Function at 0x4449e0
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebx
push edi
push esi
sub esp, 0x128
mov dword [esp], str.KERNEL32.DLL
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test eax, eax
je 0x444cc9
mov ebx, 0x3f
mov dword [esp], eax
mov dword [esp + 4], str.WTSGetActiveConsoleSessionId
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80cb48], eax
mov dword [esp], str.WTSAPI32.DLL
call fcn.007c60a0
mov esi, eax
mov dword [0x80cb58], esi
xor edi, edi
test esi, esi
jne 0x444aa1
mov eax, esi
and eax, 1
xor eax, esi
not eax
test eax, eax
je 0x444aa1
add ebx, 0x59
mov dword [0x80cb40], 0
xor eax, eax
jmp 0x444ab8
mov eax, 3
sub eax, edi
xor eax, edi
setne al
movzx eax, al
add edi, eax
mov dword [esp], esi
mov dword [esp + 4], str.WTSEnumerateSessionsA
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80cb40], eax
mov eax, dword [0x80cb58]
mov dword [esp], eax
mov dword [esp + 4], str.WTSFreeMemory
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
and ebx, 0xffffffe7
mov ecx, edi
and ecx, 1
xor ecx, edi
cmp ecx, 0xffffffff
setne cl
movzx ecx, cl
cmp edi, ecx
jb 0x444a60
mov dword [0x80cb44], eax
mov dword [esp + 4], 0
mov dword [esp], 0x80c4c4
call fcn.007c74b0
mov ecx, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete cl
movzx ecx, cl
cmp eax, ecx
jne 0x444cee
call fcn.00620bb0
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
sete cl
movzx ecx, cl
cmp eax, ecx
jne 0x444d13
call fcn.004adc40
mov byte [esp + 0x24], 0
lea esi, [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x104
mov dword [esp], str.SystemDrive
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
dec eax
cmp eax, 0x104
jb 0x444be0
mov ecx, eax
and ecx, 1
xor ecx, eax
not ecx
test ecx, ecx
je 0x444be0
and ebx, 0xffffff40
add ebx, 0xc7
mov al, bl
xor al, 0xdf
movzx eax, al
cmp eax, 0x18
je 0x444b80
cmp eax, 0x72
mov dword [esp], esi
mov dword [esp + 8], 0x7d7648
mov dword [esp + 4], 0x104
call fcn.004959f0
jmp 0x444be0
xor ebx, 0x19
xor edi, edi
jmp 0x444bcc
and ebx, 0xffffff53
mov eax, ebx
lea ebx, [eax - 0xb]
xor ebx, eax
xor bl, 0x67
mov eax, edi
not eax
and eax, 1
add eax, edi
setne al
movzx eax, al
add edi, eax
mov dword [esp], esi
mov dword [esp + 8], 0x7d7648
mov dword [esp + 4], 0x104
call fcn.004959f0
movzx ebx, bl
mov eax, edi
imul eax, eax
and eax, 3
cmp eax, 2
sbb eax, eax
and eax, 1
cmp edi, eax
jb 0x444b90
mov dword [esp], esi
mov dword [esp + 4], 0x104
call fcn.004966d0
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call sub.KERNEL32.dll_GetVolumeInformationA
sub esp, 0x20
test eax, eax
je 0x444c5e
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
je 0x444c5e
mov al, 0x51
movzx ebx, al
cmp ebx, 0x51
jne 0x444c6c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.007c7500
mov dword [0x80c4c0], eax
jmp 0x444cbf
mov dword [esp], str.Failed_to_identify_the_machine_n
call fcn.004414c0
jmp 0x444cbf
xor ebx, 3
xor esi, esi
jmp 0x444cab
and ebx, 0xffffffdf
add ebx, 0x4f
add bl, 0xd1
mov eax, esi
imul eax, eax
and eax, 3
cmp eax, 2
adc esi, 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.007c7500
mov dword [0x80c4c0], eax
movzx ebx, bl
mov eax, esi
and eax, 1
xor eax, esi
cmp eax, 0xffffffff
setne al
movzx eax, al
cmp esi, eax
jb 0x444c80
add esp, 0x128
pop esi
pop edi
pop ebx
ret
call fcn.007c4fd0
mov esi, eax
call fcn.007c4bf0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_load_libraries__syserr__d__s__n
call fcn.00441610
call fcn.0044c0d0
call fcn.007c4fd0
mov esi, eax
call fcn.007c4bf0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_create_the_LM_mutex__syserr__d__s__n
call fcn.00441610
call fcn.0044c0d0
mov dword [esp], str.Failed_to_initialize_vc_n
call fcn.00441610
call fcn.0044c0d0
int3