Function at 0x4441e2
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x4566b4]
mov edx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov ecx, 0x9cb0
cmp eax, ecx
push edi
mov dword [ebp - 0x308], edx
jg 0x444487
je 0x44447c
lea ecx, [eax - 0x9c43]
cmp ecx, 0x4a
ja case.0x44422f.40004
movzx ecx, byte [ecx + 0x4446c6]
jmp dword [ecx*4 + 0x44468a]
call fcn.0041f0e7
neg al
sbb al, al
inc al
push eax
call fcn.0041f14e
jmp 0x44467b
push 0x405e90
call fcn.0044e6eb
jmp 0x44467b
push edx
call fcn.00411b38
jmp 0x44467b
call fcn.004407bd
lea ecx, [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x44467b
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x44467b
or dword [esi + 0x4c], 0x20
mov eax, dword [ecx + 0x60]
and al, 0xf
dec al
neg al
sbb eax, eax
neg eax
push eax
call fcn.0043d659
jmp 0x44467b
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x44467b
or dword [esi + 0x4c], 0x20
mov eax, dword [ecx + 0x60]
xor edx, edx
and al, 0xf
cmp al, 2
setne dl
push edx
call fcn.0043d69c
jmp 0x44467b
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x44467b
or dword [esi + 0x4c], 0x20
mov eax, dword [ecx + 0x60]
not eax
and eax, 0x10
shr eax, 4
push eax
call fcn.0043d6de
jmp 0x44467b
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x44467b
or dword [esi + 0x4c], 0x20
mov eax, dword [ecx + 0x60]
not eax
and eax, 0x80
shr eax, 7
push eax
call fcn.0043d717
jmp 0x44467b
or dword [esi + 0x4c], 0x20
mov ecx, esi
call fcn.00442fb8
neg eax
sbb eax, eax
inc eax
push eax
mov ecx, esi
call fcn.00442fd3
jmp 0x44467b
push 0
push 1
mov ebx, 0x80000001
push ebx
push dword [0x4565f8]
lea ecx, [ebp - 0x340]
call fcn.0044dbd9
push 0
mov edi, 0x401c20
push edi
lea ecx, [ebp - 0x340]
call fcn.0044dd85
test eax, eax
je 0x4443eb
mov esi, dword [esi + 0x10]
push 0x14
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x12d
call fcn.0040db29
push eax
push 0x200
lea eax, [ebp - 0x304]
push eax
push 0x4e6c
call fcn.0040db29
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
lea ecx, [ebp - 0x340]
je 0x4443b3
call fcn.0044df2e
jmp 0x44467b
push 0
push edi
call fcn.0044dce1
push 0
push 1
push ebx
push 0x405f5c
lea ecx, [ebp - 0x35c]
call fcn.0044dbd9
push 0x405f44
lea ecx, [ebp - 0x35c]
call fcn.0044dd55
lea ecx, [ebp - 0x35c]
call fcn.0044df2e
push 0
push 1
push 0x80000002
push 0x4027d4
lea ecx, [ebp - 0x324]
call fcn.0044dbd9
push 0xffffffffffffffff
push 0x4027d0
lea ecx, [ebp - 0x324]
call fcn.0044dd85
cmp eax, 0xffffffff
je 0x44443b
push 0
push 0x43acde
push dword [ebp - 0x308]
push 0x4ea4
push dword [0x4567b8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x444446
push dword [ebp - 0x308]
call fcn.0043abf1
lea ecx, [ebp - 0x324]
call fcn.0044df2e
lea ecx, [ebp - 0x340]
jmp 0x4443a9
push 0
push edx
call fcn.0041fee2
jmp 0x44467b
mov ecx, dword [esi + 0x20]
push 0
push 0
push eax
push edx
call fcn.0041dd3a
jmp 0x44467b
push edx
call fcn.004116c0
jmp 0x44467b
cmp eax, 0x9cf6
jg 0x44458b
cmp eax, 0x9cf5
jge 0x444580
mov ecx, 0x9cce
cmp eax, ecx
jg 0x444533
je 0x4444f3
mov ecx, eax
sub ecx, 0x9cb7
je 0x4444e6
sub ecx, 8
je 0x4444db
sub ecx, 9
je case.0x44422f.40009
dec ecx
jne case.0x44422f.40004
push edx
call fcn.00411658
push 0x200
jmp 0x4445ed
push edx
call fcn.0040bb71
jmp 0x44467b
push dword [esi + 0x20]
call fcn.00424980
jmp 0x44467b
call fcn.0040bc89
cmp eax, 1
jne 0x444523
call fcn.0040c8aa
test al, al
jne 0x444519
call fcn.0040c8bc
test al, al
jne 0x444519
call fcn.0040cdc7
jmp 0x44467b
call fcn.0040cf39
jmp 0x44467b
mov ecx, dword [0x456a1c]
call fcn.0041d8e7
jmp 0x44467b
cmp eax, 0x9cec
je case.0x44422f.40009
cmp eax, 0x9ced
je 0x444576
cmp eax, 0x9cee
jle case.0x44422f.40004
cmp eax, 0x9cf2
jle 0x444580
cmp eax, 0x7d01
jl 0x44467b
cmp eax, 0x7d33
jg 0x44467b
push eax
mov ecx, esi
call fcn.00442d82
jmp 0x44467b
call fcn.00411777
jmp 0x44467b
push eax
call fcn.00411a3b
jmp 0x44467b
mov ecx, 0x9d27
cmp eax, ecx
jg 0x444603
je 0x4445f9
mov ecx, eax
sub ecx, 0x9cf9
je 0x4445ea
sub ecx, 0x1a
je 0x4445c0
dec ecx
je 0x4445b7
sub ecx, 0x11
jne case.0x44422f.40004
call fcn.0040d5e0
jmp 0x44467b
mov ecx, esi
call fcn.00442fa5
jmp 0x4445c7
mov ecx, esi
call fcn.00442f92
mov esi, eax
test esi, esi
je 0x44467b
mov ecx, esi
call fcn.00447c2b
neg eax
sbb eax, eax
inc eax
push eax
mov ecx, esi
call fcn.00447bf5
jmp 0x44467b
push dword [ebp + 0x14]
mov ecx, esi
call fcn.004441b8
jmp 0x44467b
push dword [esi + 0x10]
call fcn.0043f4dd
jmp 0x44467b
cmp eax, 0x9d28
je 0x444636
cmp eax, 0x9e9a
jle case.0x44422f.40004
cmp eax, 0x9e9e
jle case.0x44422f.40009
cmp eax, 0x9eb7
jne case.0x44422f.40004
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x44467b
push eax
call fcn.0044284b
jmp 0x44467b
push 0
push 1
push 0x80000002
push 0x4027d4
lea ecx, [ebp - 0x324]
call fcn.0044dbd9
push 1
push 0x4027cc
lea ecx, [ebp - 0x324]
call fcn.0044dce1
lea ecx, [ebp - 0x324]
call fcn.0044df2e
push 0
push 0
push 0x10
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0044d575
leave
ret 0x10