ecx, esi
call fcn.005678d0
push 6
push 0x8f
push 0x99
push ecx
push 0x8e
mov ecx, esi
mov dword [esi + 0x27c], 0
mov dword [esi + 0x280], 0xff
call fcn.00567f20
push 0
push 0
push 0x258
push 0xc
push ecx
mov ecx, esp
push 0x5adcc4
call fcn.00402f30
lea esi, [edi + 0x888]
mov ecx, esi
call fcn.005680d0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x5a703e
call fcn.00402f30
push ecx
mov ecx, esp
mov dword [ebp - 4], 1
push str.Hide_the_selected_Drive
call fcn.00402f30
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00567690
sub esp, 0x14
mov ecx, esi
call fcn.005678d0
push 4
push 0x90
push 0x9b
push ecx
push 0x8d
mov ecx, esi
mov dword [esi + 0x27c], 0
mov dword [esi + 0x280], 0xff
call fcn.00567f20
push 0
lea ecx, [edi + 0x15a0]
call fcn.0040bca8
push 0
mov ecx, esi
call fcn.0040b136
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret