Function at 0x44b0e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp ebx, dword [0x5c6a8c]
je 0x44b733
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5c0090]
neg eax
sbb eax, eax
and eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov dword [0x5c6a9c], eax
mov byte [0x5c6a90], 0
cmp ebx, 3
ja case.default.0x44b133
jmp dword [ebx*4 + 0x44b748]
mov byte [0x5c6a90], 0
xor eax, eax
mov dword [0x5c6a8c], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0044b0c0
push 0x584f20
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x44b2ce
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtClose
push esi
call edi
mov dword [0x5c6aa0], eax
test eax, eax
je 0x44b2ce
push str.NtCreateFile
push esi
call edi
mov dword [0x5c6aa4], eax
test eax, eax
je 0x44b2ce
push str.NtOpenFile
push esi
call edi
mov dword [0x5c6aa8], eax
test eax, eax
je 0x44b2ce
push str.NtQueryDirectoryFile
push esi
call edi
mov dword [0x5c6aac], eax
test eax, eax
je 0x44b2ce
push str.NtQueryInformationFile
push esi
call edi
mov dword [0x5c6ab0], eax
test eax, eax
je 0x44b2ce
push str.NtQuerySystemInformation
push esi
call edi
mov dword [0x5c6ab4], eax
test eax, eax
je 0x44b2ce
push str.NtReadFile
push esi
call edi
mov dword [0x5c6ab8], eax
test eax, eax
je 0x44b2ce
push str.NtSetInformationFile
push esi
call edi
mov dword [0x5c6abc], eax
test eax, eax
je 0x44b2ce
push str.NtWriteFile
push esi
call edi
mov dword [0x5c6ac0], eax
test eax, eax
je 0x44b2ce
push str.NtDeleteFile
push esi
call edi
mov dword [0x5c6ae4], eax
test eax, eax
je 0x44b2ce
push str.NtCreateKey
push esi
call edi
mov dword [0x5c6ac4], eax
test eax, eax
je 0x44b2ce
push str.NtDeleteKey
push esi
call edi
mov dword [0x5c6ac8], eax
test eax, eax
je 0x44b2ce
push str.NtDeleteValueKey
push esi
call edi
mov dword [0x5c6acc], eax
test eax, eax
je 0x44b2ce
push str.NtEnumerateKey
push esi
call edi
mov dword [0x5c6ad0], eax
test eax, eax
je 0x44b2ce
push str.NtEnumerateValueKey
push esi
call edi
mov dword [0x5c6ad4], eax
test eax, eax
je 0x44b2ce
push str.NtOpenKey
push esi
call edi
mov dword [0x5c6ad8], eax
test eax, eax
je 0x44b2ce
push str.NtQueryValueKey
push esi
call edi
mov dword [0x5c6adc], eax
test eax, eax
je 0x44b2ce
push str.NtSetValueKey
push esi
call edi
mov dword [0x5c6ae0], eax
test eax, eax
jne 0x44b726
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0044b0c0
call fcn.0044c560
mov esi, eax
test esi, esi
je 0x44b2ce
mov edx, str.NtClose
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6aa0], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtCreateFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6aa4], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtOpenFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6aa8], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQueryDirectoryFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6aac], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQueryInformationFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ab0], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQuerySystemInformation
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ab4], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtReadFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ab8], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtSetInformationFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6abc], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtWriteFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ac0], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtDeleteFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ae4], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtCreateKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ac4], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtDeleteKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ac8], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtDeleteValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6acc], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtEnumerateKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ad0], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtEnumerateValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ad4], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtOpenKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ad8], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQueryValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6adc], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtSetValueKey
mov ecx, esi
call fcn.0044c6b0
jmp 0x44b2c1
call fcn.0044c560
mov esi, eax
test esi, esi
je 0x44b2ce
mov edx, str.NtClose
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6ae8], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtCreateFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6aec], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtOpenFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6af0], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQueryDirectoryFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6af4], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQueryInformationFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6af8], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQuerySystemInformation
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6afc], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtReadFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b00], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtSetInformationFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b04], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtWriteFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b08], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtDeleteFile
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b2c], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtCreateKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b0c], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtDeleteKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b10], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtDeleteValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b14], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtEnumerateKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b18], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtEnumerateValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b1c], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtOpenKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b20], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtQueryValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b24], eax
test eax, eax
je 0x44b2ce
mov edx, str.NtSetValueKey
mov ecx, esi
call fcn.0044c6b0
mov dword [0x5c6b28], eax
test eax, eax
je 0x44b2ce
call fcn.0044b070
test al, al
je 0x44b2ce
mov dword [0x5c6aa0], 0x44a460
mov dword [0x5c6aa4], 0x44a4e0
mov dword [0x5c6aa8], 0x44a5c0
mov dword [0x5c6aac], 0x44a670
mov dword [0x5c6ab0], 0x44a750
mov dword [0x5c6ab4], 0x44a7f0
mov dword [0x5c6ab8], 0x44a890
mov dword [0x5c6abc], 0x44a960
mov dword [0x5c6ac0], 0x44aa00
mov dword [0x5c6ae4], 0x44aff0
mov dword [0x5c6ac4], 0x44aad0
mov dword [0x5c6ac8], 0x44ab90
mov dword [0x5c6acc], 0x44ac10
mov dword [0x5c6ad0], 0x44aca0
mov dword [0x5c6ad4], 0x44ad50
mov dword [0x5c6ad8], 0x44ae00
mov dword [0x5c6adc], 0x44ae90
mov dword [0x5c6ae0], 0x44af40
mov byte [0x5c6a90], 1
mov dword [0x5c6a8c], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret