Function at 0x44bed0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb60
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4c5bc4
call fcn.00453108
test bl, bl
je 0x44bf04
test al, 1
jne 0x44bf04
xor eax, eax
jmp 0x44c2b2
call fcn.00486b94
mov edi, eax
mov byte [0x4c8274], 0
xor eax, eax
call fcn.00449b0c
lea edx, [ebp - 0xa0]
mov eax, 0x4c5bc4
call fcn.004575cc
mov ecx, 0x4bdcb8
mov edx, 0x4bd8b8
mov eax, 0x4c5bc4
call fcn.00457598
mov edx, dword [ebp - 0x90]
mov dword [0x4bc468], edx
mov byte [0x4bbb86], bl
mov dword [0x4bc048], 1
xor ecx, ecx
mov dword [0x4bbb1c], ecx
xor eax, eax
mov dword [0x4bbb48], eax
call fcn.0044c2d4
lea edx, [ebp - 0x4a0]
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.00457598
lea edx, [ebp - 0x8a0]
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.0045756c
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x4a0]
push edx
cmp dword [ebp - 0x2c], 0
setne al
and eax, 1
push eax
mov eax, 0x4c8274
mov dl, byte [ebp + 8]
push edx
mov edx, 0x4a7940
call fcn.0044ce14
cmp byte [ebp - 1], 0
je 0x44bfd4
mov eax, 1
call fcn.0044af0c
test al, al
jne 0x44bfd4
xor eax, eax
jmp 0x44c2b2
cmp byte [ebp - 0x8a0], 0
jne 0x44c007
mov eax, 0x4c4e78
call fcn.0045de7c
mov esi, eax
mov eax, 0x4c4e78
call fcn.0045deb0
cmp esi, eax
jne 0x44c007
cmp dword [ebp - 0x2c], 0
je 0x44c003
cmp byte [ebp - 0xb], 0
je 0x44c007
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x44c01e
mov edx, 0x4a7941
mov eax, dword [0x4be4b8]
call fcn.0040fbf4
jmp 0x44c095
mov eax, 0x4c4e78
xor ecx, ecx
mov edx, dword [0x4be4b8]
call fcn.0045dfc4
test al, al
jne 0x44c03b
xor eax, eax
jmp 0x44c2b2
mov edx, dword [0x4be4b8]
cmp dword [edx + 0x30], 0
jne 0x44c095
lea ecx, [ebp - 0x8a0]
push ecx
lea eax, [ebp - 0xca0]
push eax
call fcn.00497c80
add esp, 8
cmp byte [ebp - 0xca0], 0
je 0x44c071
lea eax, [ebp - 0xca0]
call fcn.0040c22c
push 0x4a7941
lea edx, [ebp - 0xca0]
push edx
call fcn.00497ba4
add esp, 8
lea edx, [ebp - 0xca0]
mov eax, dword [0x4be4b8]
call fcn.0040fbf4
cmp dword [ebp - 0x2c], 0
je 0x44c117
cmp byte [ebp - 0xb], 0
jne 0x44c117
mov eax, 0x4c4e78
call fcn.0045de7c
mov esi, eax
test esi, esi
je 0x44c0c8
cmp byte [ebp - 0x8a0], 0
jne 0x44c117
mov eax, 0x4c4e78
call fcn.0045deb0
cmp esi, eax
jne 0x44c117
test esi, esi
jne 0x44c0d3
mov edx, 1
jmp 0x44c0f5
push 0x4bd8b8
push 0x44be31
push dword [0x4c4e64]
push 0x4a7943
push dword [0x4b2148]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x44c101
sub edx, 2
je 0x44c108
jmp 0x44c117
xor eax, eax
jmp 0x44c2b2
mov edx, 0x4a7941
mov eax, dword [0x4be4b8]
call fcn.0040fbf4
mov byte [ebp - 0x10a0], 0
test bl, bl
jne 0x44c180
cmp byte [0x4c8274], 0
je 0x44c180
cmp dword [0x4bba80], 5
je 0x44c180
lea ecx, [ebp - 0x10a0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4c8274
xor ecx, ecx
xor edx, edx
call fcn.0040a2c4
push 0x4c8274
call fcn.00499610
pop ecx
inc eax
jne 0x44c180
push 0x4c8274
mov eax, 0x1f7
call fcn.004125d0
push eax
call fcn.00486954
add esp, 8
xor eax, eax
jmp 0x44c2b2
mov eax, 0x4c5bc4
xor ecx, ecx
xor edx, edx
call fcn.0045249c
cmp byte [ebp - 0x10a0], 0
je 0x44c1a4
lea eax, [ebp - 0x10a0]
push eax
call fcn.00499610
pop ecx
call fcn.00486b94
cmp edi, eax
jne 0x44c1b6
cmp dword [0x4c7818], 0
je 0x44c1ba
xor edx, edx
jmp 0x44c1bf
mov edx, 1
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x44c227
test bl, bl
je 0x44c1f1
push 0x40
mov eax, 0x3a7
call fcn.004125d0
push eax
mov eax, 0x3a8
call fcn.004125d0
push eax
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
jmp 0x44c227
cmp dword [0x4bcc7c], 0
je 0x44c227
mov edx, 0x4bdcb8
mov eax, 0x4bd8b8
call fcn.0040a72c
test al, al
jne 0x44c227
mov eax, 0x4c4e78
call fcn.0045e1b0
test al, al
je 0x44c227
mov eax, 0x4c4e78
xor edx, edx
call fcn.00458864
mov byte [0x4c5414], 0
mov eax, 0x4c53e8
call fcn.0047c924
test bl, bl
jne 0x44c2af
cmp dword [0x4c7818], 0
jne 0x44c2af
cmp byte [0x4c8679], 0
je 0x44c2af
push 0x4c8274
call fcn.00497cb0
pop ecx
cmp eax, 0x3fe
jae 0x44c2af
push 0x4c8274
lea edx, [ebp - 0x14a0]
push edx
call fcn.00497c80
add esp, 8
lea eax, [ebp - 0x14a0]
call fcn.0040c22c
push 0x4a7954
lea edx, [ebp - 0x14a0]
push edx
call fcn.00497ba4
add esp, 8
push 1
push 0x4a7940
push 0
lea ecx, [ebp - 0x14a0]
push ecx
push 0x4a7956
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4