Function at 0x44d236
Capabilities:
Create process on windows
Create thread
Get common file path
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x45b0fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x834], eax
lea eax, [ebp - 0x830]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [ebp - 0x6a0]
push eax
mov dword [ebp - 0x6a0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
cmp dword [ebp - 0x690], 2
je 0x44d28f
mov dword [0x45b09c], ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0045086c
add esp, 0xc
push 0x104
mov edi, 0x45c2e4
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
push 0x45c3ec
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [0x45b09c], ebx
jne 0x44d341
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.0045086c
lea eax, [ebp - 0x20c]
push 0x45b0a0
push eax
call fcn.0045057c
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0045057c
lea eax, [ebp - 0x108]
push 0x458398
push eax
call fcn.0045058c
lea eax, [ebp - 0x108]
push eax
call fcn.004504ec
push eax
lea eax, [ebp - 0x108]
push eax
push 1
lea eax, [ebp - 0x20c]
push 0x458394
push eax
call fcn.0044e2bc
add esp, 0x3c
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
call fcn.0044e07c
pop ecx
mov edi, 0x45bddc
test al, al
je 0x44d382
cmp dword [0x45b09c], ebx
jne 0x44d38e
push ebx
push ebx
push 0x458388
push edi
push 0x4582c4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x45b09c], ebx
je 0x44d453
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.0045086c
lea eax, [ebp - 0x20c]
push 0x458314
push eax
call fcn.0045057c
lea eax, [ebp - 0x60c]
push edi
push eax
call fcn.0045057c
lea eax, [ebp - 0x60c]
push 0x4582f0
push eax
call fcn.0045058c
lea eax, [ebp - 0x60c]
push eax
call fcn.004504ec
push eax
lea eax, [ebp - 0x60c]
push eax
push 1
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0044e2bc
add esp, 0x3c
push 0x400f003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x45c648], eax
cmp dword [0x45b09c], ebx
je 0x44d453
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00450818
pop ecx
pop ecx
test eax, eax
jne 0x44d453
lea eax, [ebp - 0x844]
push eax
mov dword [ebp - 0x844], 0x45b0e8
mov dword [ebp - 0x840], 0x45040c
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x838], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x44d4b0
call fcn.0044d09c
cmp dword [0x45b09c], ebx
je 0x44d4c3
mov esi, 0x45b0e8
push esi
call fcn.0045000c
pop ecx
test al, al
jne 0x44d48f
push esi
call fcn.0045017c
pop ecx
test al, al
jne 0x44d48a
push edi
push esi
push 0x45b0d4
call fcn.0045008c
add esp, 0xc
call fcn.004500dc
push dword [0x45c648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044db4c
mov dword [ebp - 0x834], eax
cmp eax, ebx
je 0x44d4b0
call dword [ebp - 0x834]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00450674
leave
ret 0x10
push 0x458388
push dword [ebp - 0x834]
call fcn.00450818
pop ecx
pop ecx
test eax, eax
jne 0x44d49b
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x44eb6c
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x44f76c
push ebx
push ebx
call esi
push 0x927c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44d4f7