Function at 0x440c24
Capabilities:
Create process on windows

Disassembly:
push 0xa4
mov eax, 0x497acd
call fcn.00464960
mov ebx, ecx
cmp byte [ebx + 0x2a0], 0
jne 0x440dd9
call dword [0x4bda04]
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0x110]
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 0xb0], eax
jb 0x440c62
mov edi, dword [eax + 4]
jmp 0x440c65
lea edi, [eax + 4]
test edi, edi
je 0x440c7b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x440c7f
xor eax, eax
jmp 0x440c94
lea eax, [esi + esi]
call fcn.00467b60
mov eax, esp
push dword [ebp - 0x14]
push esi
push edi
push eax
call fcn.0042fd56
push eax
lea ecx, [ebp - 0xac]
call fcn.004041c2
xor eax, eax
cmp dword [ebx + 0x80], 0x10
mov dword [ebp - 4], eax
jb 0x440cb3
mov ebx, dword [ebx + 0x6c]
jmp 0x440cb6
add ebx, 0x6c
cmp ebx, eax
je 0x440ce5
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x440cd0
xor eax, eax
jmp 0x440ce5
lea eax, [esi + esi]
call fcn.00467b60
mov eax, esp
push dword [ebp - 0x14]
push esi
push ebx
push eax
call fcn.0042fd56
push eax
lea ecx, [ebp - 0x58]
call fcn.004041c2
mov eax, dword [ebp - 0x54]
xor ebx, ebx
push 8
inc ebx
pop esi
cmp dword [ebp - 0x40], esi
mov byte [ebp - 4], bl
jae 0x440d02
lea eax, [ebp - 0x54]
push eax
call fcn.00412e56
test al, al
pop ecx
push 0
jne 0x440d25
push ebx
lea ecx, [ebp - 0x58]
call fcn.004021c5
push 0
lea ecx, [ebp - 0xac]
jmp 0x440f96
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x5c], 0xf
call fcn.004022f1
and word [ebp - 0x20], 0
xor eax, eax
cmp dword [ebp - 0x40], esi
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 2
jae 0x440d58
lea eax, [ebp - 0x54]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004041c2
call fcn.0040910a
add esp, 0x24
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x74]
call fcn.00416403
test eax, eax
je 0x440da1
xor esi, esi
push esi
push ebx
lea ecx, [ebp - 0x74]
call fcn.004020a2
push esi
push ebx
lea ecx, [ebp - 0x58]
call fcn.004021c5
lea ecx, [ebp - 0xac]
jmp 0x440f95
cmp dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x54]
jae 0x440dac
lea eax, [ebp - 0x54]
push eax
call fcn.00459413
test eax, eax
pop ecx
jne 0x440dcb
cmp dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x54]
jae 0x440dc2
lea eax, [ebp - 0x54]
push eax
call fcn.004379a8
pop ecx
jmp 0x440d80
lea eax, [ebp - 0xac]
push eax
call fcn.0040d776
jmp 0x440dc8
call fcn.0040650e
test eax, eax
je 0x440f9c
call dword [0x4bda04]
cmp dword [ebx + 0x80], 0x10
mov dword [ebp - 0xb0], eax
jb 0x440e00
mov edi, dword [ebx + 0x6c]
jmp 0x440e03
lea edi, [ebx + 0x6c]
test edi, edi
je 0x440e19
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x440e1d
xor eax, eax
jmp 0x440e35
lea eax, [esi + esi]
call fcn.00467b60
mov eax, esp
push dword [ebp - 0xb0]
push esi
push edi
push eax
call fcn.0042fd56
push eax
lea ecx, [ebp - 0x3c]
call fcn.004041c2
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
push 3
pop esi
mov dword [ebp - 4], esi
jae 0x440e50
lea eax, [ebp - 0x38]
push eax
call fcn.00412e56
test al, al
pop ecx
push 0
jne 0x440e67
push 1
lea ecx, [ebp - 0x3c]
jmp 0x440f97
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x78], 0xf
call fcn.004022f1
and word [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x38]
push 8
pop edi
cmp dword [ebp - 0x24], edi
mov byte [ebp - 4], 4
jae 0x440ea3
lea eax, [ebp - 0x38]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb0], esp
push eax
call fcn.004041c2
call fcn.0040910a
add esp, 0x24
add ebx, 0x110
push ebx
lea ecx, [ebp - 0x90]
call fcn.00416403
test eax, eax
je 0x440f14
push 0x4a340c
push 0x4a0a40
push 0x4a0d24
push esi
push str.CNewUpdateMgr::OnGetUpdatePackage
push 0x245
push str..NewUpdateNewUpdateMgr.cpp
call fcn.00412e7f
add esp, 0x1c
xor ebx, ebx
push 0
inc ebx
push ebx
lea ecx, [ebp - 0x90]
call fcn.004020a2
push 0
lea ecx, [ebp - 0x3c]
jmp 0x440f96
cmp dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x38]
jae 0x440f1f
lea eax, [ebp - 0x38]
push eax
call fcn.00459413
test eax, eax
pop ecx
jne 0x440f65
push str.peW__rT_h
push 0x4a0a40
push 0x4a0d24
push esi
push str.CNewUpdateMgr::OnGetUpdatePackage
push 0x24b
push str..NewUpdateNewUpdateMgr.cpp
call fcn.00412e7f
mov eax, dword [ebp - 0x38]
add esp, 0x1c
cmp dword [ebp - 0x24], edi
jae 0x440f5c
lea eax, [ebp - 0x38]
push eax
call fcn.004379a8
pop ecx
jmp 0x440ef9
cmp dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x38]
jae 0x440f70
lea eax, [ebp - 0x38]
xor esi, esi
push esi
push esi
push str.__install
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x90]
call fcn.004020a2
lea ecx, [ebp - 0x3c]
push esi
push ebx
call fcn.004021c5
lea esp, [ebp - 0xc0]
call fcn.004649e3
ret