Function at 0x41c440
Capabilities:
Get disk information
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x124
push 0xffffffffffffffff
push 0x489f19
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x4b38b4]
xor eax, ebp
mov dword [ebp + 0x120], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x138]
xor ebx, ebx
mov ecx, 0x19
mov esi, 0x4b86d0
mov edi, 0x4b8800
mov edx, 1
rep movsd dword es:[edi], dword [esi]
mov dword [0x4b85d0], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], ebx
cmp dword [eax + 0x14], ebx
je 0x41c4bf
mov dword [0x4dc3bc], ebx
cmp dword [0x4dc3b8], ebx
je 0x41c4c5
mov dword [0x4dc3bc], edx
lea ecx, [ebp - 0x44]
call fcn.00419700
mov edi, dword [ebp + 0x12c]
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x41c507
push ebx
lea eax, [ebp - 0x44]
push 1
push eax
mov byte [ebp - 4], 1
call fcn.00405e10
add esp, 0xc
mov dword [ebp - 4], ebx
jmp 0x41c524
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x44]
cmp dword [eax + 0x14], ebx
je 0x41c51a
push eax
call fcn.00405d40
jmp 0x41c524
push 0x4b4d24
call fcn.004044a0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x78]
push edx
call fcn.004046e0
add esp, 8
mov eax, dword [ebp - 0x78]
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call edx
test al, al
je 0x41c9ce
jmp 0x41c550
mov eax, dword [ebp - 0x50]
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x15], bl
cmp eax, ebx
jne 0x41c569
call fcn.00469ad4
mov eax, dword [ebp - 0x50]
cmp eax, ebx
je 0x41c56d
mov ecx, dword [eax]
jmp 0x41c56f
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ecx + 0x10]
jb 0x41c57f
call fcn.00469ad4
mov eax, dword [ebp - 0x4c]
cmp byte [ebp - 0x73], bl
mov esi, eax
sete cl
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x73], cl
cmp cl, bl
je 0x41c9b0
add eax, 0x71
mov dword [ebp - 0x7c], eax
jmp 0x41c5a0
mov eax, dword [ebp - 0x7c]
cmp byte [eax], bl
jne 0x41c99b
cmp dword [ebp + 0x130], ebx
je 0x41c5bc
cmp byte [esi + 0x72], bl
je 0x41c99b
cmp dword [ebp + 0x134], ebx
je 0x41c5cd
cmp byte [esi + 0x70], bl
jne 0x41c99b
cmp dword [esi + 0x34], 0x10
jb 0x41c5d8
mov eax, dword [esi + 0x20]
jmp 0x41c5db
lea eax, [esi + 0x20]
movsx ecx, byte [eax]
push ecx
call fcn.0046b18a
sub eax, 0x41
add esp, 4
mov dword [ebp - 0x24], eax
cmp byte [esi + 0x75], bl
jne 0x41c604
cmp dword [ebp - 0x2c], ebx
jne 0x41c604
mov dword [0x4b8800], ebx
mov ecx, 1
jmp 0x41c60f
mov ecx, 1
mov dword [0x4b8800], ecx
movzx edx, byte [esi + 0x76]
mov dword [0x4b8804], edx
cmp byte [esi + 0x77], bl
je 0x41c62c
mov dword [0x4b8810], ecx
mov dword [0x4b8a68], ecx
jmp 0x41c638
mov dword [0x4b8810], ebx
mov dword [0x4b8a68], ebx
mov edx, ecx
mov ecx, eax
shl edx, cl
test dword [0x4b4f58], edx
jne 0x41c982
push 2
push 0x4905e8
lea ecx, [ebp - 0xb4]
mov dword [0x4dc3b4], edi
mov dword [ebp - 0x9c], 0xf
mov dword [ebp - 0xa0], ebx
mov byte [ebp - 0xb0], bl
call fcn.00402150
movzx eax, byte [ebp - 0x24]
add al, 0x41
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp]
mov byte [ebp - 4], 4
mov byte [ebp - 0x48], al
push eax
push edx
call fcn.00412f80
add esp, 0xc
cmp dword [ebp - 0x9c], 0x10
mov byte [ebp - 4], 6
jb 0x41c6b5
mov eax, dword [ebp - 0xb0]
push eax
call fcn.00469789
add esp, 4
push 0x103
lea ecx, [ebp + 0x1d]
push ebx
push ecx
mov dword [ebp - 0x9c], 0xf
mov dword [ebp - 0xa0], ebx
mov byte [ebp - 0xb0], bl
mov byte [ebp + 0x1c], bl
call fcn.0046a470
add esp, 0xc
cmp edi, ebx
je 0x41c71f
mov eax, dword [ebp + 4]
mov edi, 0x10
cmp dword [ebp + 0x18], edi
jae 0x41c6f4
lea eax, [ebp + 4]
push 0x104
lea edx, [ebp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x41c71c
mov eax, dword [ebp + 4]
cmp dword [ebp + 0x18], edi
jae 0x41c713
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
jmp 0x41c71f
mov byte [ebp + 0x1c], bl
movzx eax, byte [esi + 0x74]
mov edi, dword [0x4b89d8]
mov dword [0x4b89d8], eax
cmp dword [ebp + 0x12c], ebx
jne 0x41c787
cmp dword [ebp + 0x130], ebx
jne 0x41c787
cmp dword [ebp + 0x134], ebx
jne 0x41c787
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x14], ebx
je 0x41c787
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x41c787
mov edx, dword [0x4dc364]
mov eax, dword [0x4dc3d0]
push 0x4b8800
push 0x410130
push edx
push 0x1f8
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 2
jne 0x41c787
mov dword [ebp - 0x14], ebx
jmp 0x41c7c1
mov ecx, dword [ebp - 0x28]
mov esi, dword [0x4b8800]
call fcn.00401310
mov ecx, dword [ebp - 0x24]
mov edx, dword [0x4dc364]
push eax
call fcn.00418ba0
add esp, 4
test eax, eax
jne 0x41c7b0
mov dword [ebp - 0x14], ebx
jmp 0x41c7c1
cmp dword [ebp - 0x14], ebx
je 0x41c7c1
mov eax, dword [0x4b8800]
cmp eax, esi
je 0x41c7c1
mov dword [ebp - 0x2c], eax
mov dword [0x4b89d8], edi
cmp dword [ebp + 0x12c], ebx
je 0x41c81f
cmp byte [ebp + 0x1c], bl
je 0x41c81f
cmp dword [ebp - 0x14], ebx
je 0x41c808
call fcn.00432470
cmp eax, 0xffffffff
je 0x41c81f
mov ecx, dword [ebp + 4]
mov edx, 0x10
cmp dword [ebp + 0x18], edx
jae 0x41c7f3
lea ecx, [ebp + 4]
add al, 0x41
mov byte [ecx], al
mov eax, dword [ebp + 4]
cmp dword [ebp + 0x18], edx
jae 0x41c802
lea eax, [ebp + 4]
lea ecx, [ebp + 0x1c]
push ecx
jmp 0x41c818
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x41c814
lea eax, [ebp + 4]
lea edx, [ebp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov eax, dword [0x4dc364]
push ebx
push 0x3ef
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00414770
add esp, 8
mov dword [0x4dc3b4], ebx
cmp dword [0x4b8a34], ebx
je 0x41c951
cmp dword [0x4b8f14], ebx
je 0x41c951
mov edx, dword [0x4b118c]
push ebx
lea ecx, [ebp - 0xb8]
push ecx
push ebx
push ebx
push ebx
push ebx
push 0x222090
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x28
mov esi, 0xf
push str.The_filesystem_of_the_volume_mounted_as
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
call fcn.00402150
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0xf0]
push edx
mov byte [ebp - 4], 7
call fcn.00413020
push str.:_was_not_cleanly_dismounted_and_needs_to_be_checked_for_errors.
push eax
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 8
call fcn.00413670
add esp, 0x18
call fcn.004112a0
mov edi, 0x10
cmp dword [ebp - 0xbc], edi
jb 0x41c8f1
mov ecx, dword [ebp - 0xd0]
push ecx
call fcn.00469789
add esp, 4
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xc0], ebx
mov byte [ebp - 0xd0], bl
cmp dword [ebp - 0xd8], edi
jb 0x41c91a
mov edx, dword [ebp - 0xec]
push edx
call fcn.00469789
add esp, 4
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xdc], ebx
mov byte [ebp - 0xec], bl
cmp dword [ebp - 0x80], edi
jb 0x41c940
mov eax, dword [ebp - 0x94]
push eax
call fcn.00469789
add esp, 4
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
jmp 0x41c959
mov edi, 0x10
lea esi, [edi - 1]
mov byte [ebp - 4], 3
cmp dword [ebp + 0x18], edi
jb 0x41c96e
mov ecx, dword [ebp + 4]
push ecx
call fcn.00469789
add esp, 4
mov edi, dword [ebp + 0x12c]
mov dword [ebp + 0x18], esi
mov esi, dword [ebp - 0x28]
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
jmp 0x41c99b
cmp edi, ebx
jne 0x41c99b
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x14], ebx
je 0x41c99b
push str.DRIVE_LETTER_UNAVAILABLE
call fcn.00432fe0
add esp, 4
cmp byte [ebp - 0x73], bl
mov byte [ebp - 0x74], 1
sete al
mov byte [ebp - 0x73], al
cmp al, bl
jne 0x41c5a0
mov eax, dword [ebp - 0x78]
mov edx, dword [eax + 8]
lea ecx, [ebp - 0x78]
call edx
mov eax, dword [ebp - 0x78]
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x78]
call edx
test al, al
jne 0x41c550
mov esi, dword [ebp - 0x64]
cmp esi, ebx
je 0x41c9fa
mov edi, dword [ebp - 0x60]
cmp esi, edi
je 0x41c9f1
lea esp, [esp]
mov ecx, esi
call fcn.00401dc0
add esi, 0x78
cmp esi, edi
jne 0x41c9e0
mov esi, dword [ebp - 0x64]
push esi
call fcn.00469789
add esp, 4
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.00469789
mov edx, 0x4b85d0
mov ecx, 0x48
add esp, 4
mov dword [ebp - 0x78], vtable.TrueCrypt::ForEach::Container.0
mov dword [0x4dc3bc], ebx
mov esi, ecx
mov eax, edx
lea ebx, [ebx]
mov byte [eax], bl
inc eax
sub esi, 1
jne 0x41ca30
dec ecx
mov byte [edx], bl
inc edx
cmp ecx, ebx
jne 0x41ca38
cmp dword [ebp - 0x14], ebx
je 0x41ca52
cmp dword [0x4b8a24], ebx
je 0x41ca52
call fcn.00451fd0
mov esi, dword [ebp - 0x38]
cmp esi, ebx
je 0x41ca7a
mov edi, dword [ebp - 0x34]
cmp esi, edi
je 0x41ca71
mov ecx, esi
call fcn.00401dc0
add esi, 0x78
cmp esi, edi
jne 0x41ca60
mov esi, dword [ebp - 0x38]
push esi
call fcn.00469789
add esp, 4
mov ecx, dword [ebp - 0x44]
push ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.00469789
mov eax, dword [ebp - 0x14]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.00469f7b
add ebp, 0x124
mov esp, ebp
pop ebp
ret