Function at 0x4128fe
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x70]
mov ecx, dword [0x4fd5c4]
sub esp, 0x528
push ebx
xor ebx, ebx
cmp ecx, ebx
je 0x413515
push esi
mov esi, dword [ebp + 0x78]
push esi
call fcn.004011ae
test eax, eax
je 0x413514
mov ecx, dword [0x4fd5c4]
push esi
call fcn.004047f1
push str.DDI_1
push 3
call fcn.00445f0b
push str._r_n_________Device_Information__r_n
call fcn.0040d20e
lea eax, [esi + 0x1734]
add esp, 0xc
cmp word [eax], bx
je 0x412969
push eax
push str.Friendly_Name____________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
lea eax, [esi + 0x1834]
cmp word [eax], bx
je 0x412981
push eax
push str.Device_Description_______:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
push edi
push esi
call fcn.00411ddd
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [esi + 0x3a2c], ebx
je 0x412a3b
cmp dword [esi + 0x3a20], 0xffffffff
jle 0x412a3b
xor eax, eax
push 0x7e
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x36]
push ebx
push eax
call fcn.0043fd94
mov eax, dword [esi + 0x3a24]
add esp, 0xc
cmp eax, 1
jne 0x4129d4
push dword [esi + 0x3a20]
push str..PhysicalDrive_i
jmp 0x4129f6
cmp eax, 2
jne 0x4129e6
push dword [esi + 0x3a20]
push str..CdRom_i
jmp 0x4129f6
cmp eax, 3
jne 0x4129ff
push dword [esi + 0x3a20]
push str..Floppy_i
lea eax, [ebp - 0x38]
push eax
call edi
add esp, 0xc
push 0x104
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x412a3b
lea eax, [ebp - 0x38]
push eax
push str.Win32_Name_______________:__s_r_n
call fcn.0040d261
lea eax, [ebp - 0x2c0]
push eax
push str.Kernel_Name______________:__s_r_n
call fcn.0040d261
add esp, 0x10
lea edi, [esi + 0xe34]
push edi
push str.Device_ID________________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
push str.PCIVEN_
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x412a64
push edi
call fcn.0041a116
lea edi, [esi + 0x32f8]
cmp dword [edi], ebx
je 0x412a9b
push str.Hardware_IDs_____________:
call fcn.0040d20e
jmp 0x412a89
push eax
push 0x454a00
call fcn.0040d261
pop ecx
add edi, 4
mov eax, dword [edi]
pop ecx
cmp eax, ebx
jne 0x412a7a
push 0x44e77c
call fcn.0040d20e
pop ecx
push str.DDI_2
push 3
call fcn.00445f0b
lea eax, [esi + 0x1c34]
pop ecx
pop ecx
mov edi, eax
cmp word [eax], bx
jne 0x412abb
mov edi, 0x44acfc
push eax
call fcn.004108af
push eax
push edi
push str.Driver_KeyName___________:__s_s
call fcn.0040d261
mov edi, 0x44e77c
push edi
call fcn.0040d20e
lea eax, [esi + 0x33f4]
add esp, 0x10
cmp word [eax], bx
je 0x412b09
lea ecx, [esi + 0x3864]
push ecx
lea ecx, [esi + 0x3844]
push ecx
lea ecx, [esi + 0x3804]
push ecx
push eax
push str.Driver___________________:__s__Version:__s__Date:__s__Company:__s__r_n
call fcn.0040d261
add esp, 0x14
lea eax, [esi + 0x35fc]
cmp word [eax], bx
je 0x412b21
push eax
push str.Driver_Inf_______________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
push str.DDI_3
push 3
call fcn.00445f0b
mov eax, dword [esi + 0x39d4]
pop ecx
pop ecx
cmp eax, 0x14
ja 0x412b43
mov eax, dword [eax*4 + 0x494030]
jmp 0x412b48
mov eax, str.undefined
push eax
push str.Legacy_BusType___________:__s_r_n
call fcn.0040d20e
lea eax, [esi + 0x1e0e]
pop ecx
pop ecx
cmp word [eax], bx
je 0x412b6d
push eax
push str.Class____________________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
lea eax, [esi + 0x1e8e]
cmp word [eax], bx
je 0x412ba4
push eax
push str.Class_GUID_______________:__s
call fcn.0040d261
lea eax, [esi + 0x1ee8]
pop ecx
pop ecx
cmp word [eax], bx
je 0x412b9d
push eax
push str.___s_
call fcn.0040d261
pop ecx
pop ecx
push edi
call fcn.0040d20e
pop ecx
push str.DDI_4
push 3
call fcn.00445f0b
lea eax, [esi + 0x1f6c]
pop ecx
pop ecx
cmp word [eax], bx
je 0x412bca
push eax
push str.Service__________________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
lea eax, [esi + 0x1d8e]
cmp word [eax], bx
je 0x412be2
push eax
push str.Enumerator_______________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
lea edi, [esi + 0x1c8e]
cmp word [edi], bx
je 0x412c0c
lea eax, [esi + 0x10a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x412c0c
push edi
push str.PDO______________________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
lea eax, [esi + 0x1b34]
cmp word [eax], bx
jne 0x412c1c
mov eax, 0x44acfc
push eax
push str.Location_Info____________:__s_r_n
call fcn.0040d261
push dword [esi + 0x39d8]
push str.Address__________________:__u
call fcn.0040d261
mov eax, dword [esi + 0x39d8]
add esp, 0x10
cmp eax, 0x7f
jb 0x412c52
push eax
push str.__0x_X_
call fcn.0040d261
pop ecx
pop ecx
push 0x453d34
call fcn.0040d261
mov dword [esp], str.DDI_5
push 3
call fcn.00445f0b
mov eax, dword [esi + 0xc]
pop ecx
pop ecx
cmp eax, 3
je 0x412c7e
cmp eax, 6
je 0x412c7e
cmp eax, 9
jne 0x412ce3
lea eax, [esi + 0x2af8]
cmp word [eax], bx
je 0x412ca5
push eax
call fcn.00424dfa
mov edi, eax
push edi
push str.Location_IDs_____________:__s_r_n
call fcn.0040d261
push edi
call fcn.0043ffc9
add esp, 0xc
lea edi, [esi + 0x3964]
cmp word [edi], bx
je 0x412ce3
push edi
push str.Container_ID_____________:__s
call fcn.0040d261
pop ecx
pop ecx
push str.00000000_0000_0000_ffff_ffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x412cd8
push str.__GUID_CONTAINERID_INTERNALLY_CONNECTED_DEVICE_
call fcn.0040d20e
pop ecx
push 0x44e77c
call fcn.0040d20e
pop ecx
push str.DDI_6
push 3
call fcn.00445f0b
lea eax, [esi + 0x2074]
pop ecx
pop ecx
cmp word [eax], bx
jne 0x412d01
mov eax, 0x44acfc
push eax
push str.Manufacturer_Info________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
lea edi, [esi + 0x39d0]
push dword [edi]
call fcn.00440a43
push eax
push dword [edi]
push str.Capabilities_____________:_0x_02X___s__r_n
call fcn.0040d20e
add esp, 0xc
lea edi, [esi + 0x39e0]
push dword [edi]
call fcn.00440f6a
push eax
push dword [edi]
push str.Status___________________:_0x_08X___s__r_n
call fcn.0040d20e
push dword [esi + 0x39e4]
push str.Problem_Code_____________:__u
call fcn.0040d20e
mov eax, dword [esi + 0x39e4]
add esp, 0x14
cmp eax, ebx
je 0x412d75
push eax
call fcn.004408bb
push eax
push str.___s_
call fcn.0040d20e
pop ecx
pop ecx
push 0x44e77c
call fcn.0040d20e
mov dword [esp], str.DDI_7
push 3
call fcn.00445f0b
lea eax, [esi + 0x3338]
pop ecx
pop ecx
mov edi, 0x200
cmp dword [eax], ebx
je 0x412dbf
push edi
lea ecx, [ebp - 0x4b8]
push ecx
push eax
call fcn.00425642
lea eax, [ebp - 0x4b8]
push eax
push str.Upper_Filters____________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
push str.DDI_8
push 3
call fcn.00445f0b
lea eax, [esi + 0x3378]
pop ecx
pop ecx
cmp dword [eax], ebx
je 0x412df8
push edi
lea ecx, [ebp - 0x4b8]
push ecx
push eax
call fcn.00425642
lea eax, [ebp - 0x4b8]
push eax
push str.Lower_Filters____________:__s_r_n
call fcn.0040d261
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x44b900
lea eax, [esi + 0x1e0e]
push eax
call edi
test eax, eax
je 0x412e26
push 0x44b900
lea eax, [esi + 0x1f6c]
push eax
call edi
test eax, eax
jne 0x412eef
push str.DDI_9
push 3
call fcn.00445f0b
mov eax, dword [esi + 0x39dc]
pop ecx
pop ecx
cmp eax, ebx
jne 0x412ec5
push 0x3c
lea eax, [ebp + 0xc]
push ebx
push eax
mov dword [ebp + 8], 0x2d
call fcn.0043fd94
mov eax, dword [esi + 0x39d8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x412e90
push eax
cmp eax, 0x7f
jb 0x412e7e
push eax
lea eax, [ebp + 8]
push str._u__0x_X_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x412e90
lea eax, [ebp + 8]
push 0x454668
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 8]
push eax
push str.Address__________________:__s
call fcn.0040d261
mov eax, dword [esi + 0xc]
pop ecx
pop ecx
cmp eax, 9
je 0x412ead
cmp eax, 6
jne 0x412ee4
movzx eax, byte [ebp + 0x7c]
cmp dword [esi + 0x39d8], eax
je 0x412ee4
push str.____strange__usually_this_is_equal_to_the_USB_port_number_
call fcn.0040d20e
jmp 0x412ee3
cmp eax, 0x1d
jne 0x412ed1
push str.TIMEOUT
jmp 0x412ed8
push eax
call fcn.00440f3c
push eax
push str.Address__________________:__s
call fcn.0040d20e
pop ecx
pop ecx
push 0x44e77c
call fcn.0040d20e
pop ecx
push str.DDI_10
push 3
call fcn.00445f0b
mov eax, dword [esi + 0x39b4]
or edi, 0xffffffff
pop ecx
pop ecx
cmp eax, edi
je 0x412f17
push eax
push str.HcDisableSelectiveSuspend:__u_r_n
call fcn.0040d20e
pop ecx
pop ecx
mov eax, dword [esi + 0x39b8]
cmp eax, edi
je 0x412f2e
push eax
push str.EnableSelectiveSuspend___:__u_r_n
call fcn.0040d20e
pop ecx
pop ecx
mov eax, dword [esi + 0x39bc]
cmp eax, edi
je 0x412f45
push eax
push str.SelectiveSuspendEnabled__:__u_r_n
call fcn.0040d20e
pop ecx
pop ecx
mov eax, dword [esi + 0x39c0]
cmp eax, edi
je 0x412f5c
push eax
push str.EnhancedPowerMgmtEnabled_:__u_r_n
call fcn.0040d20e
pop ecx
pop ecx
mov eax, dword [esi + 0x39c4]
cmp eax, edi
je 0x412f73
push eax
push str.IdleInWorkingState_______:__u_r_n
call fcn.0040d20e
pop ecx
pop ecx
mov eax, dword [esi + 0x39c8]
cmp eax, edi
je 0x412f8a
push eax
push str.WakeFromSleepState_______:__u_r_n
call fcn.0040d20e
pop ecx
pop ecx
mov eax, dword [esi + 0x39ec]
cmp eax, ebx
je 0x412fca
dec eax
push eax
push str.Power_State______________:_D_u
call fcn.0040d20e
mov eax, dword [esi + 0x39f0]
pop ecx
pop ecx
cmp eax, ebx
je 0x412fbf
push eax
call fcn.00410851
push eax
push str.__supported:__s_
call fcn.0040d20e
pop ecx
pop ecx
push 0x44e77c
call fcn.0040d20e
pop ecx
push 0x44b180
lea edi, [esi + 0xfc4]
push edi
call fcn.0042580f
test eax, eax
je 0x412ffe
lea eax, [esi + 0x13ac]
cmp word [eax], bx
jne 0x412fef
mov eax, str.none_assigned
push eax
push edi
push str.COM_Port_________________:__s___s__r_n
call fcn.0040d261
add esp, 0xc
cmp dword [0x493a6c], ebx
jne 0x4130c0
push 0x4544bc
lea eax, [esi + 0x1f6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4130c0
cmp dword [esi + 0x39e4], ebx
jne 0x4130c0
push str.DDI_11
push 3
call fcn.00445f0b
pop ecx
pop ecx
cmp dword [esi + 0x828], ebx
jne 0x413073
mov ecx, dword [0x4fd5c4]
push 0x200
lea eax, [esi + 0x28]
push eax
push dword [esi + 0x10]
call fcn.004016e1
push eax
push str.DDI_12_n_i
push 3
mov dword [esi + 0x828], eax
call fcn.00445f0b
add esp, 0xc
xor edi, edi
cmp dword [esi + 0x828], ebx
jle 0x4130c0
lea eax, [esi + 0x28]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov dword [ebp + 0x78], eax
cmp eax, ebx
je 0x4130b3
cmp dword [0x507a24], 5
jl 0x4130a8
push edi
push str.DDI_13_i_i
push 5
call fcn.00445f0b
add esp, 0xc
push 1
push edi
push dword [ebp + 0x78]
call fcn.00412540
add dword [ebp + 0x7c], 4
inc edi
cmp edi, dword [esi + 0x828]
jl 0x413083
cmp word [esi + 0x1084], bx
je 0x4130ef
cmp dword [0x493a6c], ebx
jne 0x4130ef
push esi
call fcn.00410672
cmp dword [0x493a6c], ebx
jne 0x413505
push ebx
push esi
call fcn.00410728
jmp 0x413505
mov eax, dword [esi + 0x3a2c]
cmp eax, ebx
je 0x41310c
cmp dword [esi + 0x3a28], ebx
jne 0x413118
push esi
call fcn.00410672
jmp 0x413505
cmp dword [esi + 0x3a28], ebx
je 0x413299
cmp eax, ebx
je 0x413122
push esi
call fcn.00410672
mov edi, dword [esi + 0x3a74]
cmp edi, ebx
je 0x413505
lea eax, [edi + 0x848]
mov dword [ebp + 0x78], eax
cmp word [eax], bx
jne 0x413143
mov eax, 0x44c3a8
push eax
push str.Volume_Name______________:__S_r_n
call fcn.0040d20e
cmp dword [esi + 0x3a24], 3
pop ecx
pop ecx
jne 0x41315f
push esi
call fcn.00410576
push ebx
lea eax, [edi + 0x930]
push eax
call fcn.00410427
lea esi, [edi + 0x3264]
cmp word [esi], bx
je 0x4131a9
lea eax, [edi + 0x3278]
push eax
push str.Volume_Label_____________:__S_r_n
call fcn.0040d20e
push esi
push str.Volume_Serial____________:__S_r_n
call fcn.0040d20e
lea eax, [edi + 0x347a]
push eax
push str.File_System______________:__S_r_n
call fcn.0040d20e
add esp, 0x18
jmp 0x4131c6
mov eax, dword [edi + 0x34f4]
cmp eax, ebx
je 0x4131c6
push eax
call fcn.00440b33
push eax
push str.Volume_Info_Error________:__s_r_n
call fcn.0040d20e
pop ecx
pop ecx
lea ecx, [edi + 0x31e0]
cmp word [ecx], bx
je 0x413206
cmp dword [edi + 0x31dc], ebx
jl 0x4131fe
jg 0x4131e7
cmp dword [edi + 0x31d8], 0x200
jb 0x4131fe
lea eax, [edi + 0x3220]
cmp word [eax], bx
je 0x4131fe
push eax
push ecx
push str.Size_____________________:__S___S_available__r_n
jmp 0x41327f
push ecx
push str.Size_____________________:__S_r_n
jmp 0x413216
lea eax, [edi + 0x34ba]
cmp byte [eax], bl
je 0x41321f
push eax
push str.Hint_____________________:__s_r_n
call fcn.0040d20e
pop ecx
pop ecx
jmp 0x413287
xor eax, eax
push 0x7e
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0xb6]
push ebx
push eax
call fcn.0043fd94
push dword [edi + 0x844]
lea eax, [ebp - 0xb8]
push dword [edi + 0x840]
push str.DeviceHarddisk_iPartition_i
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp + 0x7c], ebx
call fcn.00448488
movzx eax, ax
cmp ax, bx
je 0x413287
movzx eax, ax
push eax
push dword [ebp + 0x7c]
push str.Hint_____________________:__S_Container_for__c:_r_n
call fcn.0040d20e
add esp, 0xc
push dword [ebp + 0x78]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x413505
push str.Mouse
lea edi, [esi + 0x1e0e]
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x413355
push ebx
push ebx
push 3
push ebx
push 3
push ebx
add esi, 0xc2c
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x413505
xor eax, eax
mov word [ebp + 0x64], ax
mov word [ebp + 0x7c], ax
lea edi, [ebp + 0x66]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp + 0x78]
push eax
push 0xc
lea eax, [ebp + 0x64]
push eax
push 2
lea eax, [ebp + 0x7c]
push eax
push 0xf0000
push esi
mov dword [ebp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41334f
push str._r_n______________Mouse_Information__r_n
call fcn.0040d20e
push dword [ebp + 0x6c]
push str.Input_Data_Queue_Length__:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x64]
push eax
push str.Mouse_Identifier_________:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x66]
push eax
push str.Number_of_Buttons________:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x68]
push eax
push str.Sample_Rate______________:__u_r_n
call fcn.0040d20e
add esp, 0x24
push esi
jmp 0x4134ff
push str.Keyboard
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x413505
push ebx
push ebx
push 3
push ebx
push 3
push ebx
add esi, 0xc2c
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0x7c], eax
cmp eax, 0xffffffff
je 0x413505
push 6
pop ecx
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp + 0x48], bl
lea edi, [ebp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
lea eax, [ebp + 0x78]
push eax
push 0x1c
lea eax, [ebp + 0x48]
push eax
push 0x1c
push eax
push 0xb0000
push dword [ebp + 0x7c]
mov dword [ebp + 0x78], ebx
call esi
test eax, eax
je 0x4134a6
push str._r_n______________Keyboad_Information__r_n
call fcn.0040d20e
cmp byte [ebp + 0x48], 0x51
pop ecx
mov eax, str.__HID_
je 0x4133de
mov eax, 0x44c315
push eax
movzx eax, byte [ebp + 0x48]
push eax
push str.Keyboard_ID.Type_________:_0x_X_s_r_n
call fcn.0040d20e
movzx eax, byte [ebp + 0x49]
push eax
push str.Keyboard_ID.Subtype______:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x4a]
push eax
push str.Keyboard_Mode____________:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x4c]
push eax
push str.Number_of_Function_Keys__:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x4e]
push eax
push str.Number_of_Indicators_____:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x50]
push eax
push str.Number_of_Keys_Total_____:__u_r_n
call fcn.0040d20e
push dword [ebp + 0x54]
push str.Input_Data_Queue_Length__:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x58]
push eax
push str.Key_Repeat_Minimum.UnitId:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x5a]
add esp, 0x44
push eax
push str.Key_Repeat_Minimum.Rate__:__u_per_second_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x5c]
push eax
push str.Key_Repeat_Minimum.Delay_:__u_ms_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x5e]
push eax
push str.Key_Repeat_Maximum.UnitId:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x60]
push eax
push str.Key_Repeat_Maximum.Rate__:__u_per_second_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x62]
push eax
push str.Key_Repeat_Maximum.Delay_:__u_ms_r_n
call fcn.0040d20e
add esp, 0x28
xor eax, eax
push ebx
mov word [ebp + 0x68], ax
lea edi, [ebp + 0x6a]
stosd dword es:[edi], eax
lea eax, [ebp + 0x78]
push eax
push 6
lea eax, [ebp + 0x68]
push eax
push 6
push eax
push 0xb0020
push dword [ebp + 0x7c]
call esi
test eax, eax
je 0x4134fc
movzx eax, word [ebp + 0x68]
push eax
push str.Key_Repeat_UnitId________:__u_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x6a]
push eax
push str.Key_Repeat_Rate__________:__u_per_second_r_n
call fcn.0040d20e
movzx eax, word [ebp + 0x6c]
push eax
push str.Key_Repeat_Delay_________:__u_ms_r_n
call fcn.0040d20e
add esp, 0x18
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.DDI_end
push 3
call fcn.00445f0b
pop ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8