Function at 0x4388d0
Capabilities:
Capture screenshot
Get disk size
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d7d5b
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x52ad60]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
mov eax, dword [0x52ad60]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [ebp + 8]
push dword [edi + 4]
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [0x52f408]
mov ebx, eax
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xd
jne 0x43894e
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [edi + 0x90]
mov esi, eax
push dword [edi + 0x94]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40cc0020
push 0
push 0
push ebx
push dword [edi + 0x90]
push dword [edi + 0x94]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [0x52f408]
mov eax, ecx
imul eax, ecx
cdq
mov esi, 0x18
idiv esi
cmp edx, 0xb
jne 0x438a3c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x34], eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x30], eax
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 0x28], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x20], eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
xor ebx, ebx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea esi, [esp + 0x65]
nop
mov eax, dword [0x52f408]
mov cl, al
sub cl, bl
mov edi, 1
mov ebx, 5
add esi, 6
inc edi
dec ebx
jne 0x438a23
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 6
jl 0x438a10
mov edi, dword [esp + 0x14]
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [edi + 0x90]
mov ebx, eax
push dword [edi + 0x94]
mov dword [esp + 0x18], ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [0x52f408]
mov esi, eax
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov dword [esp + 0x14], 0xd
idiv dword [esp + 0x14]
cmp edx, 0xb
jne 0x438ae0
movsd xmm3, qword [0x51a098]
movsd xmm6, qword [0x51a0c0]
movsd xmm5, qword [0x51a090]
movd xmm4, ecx
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
mov edi, edi
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x438aca
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x438ab0
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [edi + 0x94]
mov ecx, eax
xorps xmm0, xmm0
shl ecx, 5
add ecx, 0x1f
movq qword [esp + 0x40], xmm0
mov dword [esp + 0x40], eax
mov eax, dword [edi + 0x90]
sar ecx, 3
mov dword [esp + 0x44], eax
and ecx, 0xfffffffc
imul eax, ecx
push 0
push 0
movq qword [esp + 0x58], xmm0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x40]
push eax
push 0
lea eax, [esp + 0x4c]
push eax
movq qword [esp + 0x5c], xmm0
movq qword [esp + 0x6c], xmm0
push 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x54], 0x28
mov dword [esp + 0x60], 0x200001
mov dword [esp + 0x64], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ecx, dword [edi + 0x94]
imul ecx, dword [edi + 0x90]
shl ecx, 2
push ecx
push 0
push dword [esp + 0x40]
mov esi, eax
mov dword [esp + 0x24], esi
call fcn.004b84f0
add esp, 0xc
test esi, esi
je 0x438cef
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x38], 0
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov ebx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
push 3
push eax
mov dword [esp + 0x138], 0
call dword [sym.imp.gdiplus.dll_GdipSetSmoothingMode]
test eax, eax
cmovne ebx, eax
push 0x10
mov dword [esp + 0x28], ebx
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x438c28
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x34]
mov dword [esi + 4], 0
mov dword [esi], 0x516ef8
mov dword [esp + 0x40], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 4], eax
jmp 0x438c2a
xor esi, esi
mov eax, dword [0x52f408]
imul eax, eax
cdq
mov ecx, 0xa
idiv ecx
cmp edx, 7
jne 0x438c4f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test esi, esi
je 0x438ce1
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
jne 0x438cd9
push dword [edi + 0x90]
push dword [edi + 0x94]
push eax
push eax
push dword [esi + 4]
push dword [esp + 0x44]
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
push 0xcc0020
push 0
push 0
push dword [esp + 0x1c]
test eax, eax
push dword [edi + 0x90]
cmovne ebx, eax
push dword [edi + 0x94]
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.GDI32.dll_BitBlt]
mov edi, dword [esp + 0x10]
push edi
push dword [esp + 0x34]
call dword [sym.imp.gdiplus.dll_GdipReleaseDC]
push dword [esp + 0x14]
test eax, eax
cmovne ebx, eax
push edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [esp + 0x30]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.004b3a11
mov esp, ebp
pop ebp
ret 4