Function at 0x44cf80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x64], 0
mov eax, dword [ebp + 8]
test eax, eax
jl case.default.0x44cf9f
cmp eax, 4
jg case.default.0x44cf9f
jmp dword [eax*4 + 0x46d9a4]
mov dword [0x497450], 0x16
or eax, 0xffffffff
jmp 0x44d1c5
mov dword [ebp - 0x68], ebx
jmp 0x44cfcf
inc ebx
cmp byte [ebx], 0
jne 0x44cfbd
cmp byte [ebx + 1], 0
je 0x44cfcf
mov eax, ebx
inc ebx
mov byte [eax], 0x20
cmp byte [ebx], 0
jne 0x44cfbe
lea edx, [ebp - 0x50]
mov ecx, 0x44
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [ebp - 0x50], 0x44
mov esi, dword [0x49c924]
jmp 0x44cff6
dec esi
test esi, esi
je 0x44d013
lea eax, [esi - 1]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
cmp byte [eax + edx*8 + 4], 0
je 0x44cff5
mov eax, esi
mov edx, 5
mul edx
add eax, 4
mov word [ebp - 0x1e], ax
push 1
movzx eax, word [ebp - 0x1e]
push eax
call fcn.0044d870
add esp, 8
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [edx], esi
xor edi, edi
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [ebp - 0x1c]
lea eax, [edx + eax + 4]
mov dword [ebp - 8], eax
jmp 0x44d0a2
mov eax, edi
and eax, 0x1f
mov edx, edi
sar edx, 5
mov edx, dword [edx*4 + 0x49c928]
lea eax, [edx + eax*8]
mov dword [ebp - 0xc], eax
test byte [eax + 4], 0x10
jne 0x44d087
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 4]
mov byte [edx], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [edx], eax
jmp 0x44d095
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov edx, dword [ebp - 8]
or eax, 0xffffffff
mov dword [edx], eax
inc edi
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp edi, esi
jl 0x44d053
cmp dword [ebp + 8], 4
jne 0x44d0fa
xor edi, edi
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [ebp - 0x1c]
lea eax, [edx + eax + 4]
mov dword [ebp - 8], eax
jmp 0x44d0e0
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov edx, dword [ebp - 8]
or eax, 0xffffffff
mov dword [edx], eax
inc edi
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp esi, 3
jge 0x44d0ea
mov dword [ebp - 0x70], esi
jmp 0x44d0f1
mov dword [ebp - 0x70], 3
cmp edi, dword [ebp - 0x70]
jl 0x44d0c5
or dword [ebp - 0x64], 8
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x64]
push eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x44d149
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004471f0
pop ecx
mov eax, dword [ebp - 0x70]
push eax
call fcn.0044c2e0
pop ecx
or eax, 0xffffffff
jmp 0x44d1c5
mov dword [0x497450], 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004471f0
pop ecx
cmp dword [ebp + 8], 2
jne 0x44d16d
push 0
call fcn.00449f90
pop ecx
jmp 0x44d1b8
cmp dword [ebp + 8], 0
jne 0x44d199
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44d1b8
cmp dword [ebp + 8], 4
jne 0x44d1b2
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6c], 0
jmp 0x44d1b8
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret