Function at 0x443501
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b8928
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x10], ecx
je 0x4433d2
mov dword [eax], 0
jmp case.0x4433e0.4
movzx eax, word [ebp + 0xc]
dec eax
cmp eax, 9
ja case.0x4433e0.4
jmp dword [eax*4 + 0x443608]
push 0
push 0x776af4
push 0x7759cc
push 0
push str.opt_switch
lea ecx, [esi + 0x34]
call fcn.00479ce0
push eax
call fcn.005325ba
mov edi, eax
add esp, 0x14
test edi, edi
je case.0x4433e0.4
mov esi, dword [edi]
mov ecx, edi
push 1
call fcn.004c80d0
test al, al
mov ecx, edi
sete al
movzx eax, al
push eax
call dword [esi + 0x1dc]
jmp case.0x4433e0.4
or dword [esi + 0x12fc], 1
jmp case.0x4433e0.4
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [esi + 0x12fc], 2
jmp case.0x4433e0.4
mov ecx, esi
call fcn.00444670
jmp case.0x4433e0.4
lea eax, [ebp - 0x28]
push eax
call fcn.00431fb0
mov ecx, eax
call fcn.005110b3
push 0xd
push str.WinUpdate.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004032b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4434be
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 5
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb case.0x4433e0.4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4434f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4435fd
push edx
push ecx
call fcn.00468d54
add esp, 8
jmp case.0x4433e0.4
lea eax, [ebp - 0x28]
push eax
call fcn.00431fb0
mov ecx, eax
call fcn.005110b3
push str.About.exe
mov dword [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push str.WinTools
cmovae eax, dword [ebp - 0x28]
push str.Tools
push eax
lea eax, [ebp - 0x40]
push str._s.._s_s_s
push eax
call fcn.0050b7ff
add esp, 0x18
lea ecx, [ebp - 0x28]
push eax
call fcn.00403100
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x443587
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44357d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443602
push edx
push ecx
call fcn.00468d54
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4434be
jmp 0x44349f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push str.http:__win.55kantu.com_kf.html
mov dword [ebp - 4], 2
call fcn.00402730
jmp case.0x4433e0.4
mov ecx, esi
call fcn.00446320
jmp case.0x4433e0.4
mov ecx, esi
call fcn.004461e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 0x10
call fcn.00533dd1
call fcn.00533dd1
nop
out 0x33, eax
inc esp
add byte [esi], dh
xor al, 0x44
add byte [edx + 0x34], al
inc esp
add dh, bl
xor eax, 0x34570044
inc esp
add dh, cl
xor eax, 0x34630044
inc esp
add byte [esi + 0x1004435], ah
xor eax, 0x35d70044
inc esp
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b8968
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
mov dword [eax + 0x1328], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
push eax
call fcn.00425330
mov ecx, eax
call fcn.00422800
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x744352
mov byte [ecx], 0
call fcn.00410120
mov byte [ebp - 4], 1
call fcn.00425330
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00423130
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.94EEBFCEE7194DA8B358E67759B8FFE6
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
mov esi, eax
test esi, esi
je 0x44372b
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44372b
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
push 0x470
push esi
call ebx
push 0
push str.323DC7B4CDD0412691D45E426BACA479
call edi
mov esi, eax
test esi, esi
je 0x443751
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x443751
push 0
push 0
push 0x470
push esi
call ebx
push 0
push str.3B7290C2_785A_4CF4_BF7A_C977E94F7238
call edi
mov esi, eax
test esi, esi
je 0x443777
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x443777
push 0
push 0
push 0x470
push esi
call ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
call fcn.00432880
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 2
push eax
push 0
push str.B278EC65_6E53_4B41_A02B_899C012B3D9C
call fcn.00515f0b
mov edi, dword [ebp - 0x60]
add esp, 0xc
mov esi, dword [edi]
cmp esi, edi
je 0x443812
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x4437d2
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4437d2
push 0
push 0
push 0x470
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4437f8
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4437f4
cmp esi, dword [eax + 8]
jne 0x4437f4
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4437e4
mov esi, eax
jmp 0x44380e
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x44380e
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x443802
cmp esi, edi
jne 0x4437b0
mov ecx, dword [0x77cfac]
sub esp, 8
mov esi, dword [ebp - 0x64]
mov eax, dword [ecx + 0x64]
mov byte [eax + 0x78], 0
mov edx, dword [ecx + 0x64]
mov ecx, esi
mov eax, dword [edx + 0x84]
mov dword [edx + 0x88], eax
call fcn.00447a20
mov ecx, esi
call fcn.00447bf0
mov ecx, esi
call fcn.00444240
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x60]
mov ebx, eax
mov edi, dword [eax + 4]
mov esi, edi
cmp byte [edi + 0xd], 0
jne 0x443883
nop dword [eax]
push dword [esi + 8]
lea ecx, [ebp - 0x60]
call fcn.004328a0
mov esi, dword [esi]
push 0x14
push edi
call fcn.00468d54
add esp, 8
mov edi, esi
cmp byte [esi + 0xd], 0
je 0x443860
mov eax, dword [ebp - 0x60]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x60]
push 0x14
mov dword [eax], ebx
mov eax, dword [ebp - 0x60]
mov dword [eax + 8], ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x5c], 0
call fcn.00468d54
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.00423050
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 0x10