Function at 0x44d340
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esi + 4], 0
call fcn.0044cf30
push str.rapi.dll
lea ecx, [esp + 8]
call fcn.00406300
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x44d4e1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CeCreateFile
push eax
call edi
mov ecx, dword [esi]
push str.CeWriteFile
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.CeCloseHandle
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.CeFindFirstFile
push eax
call edi
mov ecx, dword [esi]
push str.CeGetFileSize
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.CeReadFile
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.CeFindNextFile
push eax
call edi
mov ecx, dword [esi]
push str.CeCreateDirectory
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.CeCreateProcess
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.CeGetSystemInfo
push eax
call edi
mov ecx, dword [esi]
push str.CeRapiInitEx
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi]
push str.CeGetFileAttributes
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi]
push str.CeRapiInvoke
push eax
call edi
mov ecx, dword [esi]
push str.CeDeleteFile
push ecx
mov dword [esi + 0x38], eax
call edi
mov edx, dword [esi]
push str.CeGetLastError
push edx
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x48], eax
mov eax, dword [esi]
push str.CeGetStoreInformation
push eax
call edi
mov dword [esi + 0x40], eax
mov ecx, dword [esi]
push str.CeGetSystemPowerStatusEx
push ecx
call edi
mov edx, dword [esi]
push str.CeSetFileAttributes
push edx
mov dword [esi + 0x44], eax
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi]
push str.CeFindClose
push eax
call edi
mov ecx, dword [esi]
push str.CeRegOpenKeyEx
push ecx
mov dword [esi + 0x50], eax
call edi
mov edx, dword [esi]
push str.CeRegQueryValueEx
push edx
mov dword [esi + 0x54], eax
call edi
mov dword [esi + 0x58], eax
mov eax, dword [esi]
push str.CeRegCloseKey
push eax
call edi
mov ecx, dword [esi]
push str.CeRegSetValueEx
push ecx
mov dword [esi + 0x5c], eax
call edi
mov edx, dword [esi]
push str.CeRegCreateKeyEx
push edx
mov dword [esi + 0x60], eax
call edi
mov dword [esi + 0x64], eax
mov eax, dword [esi]
push str.CeRegDeleteKey
push eax
call edi
mov ecx, dword [esi]
push str.CeRapiUninit
push ecx
mov dword [esi + 0x68], eax
call edi
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop edi
test ecx, ecx
jmp 0x44d4fd
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44d509
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ecx
ret