Function at 0x44ea65
Capabilities:
Create thread
Get disk size
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x527d40
push esi
push ebx
xor ebx, ebx
sub esp, 0x1fc
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x147
mov eax, dword [0x52417c]
mov dword [esp], eax
call esi
sub esp, 0x10
mov ebx, eax
mov dword [esp], 0xd0f
call fcn.00422df0
mov dword [ebp - 0x1b8], eax
mov dword [esp], 0xd0e
call fcn.00422df0
mov dword [ebp - 0x1b4], eax
mov dword [esp], 0xd10
call fcn.00422df0
lea edx, [ebp - 0x19c]
mov ecx, 0xa
mov dword [ebp - 0x1ac], 3
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1a0], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1a8], edx
mov dword [ebp - str..vhd], 0x48fca0
test ebx, ebx
js 0x44f005
cmp dword [0x524148], 0
jne 0x44f005
imul eax, ebx, 0x28
mov edi, 2
mov eax, dword [eax + 0x52242c]
mov dword [esp], edx
mov dword [esp + 0xc], 0x4b1dac
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], pe_nt_image_headers32
call dword [sym.imp.msvcrt.dll__snprintf_s]
xor ecx, ecx
mov byte [ebp - 0x11d], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x150
mov eax, dword [0x52417c]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [0x527d44], eax
mov dword [esp], eax
call fcn.004082ed
cmp dword [0x5240c8], 0
mov dword [0x527d58], eax
je 0x44eba2
xor eax, eax
cmp dword [0x4df23c], 1
sete al
mov edi, eax
add edi, 2
mov eax, dword [0x522e38]
mov edx, str._NULL_
mov dword [ebp - 0x1ac], edi
mov dword [ebp - 0x1c8], 1
test eax, eax
cmovne edx, eax
mov ebx, dword [ebp - 0x1c8]
cmp edi, ebx
jb 0x44ebfa
mov eax, dword [ebx*4 + 0x48fc9c]
mov dword [esp], edx
add eax, 2
mov dword [esp + 4], eax
mov dword [ebp - 0x1cc], edx
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x1cc]
test eax, eax
je 0x44ec04
inc ebx
mov dword [ebp - 0x1c8], ebx
jmp 0x44ebc1
mov dword [ebp - 0x1c8], 2
lea eax, [ebp - 0x1c8]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1ac]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call fcn.00440356
mov dword [0x527d5c], eax
mov ebx, eax
test eax, eax
je 0x44efd3
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1c8], eax
test eax, eax
je 0x44ec76
lea edi, [eax - 1]
mov edx, dword [edi*4 + 0x48fca0]
lea eax, [edx + 1]
mov dword [ebp - 0x1cc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, dword [ebp - 0x1cc]
test eax, eax
jne 0x44ec91
mov eax, edi
jmp 0x44ec3f
mov dword [esp], str.Warning:_Can_not_determine_image_type_from_extension___Saving_to_uncompressed_VHD.
call fcn.0043d9e0
mov dword [ebp - 0x1c8], 1
jmp 0x44edde
mov eax, dword [0x522ecc]
lea ebx, [edx + 2]
mov dword [0x522e38], ebx
test eax, eax
je 0x44ecbc
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.PreferredSaveImageType
call fcn.00426fc7
jmp 0x44edc1
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edi, eax
xor eax, eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x1c4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x44ed11
xor eax, eax
mov dword [ebp - 0x1c4], eax
jmp 0x44ed99
lea eax, [ebp - 0x11c]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1c0]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWARESmu1zelRufus_7
mov eax, dword [ebp - 0x1c4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
je 0x44ed69
xor ecx, ecx
mov dword [ebp - 0x1c0], ecx
jmp 0x44ed99
xor edx, edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], edx
mov dword [esp + 4], str.PreferredSaveImageType
mov eax, dword [ebp - 0x1c0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x1c4]
test eax, eax
je 0x44edad
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x44edc1
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x1c8]
cmp eax, 1
je 0x44edde
cmp eax, 3
mov edx, 3
mov eax, 0x63
cmovne eax, edx
jmp 0x44ede3
mov eax, 2
mov dword [0x527d40], eax
mov edx, dword [0x4df224]
mov eax, dword [0x4df220]
cmp dword [0x527d58], 0
mov dword [0x527d48], 0x2000000
mov dword [0x527d54], edx
mov dword [0x527d50], eax
je 0x44efd3
cmp dword [0x527d5c], 0
je 0x44efd3
xor eax, eax
mov dword [esp + 4], 0x8002
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [0x5241b4]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0x10
cmp dword [0x527d40], 2
mov dword [0x4dfd80], eax
jne 0x44eeec
xor eax, eax
lea ebx, [ebp - 0x11c]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov eax, dword [0x527d5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNameA]
sub esp, 0xc
test eax, eax
je 0x44eeec
xor edi, edi
lea eax, [ebp - 0x1c0]
mov dword [esp], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
sub esp, 0x10
test eax, eax
je 0x44eeec
mov eax, dword [0x4df220]
mov edx, dword [0x4df224]
add eax, 0x1ff
adc edx, 0
cmp eax, dword [ebp - 0x1c0]
mov eax, edx
sbb eax, dword [ebp - 0x1bc]
jl 0x44eeec
mov dword [esp], str.The_VHD_size_is_too_large_for_the_target_drive
call fcn.0043d9e0
mov dword [0x4dfd80], 0xc00300df
jmp 0x44efb0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00431f69
xor eax, eax
mov dword [0x4dfd80], eax
mov dword [esp], 1
call fcn.00449e27
mov edx, 0x44b582
mov eax, 0x44c419
cmp dword [0x527d40], 0x63
cmove eax, edx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0xc], 0x527d40
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x524148], eax
sub esp, 0x18
test eax, eax
je 0x44ef9a
mov dword [esp], str._r_nSave_to_VHD_operation_started
xor ebx, ebx
xor edi, edi
call fcn.0043d9e0
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp], 1
call fcn.00422f82
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x8009
mov eax, dword [0x5241b4]
mov dword [esp], eax
call esi
jmp 0x44efd0
mov dword [esp], str.Unable_to_start_VHD_save_thread
call fcn.0043d9e0
mov dword [0x4dfd80], 0xe0031205
xor ecx, ecx
mov dword [esp + 4], 0x8000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [0x5241b4]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_PostMessageW]
sub esp, 0x10
cmp dword [0x524148], 0
jne 0x44f005
mov eax, dword [0x527d58]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x527d58], eax
mov eax, dword [0x527d5c]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor edx, edx
mov dword [0x527d5c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret