Function at 0x44cd00
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb60
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4c309c
call fcn.0045e264
test bl, bl
je 0x44cd34
test al, 1
jne 0x44cd34
xor eax, eax
jmp 0x44d0e2
call fcn.0044e5e8
mov edi, eax
mov byte [0x4c6148], 0
xor eax, eax
call fcn.004572bc
lea edx, [ebp - 0xa0]
mov eax, 0x4c309c
call fcn.004626b8
mov ecx, 0x4bb1b4
mov edx, 0x4badb4
mov eax, 0x4c309c
call fcn.00462684
mov edx, dword [ebp - 0x90]
mov dword [0x4b996c], edx
mov byte [0x4b908a], bl
mov dword [0x4b954c], 1
xor ecx, ecx
mov dword [0x4b9020], ecx
xor eax, eax
mov dword [0x4b904c], eax
call fcn.00442051
lea edx, [ebp - 0x4a0]
mov eax, 0x4c309c
xor ecx, ecx
call fcn.00462684
lea edx, [ebp - 0x8a0]
mov eax, 0x4c309c
xor ecx, ecx
call fcn.00462658
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x4a0]
push edx
cmp dword [ebp - 0x2c], 0
setne al
and eax, 1
push eax
mov eax, 0x4c6148
mov dl, byte [ebp + 8]
push edx
mov edx, 0x4a4c39
call fcn.0044da6c
cmp byte [ebp - 1], 0
je 0x44ce04
mov eax, 1
call fcn.00441ed3
test al, al
jne 0x44ce04
xor eax, eax
jmp 0x44d0e2
cmp byte [ebp - 0x8a0], 0
jne 0x44ce37
mov eax, 0x4c2354
call fcn.00468e84
mov esi, eax
mov eax, 0x4c2354
call fcn.00468eb8
cmp esi, eax
jne 0x44ce37
cmp dword [ebp - 0x2c], 0
je 0x44ce33
cmp byte [ebp - 0xb], 0
je 0x44ce37
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x44ce4e
mov edx, 0x4a4ddd
mov eax, dword [0x4bb9b4]
call fcn.0040f77c
jmp 0x44cec5
mov eax, 0x4c2354
xor ecx, ecx
mov edx, dword [0x4bb9b4]
call fcn.00468fcc
test al, al
jne 0x44ce6b
xor eax, eax
jmp 0x44d0e2
mov edx, dword [0x4bb9b4]
cmp dword [edx + 0x30], 0
jne 0x44cec5
lea ecx, [ebp - 0x8a0]
push ecx
lea eax, [ebp - 0xca0]
push eax
call fcn.00494e64
add esp, 8
cmp byte [ebp - 0xca0], 0
je 0x44cea1
lea eax, [ebp - 0xca0]
call fcn.0040bf64
push 0x4a4ddd
lea edx, [ebp - 0xca0]
push edx
call fcn.00494d88
add esp, 8
lea edx, [ebp - 0xca0]
mov eax, dword [0x4bb9b4]
call fcn.0040f77c
cmp dword [ebp - 0x2c], 0
je 0x44cf47
cmp byte [ebp - 0xb], 0
jne 0x44cf47
mov eax, 0x4c2354
call fcn.00468e84
mov esi, eax
test esi, esi
je 0x44cef8
cmp byte [ebp - 0x8a0], 0
jne 0x44cf47
mov eax, 0x4c2354
call fcn.00468eb8
cmp esi, eax
jne 0x44cf47
test esi, esi
jne 0x44cf03
mov edx, 1
jmp 0x44cf25
push 0x4badb4
push 0x442feb
push dword [0x4c2340]
push 0x4a571c
push dword [0x4af654]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x44cf31
sub edx, 2
je 0x44cf38
jmp 0x44cf47
xor eax, eax
jmp 0x44d0e2
mov edx, 0x4a4ddd
mov eax, dword [0x4bb9b4]
call fcn.0040f77c
mov byte [ebp - 0x10a0], 0
test bl, bl
jne 0x44cfb0
cmp byte [0x4c6148], 0
je 0x44cfb0
cmp dword [0x4b8f84], 5
je 0x44cfb0
lea ecx, [ebp - 0x10a0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4c6148
xor ecx, ecx
xor edx, edx
call fcn.0040a0bc
push 0x4c6148
call fcn.004967f8
pop ecx
inc eax
jne 0x44cfb0
push 0x4c6148
mov eax, 0x1f7
call fcn.0041202c
push eax
call fcn.0044e3e0
add esp, 8
xor eax, eax
jmp 0x44d0e2
mov eax, 0x4c309c
xor ecx, ecx
xor edx, edx
call fcn.0045d68c
cmp byte [ebp - 0x10a0], 0
je 0x44cfd4
lea eax, [ebp - 0x10a0]
push eax
call fcn.004967f8
pop ecx
call fcn.0044e5e8
cmp edi, eax
jne 0x44cfe6
cmp dword [0x4c4cf4], 0
je 0x44cfea
xor edx, edx
jmp 0x44cfef
mov edx, 1
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x44d057
test bl, bl
je 0x44d021
push 0x40
mov eax, 0x3a7
call fcn.0041202c
push eax
mov eax, 0x3a8
call fcn.0041202c
push eax
push dword [0x4c2340]
call sub.USER32.DLL_MessageBoxA
jmp 0x44d057
cmp dword [0x4ba17c], 0
je 0x44d057
mov edx, 0x4bb1b4
mov eax, 0x4badb4
call fcn.0040a504
test al, al
jne 0x44d057
mov eax, 0x4c2354
call fcn.004691b8
test al, al
je 0x44d057
mov eax, 0x4c2354
xor edx, edx
call fcn.004638e8
mov byte [0x4c28f0], 0
mov eax, 0x4c28c4
call fcn.004495b8
test bl, bl
jne 0x44d0df
cmp dword [0x4c4cf4], 0
jne 0x44d0df
cmp byte [0x4c654d], 0
je 0x44d0df
push 0x4c6148
call fcn.00494e94
pop ecx
cmp eax, 0x3fe
jae 0x44d0df
push 0x4c6148
lea edx, [ebp - 0x14a0]
push edx
call fcn.00494e64
add esp, 8
lea eax, [ebp - 0x14a0]
call fcn.0040bf64
push 0x4a4cdd
lea edx, [ebp - 0x14a0]
push edx
call fcn.00494d88
add esp, 8
push 1
push 0x4a4c39
push 0
lea ecx, [ebp - 0x14a0]
push ecx
push 0x4a572d
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4