Function at 0x404440
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x368
lea eax, [esp + 0x264]
push ebx
push ebp
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [esp + 0x37c]
push 0x5c
push esi
call fcn.004069b0
mov edi, eax
xor ebx, ebx
add esp, 8
cmp edi, ebx
je 0x404479
mov byte [edi], bl
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
call ebp
cmp edi, ebx
je 0x404489
mov byte [edi], 0x5c
push 0x2e
push esi
call fcn.004069b0
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x40464f
push str..tlb
push edi
call fcn.004098c0
add esp, 8
test eax, eax
jne 0x404563
mov ecx, 0x81
lea edi, [esp + 0x6e]
mov word [esp + 0x6c], bx
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x70]
push ecx
push 0xffffffffffffffff
push esi
push ebx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x10]
lea eax, [esp + 0x6c]
push edx
push eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
test eax, eax
jne 0x404555
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x404555
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x40454b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
push ecx
mov cx, word [eax + 0x1a]
push edx
mov dx, word [eax + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.OLEAUT32.dll_VarDecFix]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call esi
jmp 0x404645
push str..exe
push edi
call fcn.004098c0
add esp, 8
test eax, eax
jne 0x404605
mov ecx, 0x40
lea edi, [esp + 0x6d]
mov byte [esp + 0x6c], bl
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40c210
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x6c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
call esi
lea ecx, [esp + 0x6c]
push str.___unregserver
push ecx
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
xor edx, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x20], edx
push ecx
push ebx
mov dword [esp + 0x2c], edx
push ebx
push ebx
mov dword [esp + 0x38], edx
push ebx
push ebx
lea edx, [esp + 0x88]
push ebx
push edx
push ebx
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404645
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call edi
cmp esi, ebx
je 0x40463f
push str.DllUnregisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404638
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
lea eax, [esp + 0x274]
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret