Function at 0x44f228
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
call fcn.00405a60
push 1
push 0xffffffffffffffff
push 0x597548
lea ecx, [ebp - 0x228]
call fcn.00408d60
push ebx
lea ecx, [ebp - 0x228]
cmp eax, 0xffffffff
jne 0x44f2bd
push 1
call fcn.00405df0
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret 4
inc eax
push eax
call fcn.004090c0
push 1
push 3
lea ecx, [ebp - 0x304]
call fcn.0044efc6
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x2f4]
mov eax, dword [eax + 4]
lea eax, [ebp + eax - 0x2f4]
mov edx, dword [eax + 0x14]
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x2f4]
mov eax, dword [eax + 4]
push edi
push 0x5984e0
lea eax, [ebp + eax - 0x2f4]
or dword [eax + 0x14], 8
push ecx
push 0x4ce09c
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x2f4]
push 0x4c958c
push eax
call fcn.0044dd0b
pop ecx
pop ecx
push eax
call fcn.0044de61
pop ecx
pop ecx
push eax
call fcn.0044dd0b
pop ecx
pop ecx
mov ecx, eax
call fcn.0044e24c
push eax
call fcn.0044df87
pop ecx
pop ecx
mov ecx, eax
call fcn.0044e24c
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.0044f186
cmp dword [ebp - 0x230], 8
mov eax, dword [ebp - 0x244]
jae 0x44f381
lea eax, [ebp - 0x244]
push eax
call fcn.004a2aec
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x244]
mov esi, eax
call fcn.00405df0
push 0x40
lea eax, [ebp - 0x344]
push ebx
push eax
call fcn.0049d850
add esp, 0xc
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x348], 0x44
call fcn.00421110
lea ecx, [ebp - 0x25c]
call fcn.00421170
push eax
lea eax, [ebp - 0x348]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x44f411
lea ecx, [ebp - 0x25c]
call fcn.00421120
cmp esi, ebx
je 0x44f3fa
push esi
call fcn.0049d8ca
pop ecx
lea ecx, [ebp - 0x304]
call fcn.0044dac6
push ebx
lea ecx, [ebp - 0x228]
jmp 0x44f2a3
push 0xffffffffffffffff
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp edi, 0x102
jne 0x44f481
lea ecx, [ebp - 0x25c]
call fcn.00421120
cmp esi, ebx
je 0x44f457
push esi
call fcn.0049d8ca
pop ecx
mov byte [ebp - 0x245], bl
lea ecx, [ebp - 0x304]
call fcn.0044dac6
push ebx
push 1
lea ecx, [ebp - 0x228]
call fcn.00405df0
mov al, byte [ebp - 0x245]
jmp 0x44f2ac
cmp al, bl
je 0x44f494
mov byte [ebp - 0x245], 1
cmp dword [ebp - 0x24c], ebx
je 0x44f49a
mov byte [ebp - 0x245], bl
lea ecx, [ebp - 0x25c]
call fcn.00421120
cmp esi, ebx
je 0x44f4b0
push esi
call fcn.0049d8ca
pop ecx
mov al, byte [ebp - 0x245]
mov byte [ebp - 0x245], al
jmp 0x44f45d