Function at 0x440ad9
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x557b14]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x10c]
xor ebx, ebx
cmp byte [eax], bl
push edi
mov dword [esp + 0x24], esi
je 0x4412c6
push 0xfffffffffffffffd
push 0x579560
mov byte [eax], bl
mov eax, dword [esi]
push 0x53ccb4
call dword [eax + 0x24]
cmp eax, ebx
je 0x440b2c
mov ebx, eax
call fcn.0041a39b
xor ebx, ebx
mov eax, dword [esi]
push 0xfffffffffffffffd
mov edi, 0x579dd0
push edi
push str.obtprize
mov ecx, esi
call dword [eax + 0x24]
cmp eax, ebx
je 0x440b4f
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx]
mov edi, eax
jmp 0x440b51
xor edi, edi
cmp edi, ebx
je 0x440b9d
mov esi, dword [edi]
sub esp, 0x1c
mov ecx, esp
push str.closewnd
call fcn.00401516
mov ecx, edi
call dword [esi + 0x60]
fld dword [0x544f30]
fstp dword [esp + 0x18]
lea ecx, [edi + 0x3c]
fld dword [0x544cdc]
mov eax, dword [ecx]
fstp dword [esp + 0x1c]
sub esp, 0xc
fldz
mov edi, esp
fstp dword [esp + 0x2c]
lea esi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x10]
mov esi, dword [esp + 0x24]
call fcn.004434ea
push 7
pop ecx
call fcn.00443464
dec eax
je 0x440fe5
dec eax
je 0x440e3b
dec eax
jne 0x441321
push str.khufu_title3.ogg
mov eax, esi
call fcn.0043ff2f
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440c44
fld dword [0x544c68]
mov ecx, 0xffffe1b9
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f2c]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544f28]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544b44]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.fawnscript.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push str.finwnd_l1_3
push str.txt1
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x440c46
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x440c5d
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440ce2
fld dword [0x544c78]
mov ecx, 0xff80ff80
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f24]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544cf0]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544ba0]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.berlin.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push 0x53ea68
push str.txt2
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x440ce4
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x440cfb
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440d80
fld dword [0x544f20]
mov ecx, 0xffffe1b9
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f1c]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544f18]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544f14]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.fawnscript.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push str.finwnd_l3_3
push str.txt3
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x440d82
xor eax, eax
fld dword [0x543c88]
mov ecx, dword [0x57b4c8]
fstp dword [eax + 0xa4]
cmp byte [ecx + 0x36], bl
je 0x440da5
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440e28
fld dword [0x544f10]
or ecx, 0xffffffff
fstp dword [esp + 0x18]
fld dword [0x544df8]
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544f0c]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544f08]
push 0x16
push ecx
sub esp, 0xc
mov edi, esp
push str.fawnscript.cug_fnt
push 1
push str.finwnd_l4_3
push str.txt4
fstp dword [esp + 0x3c]
lea esi, [esp + 0x38]
fldz
mov ebx, eax
fstp dword [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x440e2a
xor eax, eax
fld dword [0x543c88]
fstp dword [eax + 0xa4]
jmp 0x4412a1
push str.khufu_title2.ogg
mov eax, esi
call fcn.0043ff2f
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440ec0
fld dword [0x544c68]
mov ecx, 0xffffe1b9
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f2c]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544f0c]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544f04]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.fawnscript.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push str.finwnd_l1_2
push str.txt1
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x440ec2
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x440ed9
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440f5e
fld dword [0x544c78]
mov ecx, 0xff80ff80
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f24]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544cdc]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544110]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.berlin.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push 0x53ea38
push str.txt2
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x440f60
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x440f77
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x440e28
fld dword [0x544f20]
mov ecx, 0xffffe1b9
fstp dword [esp + 0x18]
fld dword [0x544f1c]
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544f18]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544f00]
push 0x16
push ecx
sub esp, 0xc
mov edi, esp
push str.fawnscript.cug_fnt
push 1
push str.finwnd_l3_2
push str.txt3
jmp 0x440e08
push str.khufu_title1.ogg
mov eax, esi
call fcn.0043ff2f
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x44106a
fld dword [0x544c68]
mov ecx, 0xffffe1b9
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f2c]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544f0c]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544efc]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.fawnscript.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push str.finwnd_l1_1
push str.txt1
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x44106c
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x441083
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x441108
fld dword [0x544c78]
mov ecx, 0xff80ff80
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544f24]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544cdc]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x54427c]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.berlin.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push 0x53e9e4
push str.txt2
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x44110a
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x441121
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x4411a6
fld dword [0x544f20]
mov ecx, 0xffffe1b9
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544ef8]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x5440fc]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x54482c]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.fawnscript.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push str.finwnd_l3_1
push str.txt3
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x4411a8
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x4411bf
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa0
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x441218
fld dword [0x544f30]
push 4
fstp dword [esp + 0x10]
push 1
fld dword [0x544ef4]
sub esp, 0xc
fstp dword [esp + 0x24]
mov edi, esp
fldz
lea esi, [esp + 0x20]
fstp dword [esp + 0x28]
push str.setss
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
movsd dword es:[edi], dword [esi]
call fcn.0042d68b
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x44121a
xor eax, eax
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
push 0xa8
call fcn.004e0321
cmp eax, ebx
pop ecx
je 0x44129f
fld dword [0x543fe0]
mov ecx, 0xffe1e1e1
fstp dword [esp + 0x18]
lea esi, [esp + 0xc]
fld dword [0x544b58]
mov ebx, eax
fstp dword [esp + 0x1c]
push dword [esp + 0x1c]
fld dword [0x544cdc]
push dword [esp + 0x1c]
fstp dword [esp + 0x14]
fld dword [0x544ef0]
push 0x16
fstp dword [esp + 0x1c]
fldz
push ecx
sub esp, 0xc
fstp dword [esp + 0x30]
mov edi, esp
movsd dword es:[edi], dword [esi]
push str.fawnscript.cug_fnt
push 1
movsd dword es:[edi], dword [esi]
push str.finwnd_l4_1
push str.txt4
movsd dword es:[edi], dword [esi]
call fcn.00423848
mov esi, dword [esp + 0x24]
xor ebx, ebx
jmp 0x4412a1
xor eax, eax
mov ecx, dword [0x57b4c8]
cmp byte [ecx + 0x36], bl
je 0x4412b8
fld dword [0x543a34]
fstp dword [eax + 0xa0]
mov edx, dword [esi]
push ebx
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call dword [edx + 0x10]
jmp 0x441321
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 1
jne 0x44131c
lea eax, [esp + 0x28]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x134]
push str.desk.cpl_InstallScreenSaver__sSaqScreenSaver.scr
push eax
call fcn.004e116e
add esp, 0xc
push 1
push ebx
lea eax, [esp + 0x138]
push eax
push str.rundll32.exe
push 0x537b7c
push dword [0x577ac8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x441321
mov eax, dword [esi]
call dword [eax + 0x6c]
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
xor eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.004e0010
mov esp, ebp
pop ebp
ret 4