Function at 0x44f927
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4c5690]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
je 0x44f940
mov dword [eax + 0x14], edi
mov ebx, dword [ebp + 8]
mov eax, 0x10f48d
cmp ebx, eax
jg 0x44fc3f
je 0x44fc36
lea eax, [ebx - 0x1b207]
cmp eax, 0xd
ja case.0x44f965.111116
jmp dword [eax*4 + 0x44fc83]
push edi
push edi
mov ecx, esi
call fcn.004550b5
jmp 0x44fc79
mov ecx, dword [esi + 0xdc]
push 0xffffffffffffffff
push edi
call fcn.004781b6
jmp 0x44fc79
mov ecx, esi
call fcn.004592fe
jmp 0x44fc79
mov ecx, esi
call fcn.0045915f
jmp 0x44fc79
mov ecx, esi
call fcn.00458f77
jmp 0x44fc79
mov ecx, esi
call fcn.00458e75
jmp 0x44fc79
mov ecx, esi
call fcn.00454cfd
cmp eax, edi
je 0x44fc79
push eax
lea eax, [esi + 0x1c8]
add esi, 0x1cc
lea ecx, [ebp - 0xc]
neg eax
sbb eax, eax
and eax, esi
push dword [eax]
call fcn.00489980
push ecx
lea ecx, [ebp - 0xc]
mov eax, esp
push 0x8000
push eax
call fcn.00489a5c
call fcn.00402a6c
mov eax, esp
push ecx
fld st(0)
push ecx
fstp qword [esp]
push eax
fstp st(0)
call fcn.004199f1
add esp, 0xc
call fcn.0048f436
pop ecx
lea ecx, [ebp - 0xc]
call fcn.004893ad
jmp 0x44fc79
mov eax, dword [0x4af550]
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
mov eax, 0x400
push eax
push eax
call fcn.00403c58
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00403cd2
mov edi, 0x1b210
cmp ebx, edi
jle 0x44fa78
push str.SysWOW64_
lea ecx, [ebp - 0x10]
call fcn.00403927
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 8]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x10]
jmp 0x44fa97
push str.System32_
lea ecx, [ebp - 0x14]
call fcn.00403927
mov eax, dword [ebp - 0x14]
lea ecx, [ebp + 8]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x14]
call fcn.004038fb
mov ecx, esi
call fcn.00454cfd
test eax, eax
je 0x44fc1d
push eax
lea eax, [esi + 0x1c8]
add esi, 0x1cc
lea ecx, [ebp - 0x34]
neg eax
sbb eax, eax
and eax, esi
push dword [eax]
call fcn.00489980
mov eax, dword [0x4af550]
mov esi, str.regsvr32.exe
mov dword [ebp - 8], eax
mov eax, esi
test eax, eax
je 0x44fae2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.00403bd8
lea eax, [ebp + 8]
lea ecx, [ebp - 8]
push eax
call fcn.00403a8c
push 0x4bc550
lea ecx, [ebp - 4]
call fcn.00403927
cmp ebx, edi
je 0x44fb11
cmp ebx, 0x1b212
jne 0x44fb35
push 0x4b57dc
lea ecx, [ebp - 0x18]
call fcn.00403927
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x18]
call fcn.004038fb
push 0x4b0254
lea ecx, [ebp - 0x20]
call fcn.00403927
push 0x4b57d8
lea ecx, [ebp - 0x1c]
call fcn.00403927
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push 0x8000
push eax
call fcn.00489a5c
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00403b20
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x28]
call fcn.004038fb
lea ecx, [ebp - 0x2c]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
xor esi, esi
lea ecx, [ebp - 8]
push esi
mov dword [ebp - 0x70], 0x3c
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x4b0138
call fcn.00403c58
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x60], eax
call fcn.00403c58
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x50], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x34]
call fcn.004893ad
lea ecx, [ebp + 8]
call fcn.004038fb
jmp 0x44fc79
push 1
jmp 0x44fc2d
push 2
mov ecx, esi
call fcn.00455247
jmp 0x44fc79
mov ecx, esi
call fcn.00458e06
jmp 0x44fc79
mov eax, ebx
sub eax, 0x10f48e
je 0x44fc72
dec eax
je 0x44fc69
dec eax
dec eax
je 0x44fc53
xor eax, eax
jmp 0x44fc7c
push edi
push 0xa76c
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44fc79
mov ecx, esi
call fcn.00458d06
jmp 0x44fc79
mov ecx, esi
call fcn.00458cb6
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4