Function at 0x449e60
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562148
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x630], 4
mov ebx, dword [ebp + 8]
jne 0x44a0fc
cmp byte [0x5bab3c], 0
jne 0x44a0fc
push 0
push str.localfilepath
push str.Software
lea eax, [ebp - 0x40]
mov byte [0x5bab3c], 1
push eax
call fcn.0043bdc0
mov dword [ebp - 4], 0
lea esi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae esi, dword [ebp - 0x40]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x449f04
push 0x30
push 0x59050c
push 0x590518
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x10
mov ecx, edi
call fcn.004452e0
jmp 0x44a0c6
cmp dword [ebp + 0xc], 0
jne 0x44a019
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x58bc94
mov edx, ebx
mov ecx, SysReAllocStringLen
call fcn.00417280
add esp, 8
test eax, eax
je 0x44a000
cmp dword [ebp - 0x18], 0
jbe 0x44a000
push str..exe
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x449f7b
push ecx
lea edx, [eax + 1]
mov ecx, esi
call fcn.00417040
add esp, 4
mov ebx, eax
jmp 0x449f9f
push 5
push 0
push 0
push esi
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb ebx, ebx
neg ebx
call fcn.004452a0
test eax, eax
je 0x449fc7
mov edx, 0x1869f
call fcn.00417670
push eax
push ebx
push str.typeshellcontentopenfilevalue_drnd_d
push str.http:__downloader.aldtop.com_client_debug
push edi
call fcn.004458a0
add esp, 0x14
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44a011
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44a007
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a11a
jmp 0x44a007
mov ebx, 1
jmp 0x449fca
push edx
push ecx
call fcn.00497d51
add esp, 8
test ebx, ebx
je 0x44a0c6
push esi
lea eax, [ebp - 0x28]
push str._select___s_
push eax
call fcn.00413710
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 5
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push str.explorer
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
push 0xf
sbb esi, esi
push str.Option
neg esi
call fcn.0043b1e0
test eax, eax
je 0x44a090
mov edx, 0x1869f
call fcn.00417670
push eax
push esi
push str.typeshellcontentopendirvalue_drnd_d
push str.http:__downloader.aldtop.com_client_debug
push edi
call fcn.004458a0
add esp, 0x14
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44a0c6
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44a0bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a11f
push edx
push ecx
call fcn.00497d51
add esp, 8
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x44a0fc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44a0f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a124
push edx
push ecx
call fcn.00497d51
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497d40
mov esp, ebp
pop ebp
ret 8
call fcn.00524a29
call fcn.00524a29
call fcn.00524a29
int3