Function at 0x4887b0
Capabilities:
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualLock]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
push 0x802
mov eax, dword [ebx + 0x10]
push 0x576498
mov dword [0x5685fc], eax
call esi
push 0x48
push 0x58d388
call esi
push 0x70
push 0x57f7e0
call esi
push 0x5801a8
call fcn.00428bc0
add esp, 4
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
push 0x5200dc
push edi
mov dword [0x58d380], eax
call fcn.0042c560
add esp, 8
test eax, eax
je 0x488853
mov dword [0x568610], 1
call fcn.004cbb40
call fcn.004ba340
cmp word [0x57ec70], 0
je 0x488841
call fcn.004c4980
call fcn.004a4ee0
test eax, eax
je 0x488aa1
jmp 0x488ab3
push edi
mov ecx, ebx
call fcn.00483f20
call fcn.004cbb40
cmp word [0x57ec70], 0
je 0x48886f
call fcn.004c4980
call fcn.004ba340
push 0x5778e0
push dword [ebx + 0x10]
call fcn.0048ca60
add esp, 8
test eax, eax
jne 0x4888a1
call fcn.004ce1a0
test eax, eax
je 0x4888a1
push dword [ebx + 0x10]
push str.HOTKEY_REGISTRATION_ERROR
call fcn.00419c20
add esp, 8
push str.TaskbarCreated
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov esi, dword [ebx]
mov dword [ebx + 0x82c], eax
call sub.SHELL32.dll_IsUserAnAdmin
neg eax
mov ecx, ebx
sbb eax, eax
neg eax
push eax
push 8
call dword [esi + 0xb8]
push 1
push dword [ebx + 0x10]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
cmp dword [0x57f7c8], 0
jne 0x4888f7
push 0xe
call fcn.0041c0d0
add esp, 4
test eax, eax
je 0x4888f7
call fcn.004a9090
mov dword [ebx + 0x834], eax
mov edi, dword [ebx + 0x10]
push 0x526564
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x488927
push str.WTSRegisterSessionNotification
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x488920
push 0
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [0x57f7cc], 0
jne 0x488935
call fcn.0047b210
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0x6ac
call dword [eax + 0x8c]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x10]
call edi
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x10]
call edi
add dword [ebp - 0x14], 2
lea eax, [ebp - 0x14]
add dword [ebp - 0x10], 2
lea ecx, [ebx + 0x898]
sub dword [ebp - 0xc], 2
sub dword [ebp - 8], 2
push 0x6aa
push dword [ebx + 0x10]
push eax
push 0x50000000
call fcn.00407170
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0x6ad
call dword [eax + 0x8c]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x10]
call edi
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x10]
call edi
add dword [ebp - 0x14], 2
lea eax, [ebp - 0x14]
add dword [ebp - 0x10], 2
lea ecx, [ebx + 0x838]
sub dword [ebp - 0xc], 2
sub dword [ebp - 8], 2
push 0x6ab
push dword [ebx + 0x10]
push eax
push 0x50000000
call fcn.00407170
mov edi, dword [sym.imp.USER32.dll_GetMenu]
push 2
push dword [ebx + 0x10]
call edi
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
push 0
push 0x9cac
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
call fcn.00421530
test eax, eax
jne 0x488a28
push eax
push 0x9cb3
push dword [ebx + 0x10]
call edi
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
call fcn.004208d0
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x9c8f
push 3
push dword [ebx + 0x10]
call edi
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
call fcn.00420950
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x9cae
push 3
push dword [ebx + 0x10]
call edi
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
mov ecx, ebx
call fcn.0048a710
push 0
push 0x1f4
push 0xff
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 8
push dword [ebx + 0x10]
call fcn.00417c00
add esp, 4
push 1
call fcn.004f7120
push 0
call fcn.004f7120
int3