Function at 0x44a3ef
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8268
call fcn.004536d0
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x1ffe
xor edi, edi
push esi
mov word [ebp - 0x624c], ax
lea eax, [ebp - 0x624a]
push edi
push eax
mov dword [ebp - 0x8258], edi
call sub.MSVCR100.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x424c], ax
lea eax, [ebp - 0x424a]
push edi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x224c], ax
lea eax, [ebp - 0x224a]
push edi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push edi
push eax
mov dword [ebp - 0x825c], 1
mov dword [ebp - 0x8254], edi
call sub.MSVCR100.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0x3c
cmp dword [0x46bbb8], edi
jne 0x44a7f7
push ebx
lea eax, [ebp - 0x8258]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlhivelist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.MSVCR100.dll_wcscat]
mov esi, 0x46bbb8
xor eax, eax
mov word [ebp - 0x624c], ax
mov word [ebp - 0x824c], ax
lea eax, [ebp - 0x8264]
push eax
lea eax, [ebp - 0x824c]
push eax
lea eax, [ebp - 0x8268]
push eax
push edi
lea eax, [ebp - 0x8260]
push eax
lea eax, [ebp - 0x624c]
push eax
push dword [ebp - 0x8254]
mov dword [ebp - 0x8260], 0x1000
push dword [ebp - 0x8258]
mov dword [ebp - 0x8264], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x44a53b
mov dword [ebp - 0x825c], edi
jmp 0x44a7e4
cmp word [ebp - 0x824c], di
je 0x44a7e4
cmp word [ebp - 0x24c], di
je 0x44a56e
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x824c]
push eax
call fcn.0044d169
pop ecx
pop ecx
test eax, eax
jne 0x44a5f2
push 0x41
pop eax
push 0x3a
mov word [ebp - 0x44], ax
pop eax
mov word [ebp - 0x42], ax
push 0x5c
pop eax
mov word [ebp - 0x40], ax
xor eax, eax
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x8250], edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x44a5da
xor eax, eax
mov word [ebp - 0x40], ax
push 0x104
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x824c]
push eax
call fcn.0044d169
pop ecx
pop ecx
test eax, eax
jne 0x44a5f2
push 0x5c
pop eax
mov word [ebp - 0x40], ax
inc word [ebp - 0x44]
inc dword [ebp - 0x8250]
cmp dword [ebp - 0x8250], 0x1a
jl 0x44a58f
jmp 0x44a7e4
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
lea eax, [ebp + eax*2 - 0x824c]
mov dword [ebp - 0x8250], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x424c]
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy]
push dword [ebp - 0x8250]
lea eax, [ebp - 0x424c]
push eax
call ebx
lea eax, [ebp - 0x424c]
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
push edi
push edi
lea eax, [ebp + eax*2 - 0x424c]
push edi
mov dword [ebp - 0x8250], eax
push 1
lea eax, [ebp - 0x424c]
push eax
push esi
call fcn.00446de7
lea eax, [ebp - 0x424c]
push str..log
push eax
call ebx
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x424c]
push eax
push esi
call fcn.00446de7
add esp, 0x50
call fcn.0044e93c
test eax, eax
je 0x44a7e4
mov ecx, dword [ebp - 0x8250]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x424c]
push str..log1
push eax
call ebx
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x424c]
push eax
push esi
call fcn.00446de7
mov ecx, dword [ebp - 0x8250]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x424c]
push str..log2
push eax
call ebx
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x424c]
push eax
push esi
call fcn.00446de7
mov ecx, dword [ebp - 0x8250]
xor eax, eax
add esp, 0x40
mov word [ecx], ax
lea eax, [ebp - 0x424c]
push str._system32config_
push eax
call fcn.0044d2fa
pop ecx
pop ecx
mov dword [ebp - 0x8250], eax
cmp eax, edi
je 0x44a7e4
push str._system32config_
call dword [sym.imp.MSVCR100.dll_wcslen]
mov ecx, dword [ebp - 0x8250]
lea eax, [ecx + eax*2]
mov dword [esp], str.RegBack_
push eax
lea eax, [ebp - 0x424c]
push eax
lea eax, [ebp - 0x224c]
push eax
call fcn.0044d363
lea eax, [ebp - 0x224c]
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
push edi
push edi
lea eax, [ebp + eax*2 - 0x224c]
push edi
mov dword [ebp - 0x8250], eax
push 1
lea eax, [ebp - 0x224c]
push eax
push esi
call fcn.00446de7
lea eax, [ebp - 0x224c]
push str..log
push eax
call ebx
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x224c]
push eax
push esi
call fcn.00446de7
mov ecx, dword [ebp - 0x8250]
xor eax, eax
add esp, 0x4c
mov word [ecx], ax
lea eax, [ebp - 0x224c]
push str..log1
push eax
call ebx
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x224c]
push eax
push esi
call fcn.00446de7
mov ecx, dword [ebp - 0x8250]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x224c]
push str..log2
push eax
call ebx
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x224c]
push eax
push esi
call fcn.00446de7
add esp, 0x40
inc dword [ebp - 0x8254]
cmp dword [ebp - 0x825c], edi
jne 0x44a4cf
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004534b8
leave
ret