Function at 0x44d980
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45298f
mov eax, dword fs:[0]
push eax
sub esp, 0xd5c
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd68], ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.004017e0
lea ecx, [ebp - 0x119]
call fcn.0044b0d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x119]
call fcn.0044b220
mov byte [ebp - 0x114], 0
push 0xfe
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.0041bda0
add esp, 0xc
mov dword [ebp - 0x118], 0xff
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x118]
jg 0x44da2d
cmp dword [ebp - 0x10], 0
jne 0x44da69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str._GetWinInstallPath__GetLogicalDriveStrings_nRes:_d__Err:_d__n
mov edx, dword [ebp - 0xd68]
add edx, 0x101
push edx
call fcn.0041bfd7
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x119]
call fcn.0044b0c0
jmp 0x44e1bd
mov dword [ebp - 0x938], 0
jmp 0x44da84
mov eax, dword [ebp - 0x938]
add eax, 1
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x10]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp dword [ebp - 0x938], eax
jge 0x44dcb2
mov ecx, dword [ebp - 0x938]
movsx edx, byte [ebp + ecx*4 - 0x114]
cmp edx, 0x78
je 0x44dac2
mov eax, dword [ebp - 0x938]
movsx ecx, byte [ebp + eax*4 - 0x114]
cmp ecx, 0x58
jne 0x44dac4
jmp 0x44da75
push 0x400
push 0
lea edx, [ebp - 0x724]
push edx
call fcn.0041bda0
add esp, 0xc
mov eax, dword [ebp - 0x938]
movsx ecx, byte [ebp + eax*4 - 0x114]
push ecx
push str._C:WINDOWS_system32configSAM
lea edx, [ebp - 0x724]
push edx
call fcn.0041bfd7
add esp, 0xc
lea eax, [ebp - 0x724]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44db67
push 0x210
push 0
lea ecx, [ebp - 0x934]
push ecx
call fcn.0041bda0
add esp, 0xc
lea edx, [ebp - 0x724]
push edx
lea eax, [ebp - 0x934]
push eax
call fcn.0041d8b0
add esp, 8
lea ecx, [ebp - 0x724]
push ecx
mov ecx, dword [ebp - 0xd68]
call fcn.0044d7f0
mov byte [ebp - 0x72c], al
lea edx, [ebp - 0x934]
push edx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401760
push 0x400
push 0
lea eax, [ebp - 0x724]
push eax
call fcn.0041bda0
add esp, 0xc
mov ecx, dword [ebp - 0x938]
movsx edx, byte [ebp + ecx*4 - 0x114]
push edx
push str._C:WINNT_system32configSAM
lea eax, [ebp - 0x724]
push eax
call fcn.0041bfd7
add esp, 0xc
lea ecx, [ebp - 0x724]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44dc0a
push 0x210
push 0
lea edx, [ebp - 0x934]
push edx
call fcn.0041bda0
add esp, 0xc
lea eax, [ebp - 0x724]
push eax
lea ecx, [ebp - 0x934]
push ecx
call fcn.0041d8b0
add esp, 8
lea edx, [ebp - 0x724]
push edx
mov ecx, dword [ebp - 0xd68]
call fcn.0044d7f0
mov byte [ebp - 0x72c], al
lea eax, [ebp - 0x934]
push eax
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401760
push 0x400
push 0
lea ecx, [ebp - 0x724]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp - 0x938]
movsx eax, byte [ebp + edx*4 - 0x114]
push eax
push str._C:WINNT35_system32configSAM
lea ecx, [ebp - 0x724]
push ecx
call fcn.0041bfd7
add esp, 0xc
lea edx, [ebp - 0x724]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44dcad
push 0x210
push 0
lea eax, [ebp - 0x934]
push eax
call fcn.0041bda0
add esp, 0xc
lea ecx, [ebp - 0x724]
push ecx
lea edx, [ebp - 0x934]
push edx
call fcn.0041d8b0
add esp, 8
lea eax, [ebp - 0x724]
push eax
mov ecx, dword [ebp - 0xd68]
call fcn.0044d7f0
mov byte [ebp - 0x72c], al
lea ecx, [ebp - 0x934]
push ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401760
jmp 0x44da75
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401710
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x93c], 0
jmp 0x44dce1
mov edx, dword [ebp - 0x93c]
add edx, 1
mov dword [ebp - 0x93c], edx
mov eax, dword [ebp - 0x93c]
cmp eax, dword [ebp - 0x120]
jge 0x44e123
mov ecx, dword [ebp - 0x93c]
push ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401730
movzx edx, byte [eax + 0x209]
test edx, edx
je 0x44dd15
jmp 0x44dcd2
mov eax, dword [ebp - 0x93c]
push eax
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401730
push eax
lea ecx, [ebp - 0x324]
push ecx
call fcn.0041d8b0
add esp, 8
lea edx, [ebp - 0x324]
push edx
mov ecx, dword [ebp - 0xd68]
call fcn.0044b740
push 0x46b65c
lea eax, [ebp - 0x324]
push eax
call fcn.0041d8c0
add esp, 8
push 0
lea ecx, [ebp - 0x324]
push ecx
call fcn.00440a30
add esp, 8
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 0
jne 0x44dd85
jmp 0x44dcd2
push 0x81
push str.SelectDefault
push 0
mov edx, dword [ebp - 0x944]
push edx
call fcn.00440380
add esp, 0x10
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x940]
push eax
lea ecx, [ebp - 0x324]
push ecx
push str._GetWinInstallPath__system:_s__nID:_d._n
push 0x47fcf0
call fcn.0043c100
add esp, 0x10
mov byte [ebp - 0xb44], 0
push 0x1ff
push 0
lea edx, [ebp - 0xb43]
push edx
call fcn.0041bda0
add esp, 0xc
mov eax, dword [ebp - 0x940]
push eax
push str.ControlSet_03dServicesNTDSParametersDSA_Database_file
lea ecx, [ebp - 0xb44]
push ecx
call fcn.0041bfd7
add esp, 0xc
push 0x81
push 1
lea edx, [ebp - 0xb44]
push edx
push 0
push 0
mov eax, dword [ebp - 0x944]
push eax
call fcn.0043fc40
add esp, 0x18
mov dword [ebp - 0xb48], eax
cmp dword [ebp - 0xb48], 0
jne 0x44de42
mov ecx, dword [ebp - 0x944]
push ecx
call fcn.0043dbf0
add esp, 4
jmp 0x44dcd2
push 0
push 0
push 0x200
lea edx, [ebp - 0xb44]
push edx
mov eax, dword [ebp - 0xb48]
mov eax, dword [eax]
cdq
sub eax, edx
sar eax, 1
push eax
mov ecx, dword [ebp - 0xb48]
add ecx, 4
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb48]
mov eax, dword [edx]
cdq
sub eax, edx
sar eax, 1
mov byte [ebp + eax - 0xb44], 0
movsx eax, byte [ebp - 0xb44]
test eax, eax
je 0x44e0ed
lea ecx, [ebp - 0xb44]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44df43
push 0x210
push 0
lea edx, [ebp - 0x934]
push edx
call fcn.0041bda0
add esp, 0xc
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0x728], eax
mov ecx, dword [ebp - 0x93c]
push ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401730
push eax
lea edx, [ebp - 0x934]
push edx
call fcn.0041d8b0
add esp, 8
lea eax, [ebp - 0xb44]
push eax
lea ecx, [ebp - 0x830]
push ecx
call fcn.0041d8b0
add esp, 8
lea edx, [ebp - 0x934]
push edx
mov ecx, dword [ebp - 0xd68]
call fcn.0044d7f0
mov byte [ebp - 0x72c], al
mov byte [ebp - 0x72b], 1
lea eax, [ebp - 0x934]
push eax
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401760
jmp 0x44e0ed
mov cl, byte [ebp - 0x324]
mov byte [ebp - 0xb44], cl
lea edx, [ebp - 0xb44]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44dffa
push 0x210
push 0
lea eax, [ebp - 0x934]
push eax
call fcn.0041bda0
add esp, 0xc
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x728], ecx
mov edx, dword [ebp - 0x93c]
push edx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401730
push eax
lea eax, [ebp - 0x934]
push eax
call fcn.0041d8b0
add esp, 8
lea ecx, [ebp - 0xb44]
push ecx
lea edx, [ebp - 0x830]
push edx
call fcn.0041d8b0
add esp, 8
lea eax, [ebp - 0x934]
push eax
mov ecx, dword [ebp - 0xd68]
call fcn.0044d7f0
mov byte [ebp - 0x72c], al
mov byte [ebp - 0x72b], 1
lea ecx, [ebp - 0x934]
push ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401760
jmp 0x44e0ed
mov dword [ebp - 0xb4c], 0
jmp 0x44e015
mov edx, dword [ebp - 0xb4c]
add edx, 1
mov dword [ebp - 0xb4c], edx
mov eax, dword [ebp - 0x10]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp dword [ebp - 0xb4c], eax
jge 0x44e0ed
mov eax, dword [ebp - 0xb4c]
mov cl, byte [ebp + eax*4 - 0x114]
mov byte [ebp - 0xb44], cl
lea edx, [ebp - 0xb44]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44e0e8
push 0x210
push 0
lea eax, [ebp - 0x934]
push eax
call fcn.0041bda0
add esp, 0xc
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x728], ecx
mov edx, dword [ebp - 0x93c]
push edx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401730
push eax
lea eax, [ebp - 0x934]
push eax
call fcn.0041d8b0
add esp, 8
lea ecx, [ebp - 0xb44]
push ecx
lea edx, [ebp - 0x830]
push edx
call fcn.0041d8b0
add esp, 8
lea eax, [ebp - 0x934]
push eax
mov ecx, dword [ebp - 0xd68]
call fcn.0044d7f0
mov byte [ebp - 0x72c], al
mov byte [ebp - 0x72b], 1
lea ecx, [ebp - 0x934]
push ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401760
jmp 0x44e0ed
jmp 0x44e006
cmp dword [ebp - 0xb48], 0
je 0x44e10f
mov edx, dword [ebp - 0xb48]
push edx
call fcn.0041baa5
add esp, 4
mov dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x944]
push eax
call fcn.0043dbf0
add esp, 4
jmp 0x44dcd2
mov dword [ebp - 0xb50], 0
jmp 0x44e13e
mov ecx, dword [ebp - 0xb50]
add ecx, 1
mov dword [ebp - 0xb50], ecx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401710
cmp dword [ebp - 0xb50], eax
jae 0x44e1ab
mov edx, dword [ebp - 0xb50]
push edx
mov ecx, dword [ebp - 0xd68]
add ecx, 0x18
call fcn.00401730
mov ecx, 0x84
mov esi, eax
lea edi, [ebp - 0xd64]
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [ebp - 0xb5b]
test eax, eax
je 0x44e197
lea ecx, [ebp - 0xc60]
push ecx
mov ecx, dword [ebp - 0xd68]
call fcn.0044bca0
jmp 0x44e1a9
lea edx, [ebp - 0xd64]
push edx
mov ecx, dword [ebp - 0xd68]
call fcn.0044bca0
jmp 0x44e12f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x119]
call fcn.0044b0c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret