Function at 0x44cb80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
test byte [0x5988d4], 0x40
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], esi
je 0x44cbba
mov edx, dword [esi]
push 0xb
push 0
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
test eax, eax
mov edx, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 5
je 0x44cc1c
cmp byte [eax], 0x2d
jne 0x44cc1c
push 0x6e
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x44cbf6
mov dword [esp + 0x1c], 7
mov eax, dword [esi + 4]
push 0x70
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x44cc10
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 2
mov edx, dword [esp + 0x10]
mov eax, dword [esi + edx*4]
test eax, eax
lea ebx, [esi + edx*4]
jne 0x44cc3a
mov edx, dword [esi]
push eax
push eax
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [eax], 0x22
jne 0x44cc6c
push 0
push 0x104
push edi
mov ecx, esi
call fcn.004ede70
test eax, eax
jge 0x44cd77
mov edx, dword [esi]
push 3
push 0
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 0
cmp dword [ebx], 0
je 0x44cd7c
mov dword [esp + 0x24], ebx
lea esp, [esp]
cmp byte [edi], 0
je 0x44ccd6
mov al, byte [edi + 1]
test al, al
je 0x44ccd6
mov ecx, dword [ebx]
push 0x3a
push ecx
call fcn.00563730
add esp, 8
test eax, eax
jne 0x44cd7c
mov esi, dword [ebp + 8]
push esi
push 0x576d8c
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
ja 0x44cd7f
dec edi
jmp 0x44ccc0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44ccc0
mov dx, word [0x575258]
mov word [edi], dx
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44cce0
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44ccf0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, dword [ebx]
mov edx, esi
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x44cd10
mov edx, 0x576d84
mov ecx, esi
call fcn.0041d600
test eax, eax
jne 0x44cd6f
mov edx, 0x576d7c
mov ecx, esi
call fcn.0041d600
test eax, eax
jne 0x44cd6f
mov edx, 0x576d74
mov ecx, esi
call fcn.0041d600
test eax, eax
mov edi, dword [esp + 0x14]
jne 0x44cd73
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add ebx, 4
inc edx
test eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ebx
jne 0x44cc80
jmp 0x44cd7c
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
mov edx, esi
mov byte [esi], 0
call fcn.004ed300
cmp byte [edi], 0
jne 0x44cdae
cmp byte [esi], 0
je 0x44cdae
mov edx, edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44cda2
mov byte [esi], cl
xor eax, eax
mov ecx, 0xf9
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
test eax, eax
mov edi, dword [esp + 0x14]
je 0x44ce01
push 0x5902c8
push 0x5901c8
push 0x5900c8
push 0x5900c0
push edi
call fcn.00563b42
push 0x5900c8
push 0x5900c0
lea ecx, [esp + 0x44]
push 0x574904
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov al, byte [esp + 0x28]
test al, al
jne 0x44ce1f
xor eax, eax
jmp 0x44ce10
mov cl, byte [eax + 0x598248]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x44ce10
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x5a1b00]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
push edi
push 0
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x1f
jae 0x44ce58
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
push 4
push edi
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4