Function at 0x44cd8c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb60
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4c319c
call fcn.0045e2f0
test bl, bl
je 0x44cdc0
test al, 1
jne 0x44cdc0
xor eax, eax
jmp 0x44d16e
call fcn.0044e674
mov edi, eax
mov byte [0x4c6248], 0
xor eax, eax
call fcn.00457348
lea edx, [ebp - 0xa0]
mov eax, 0x4c319c
call fcn.00462744
mov ecx, 0x4bb2b4
mov edx, 0x4baeb4
mov eax, 0x4c319c
call fcn.00462710
mov edx, dword [ebp - 0x90]
mov dword [0x4b9a6c], edx
mov byte [0x4b918a], bl
mov dword [0x4b964c], 1
xor ecx, ecx
mov dword [0x4b9120], ecx
xor eax, eax
mov dword [0x4b914c], eax
call fcn.004420ce
lea edx, [ebp - 0x4a0]
mov eax, 0x4c319c
xor ecx, ecx
call fcn.00462710
lea edx, [ebp - 0x8a0]
mov eax, 0x4c319c
xor ecx, ecx
call fcn.004626e4
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x4a0]
push edx
cmp dword [ebp - 0x2c], 0
setne al
and eax, 1
push eax
mov eax, 0x4c6248
mov dl, byte [ebp + 8]
push edx
mov edx, 0x4a4d11
call fcn.0044daf8
cmp byte [ebp - 1], 0
je 0x44ce90
mov eax, 1
call fcn.00441f50
test al, al
jne 0x44ce90
xor eax, eax
jmp 0x44d16e
cmp byte [ebp - 0x8a0], 0
jne 0x44cec3
mov eax, 0x4c2454
call fcn.00468f10
mov esi, eax
mov eax, 0x4c2454
call fcn.00468f44
cmp esi, eax
jne 0x44cec3
cmp dword [ebp - 0x2c], 0
je 0x44cebf
cmp byte [ebp - 0xb], 0
je 0x44cec3
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x44ceda
mov edx, 0x4a4eb5
mov eax, dword [0x4bbab4]
call fcn.0040f77c
jmp 0x44cf51
mov eax, 0x4c2454
xor ecx, ecx
mov edx, dword [0x4bbab4]
call fcn.00469058
test al, al
jne 0x44cef7
xor eax, eax
jmp 0x44d16e
mov edx, dword [0x4bbab4]
cmp dword [edx + 0x30], 0
jne 0x44cf51
lea ecx, [ebp - 0x8a0]
push ecx
lea eax, [ebp - 0xca0]
push eax
call fcn.00494f58
add esp, 8
cmp byte [ebp - 0xca0], 0
je 0x44cf2d
lea eax, [ebp - 0xca0]
call fcn.0040bf64
push 0x4a4eb5
lea edx, [ebp - 0xca0]
push edx
call fcn.00494e7c
add esp, 8
lea edx, [ebp - 0xca0]
mov eax, dword [0x4bbab4]
call fcn.0040f77c
cmp dword [ebp - 0x2c], 0
je 0x44cfd3
cmp byte [ebp - 0xb], 0
jne 0x44cfd3
mov eax, 0x4c2454
call fcn.00468f10
mov esi, eax
test esi, esi
je 0x44cf84
cmp byte [ebp - 0x8a0], 0
jne 0x44cfd3
mov eax, 0x4c2454
call fcn.00468f44
cmp esi, eax
jne 0x44cfd3
test esi, esi
jne 0x44cf8f
mov edx, 1
jmp 0x44cfb1
push 0x4baeb4
push 0x443068
push dword [0x4c2440]
push str.ASKPROCESSVOLDLG
push dword [0x4af754]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x44cfbd
sub edx, 2
je 0x44cfc4
jmp 0x44cfd3
xor eax, eax
jmp 0x44d16e
mov edx, 0x4a4eb5
mov eax, dword [0x4bbab4]
call fcn.0040f77c
mov byte [ebp - 0x10a0], 0
test bl, bl
jne 0x44d03c
cmp byte [0x4c6248], 0
je 0x44d03c
cmp dword [0x4b9084], 5
je 0x44d03c
lea ecx, [ebp - 0x10a0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4c6248
xor ecx, ecx
xor edx, edx
call fcn.0040a0bc
push 0x4c6248
call fcn.004968ec
pop ecx
inc eax
jne 0x44d03c
push 0x4c6248
mov eax, 0x1f7
call fcn.0041202c
push eax
call fcn.0044e46c
add esp, 8
xor eax, eax
jmp 0x44d16e
mov eax, 0x4c319c
xor ecx, ecx
xor edx, edx
call fcn.0045d718
cmp byte [ebp - 0x10a0], 0
je 0x44d060
lea eax, [ebp - 0x10a0]
push eax
call fcn.004968ec
pop ecx
call fcn.0044e674
cmp edi, eax
jne 0x44d072
cmp dword [0x4c4df4], 0
je 0x44d076
xor edx, edx
jmp 0x44d07b
mov edx, 1
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x44d0e3
test bl, bl
je 0x44d0ad
push 0x40
mov eax, 0x3a7
call fcn.0041202c
push eax
mov eax, 0x3a8
call fcn.0041202c
push eax
push dword [0x4c2440]
call sub.USER32.DLL_MessageBoxA
jmp 0x44d0e3
cmp dword [0x4ba27c], 0
je 0x44d0e3
mov edx, 0x4bb2b4
mov eax, 0x4baeb4
call fcn.0040a504
test al, al
jne 0x44d0e3
mov eax, 0x4c2454
call fcn.00469244
test al, al
je 0x44d0e3
mov eax, 0x4c2454
xor edx, edx
call fcn.00463974
mov byte [0x4c29f0], 0
mov eax, 0x4c29c4
call fcn.00449644
test bl, bl
jne 0x44d16b
cmp dword [0x4c4df4], 0
jne 0x44d16b
cmp byte [0x4c664d], 0
je 0x44d16b
push 0x4c6248
call fcn.00494f88
pop ecx
cmp eax, 0x3fe
jae 0x44d16b
push 0x4c6248
lea edx, [ebp - 0x14a0]
push edx
call fcn.00494f58
add esp, 8
lea eax, [ebp - 0x14a0]
call fcn.0040bf64
push 0x4a4db5
lea edx, [ebp - 0x14a0]
push edx
call fcn.00494e7c
add esp, 8
push 1
push 0x4a4d11
push 0
lea ecx, [ebp - 0x14a0]
push ecx
push 0x4a5805
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4