Function at 0x451c5f
Capabilities:
Create thread
Get disk size
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x52a900
push esi
push ebx
xor ebx, ebx
sub esp, 0x1fc
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x147
mov eax, dword [0x526d20]
mov dword [esp], eax
call esi
sub esp, 0x10
mov ebx, eax
mov dword [esp], 0xd0f
call fcn.0042291e
mov dword [ebp - 0x1b8], eax
mov dword [esp], 0xd0e
call fcn.0042291e
mov dword [ebp - 0x1b4], eax
mov dword [esp], 0xd10
call fcn.0042291e
lea edx, [ebp - 0x19c]
mov ecx, 0xa
mov dword [ebp - 0x1ac], 3
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1a0], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1a8], edx
mov dword [ebp - str..vhd], 0x492b00
test ebx, ebx
js 0x4521c4
cmp dword [0x526ce8], 0
jne 0x4521c4
imul eax, ebx, 0x28
mov eax, dword [eax + 0x524fcc]
mov dword [esp], edx
mov dword [esp + 8], 0x4b4adf
mov dword [esp + 0xc], eax
mov dword [esp + 4], pe_nt_image_headers32
call dword [sym.imp.msvcrt.dll__snprintf]
xor ecx, ecx
mov byte [ebp - 0x11d], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x150
mov eax, dword [0x526d20]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [0x52a904], eax
mov dword [esp], eax
call fcn.00408898
cmp dword [0x526c68], 0
mov dword [0x52a918], eax
je 0x451d87
cmp dword [0x4e223c], 1
je 0x451d91
mov dword [ebp - 0x1ac], 2
mov eax, dword [ebp - 0x1ac]
mov edi, str._NULL_
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0x1cc], eax
mov eax, dword [0x5259d8]
test eax, eax
cmovne edi, eax
mov ebx, dword [ebp - 0x1c8]
cmp dword [ebp - 0x1cc], ebx
jb 0x451de7
mov dword [esp + 4], edi
mov eax, dword [ebx*4 + 0x492afc]
add eax, 2
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x451df1
inc ebx
mov dword [ebp - 0x1c8], ebx
jmp 0x451db6
mov dword [ebp - 0x1c8], 2
lea eax, [ebp - 0x1c8]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1ac]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call fcn.00441be5
mov dword [0x52a91c], eax
mov eax, dword [ebp - 0x1c8]
test eax, eax
je 0x451e2e
cmp dword [ebp - 0x1ac], eax
jae 0x451e4b
mov dword [esp + 8], 0x46c
mov dword [esp + 4], str.vhd.c
mov dword [esp], 0x4b4ae2
call dword [0x494088]
mov ebx, dword [eax*4 + 0x492afc]
mov eax, dword [0x525a6c]
add ebx, 2
mov dword [0x5259d8], ebx
test eax, eax
je 0x451e7d
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.PreferredSaveImageType
call fcn.004280dd
jmp 0x451f82
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edi, eax
xor eax, eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x1c4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x451ed2
xor eax, eax
mov dword [ebp - 0x1c4], eax
jmp 0x451f5a
lea eax, [ebp - 0x11c]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1c0]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWAREAkeo_ConsultingRufus
mov eax, dword [ebp - 0x1c4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
je 0x451f2a
xor ecx, ecx
mov dword [ebp - 0x1c0], ecx
jmp 0x451f5a
xor edx, edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], edx
mov dword [esp + 4], str.PreferredSaveImageType
mov eax, dword [ebp - 0x1c0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x1c4]
test eax, eax
je 0x451f6e
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x451f82
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov edx, dword [ebp - 0x1c8]
mov eax, 2
cmp edx, 1
je 0x451fa2
cmp edx, 3
mov eax, 0x63
mov edx, 3
cmovne eax, edx
mov dword [0x52a900], eax
mov edx, dword [0x4e2224]
mov eax, dword [0x4e2220]
cmp dword [0x52a918], 0
mov dword [0x52a908], 0x2000000
mov dword [0x52a914], edx
mov dword [0x52a910], eax
je 0x452192
cmp dword [0x52a91c], 0
je 0x452192
xor eax, eax
mov dword [esp + 4], 0x8002
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [0x526d5c]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0x10
cmp dword [0x52a900], 2
mov dword [0x4e2900], eax
jne 0x4520ab
xor eax, eax
lea ebx, [ebp - 0x11c]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov eax, dword [0x52a91c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNameA]
sub esp, 0xc
test eax, eax
je 0x4520ab
xor edi, edi
lea eax, [ebp - 0x1c0]
mov dword [esp], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
sub esp, 0x10
test eax, eax
je 0x4520ab
mov eax, dword [0x4e2220]
mov edx, dword [0x4e2224]
add eax, 0x1ff
adc edx, 0
cmp eax, dword [ebp - 0x1c0]
mov eax, edx
sbb eax, dword [ebp - 0x1bc]
jl 0x4520ab
mov dword [esp], str.The_VHD_size_is_too_large_for_the_target_drive
call fcn.0043efa9
mov dword [0x4e2900], 0xc00300df
jmp 0x45216f
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.004330aa
xor eax, eax
mov dword [0x4e2900], eax
mov dword [esp], 1
call fcn.0044d14d
mov edx, 0x44eaa1
mov eax, 0x44f930
cmp dword [0x52a900], 0x63
cmove eax, edx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0xc], 0x52a900
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x526ce8], eax
sub esp, 0x18
test eax, eax
je 0x452159
mov dword [esp], str._r_nSave_to_VHD_operation_started
xor ebx, ebx
xor edi, edi
call fcn.0043efa9
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp], 1
call fcn.00422ac2
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x8009
mov eax, dword [0x526d5c]
mov dword [esp], eax
call esi
jmp 0x45218f
mov dword [esp], str.Unable_to_start_VHD_save_thread
call fcn.0043efa9
mov dword [0x4e2900], 0xe0031205
xor ecx, ecx
mov dword [esp + 4], 0x8000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [0x526d5c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_PostMessageW]
sub esp, 0x10
cmp dword [0x526ce8], 0
jne 0x4521c4
mov eax, dword [0x52a918]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x52a918], eax
mov eax, dword [0x52a91c]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor edx, edx
mov dword [0x52a91c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret