Function at 0x480930
Capabilities:
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualLock]
mov ebx, ecx
push edi
push 0x802
push 0x575118
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], ebx
mov dword [0x5685fc], eax
call esi
push 0x48
push 0x58d388
call esi
push 0x70
push 0x57f7e0
call esi
push dword [ebx + 0x10]
call fcn.004cd9a0
push 0x5801a8
call fcn.00428bc0
add esp, 8
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov esi, dword [ebp + 0xc]
push 0x5200dc
push esi
mov dword [0x58d380], eax
call fcn.0042c560
add esp, 8
test eax, eax
je 0x4809d2
mov dword [0x568610], 1
call fcn.004cbb40
call fcn.004ba340
cmp word [0x57ec70], 0
je 0x4809c0
call fcn.004c4980
call fcn.004a4ee0
test eax, eax
je 0x480c0d
jmp 0x480c1f
push esi
mov ecx, ebx
call fcn.0047be90
call fcn.004cbb40
cmp word [0x57ec70], 0
je 0x4809ee
call fcn.004c4980
call fcn.004ba340
cmp dword [0x57510c], 0
jne 0x480a03
mov ecx, ebx
call fcn.0047c0a0
push 0x5778e0
push dword [ebx + 0x10]
call fcn.0048ca60
add esp, 8
test eax, eax
jne 0x480a30
call fcn.004ce1a0
test eax, eax
je 0x480a30
push dword [ebx + 0x10]
push str.HOTKEY_REGISTRATION_ERROR
call fcn.00419c20
add esp, 8
mov esi, dword [ebx]
call sub.SHELL32.dll_IsUserAnAdmin
neg eax
mov ecx, ebx
sbb eax, eax
neg eax
push eax
push 8
call dword [esi + 0xb8]
push 1
push dword [ebx + 0x10]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov ecx, ebx
call fcn.0047e140
cmp dword [0x57f7c8], 0
jne 0x480a7c
push 0xe
call fcn.0041c0d0
add esp, 4
test eax, eax
je 0x480a7c
call fcn.004a9090
mov dword [ebx + 0x83c], eax
call fcn.004180b0
call fcn.00404580
mov eax, dword [ebx]
mov ecx, ebx
push 0
push 0x400
push 0x141
push 0x40a
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx]
mov ecx, ebx
push 0x40a
call dword [eax + 0x8c]
mov edi, eax
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push eax
push 0xffffffffffffffeb
push edi
call esi
push 0x47e430
push 0xfffffffffffffffc
push edi
call esi
xor eax, eax
mov ecx, ebx
cmp dword [0x559304], eax
sete al
push eax
mov eax, dword [ebx]
push 0x3ee
call dword [eax + 0x8c]
push eax
call fcn.00405b70
add esp, 8
push str.TaskbarCreated
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov edi, dword [ebx + 0x10]
push 0x526564
mov dword [ebx + 0x82c], eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x480b3d
push str.WTSRegisterSessionNotification
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x480b36
push 0
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [0x57f7cc], 0
jne 0x480b4b
call fcn.0047b210
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, eax
push 0
push 0x9cac
push 4
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov eax, dword [ebp - 4]
mov ecx, eax
push 0x40a
mov edx, dword [eax]
call dword [edx + 0x8c]
push 0x15
push 0
push ebx
mov dword [0x567324], eax
call edi
push eax
call edi
push 2
push ebx
mov dword [0x567320], eax
call edi
mov dword [0x57c0b4], eax
call fcn.004208d0
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x9c8f
push 5
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
call fcn.00420950
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x9cae
push 5
push ebx
call edi
push eax
call esi
call fcn.00418ac0
call fcn.00418e00
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.00482370
push 0
push 0x1f4
push 0xff
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebx + 0x10]
call fcn.00417c00
add esp, 4
push 1
call fcn.004f7120
push 0
call fcn.004f7120
int3