Function at 0x44919c
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x84], ebp
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x450360
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xorps xmm0, xmm0
lea ecx, [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
movaps xmmword [ecx], xmm0
mov dword [eax + 8], 0
push 4
push 0x79ade4
call fcn.004051ae
mov dword [esi + 0x98], 4
lea eax, [esi + 0x30]
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f590
mov eax, dword [esi + 0x20]
cmp dword [esi + 0x24], 8
lea edx, [esi + 0x10]
jb 0x449225
mov edx, dword [esi + 0x10]
lea ebx, [esi + 0x30]
mov ecx, ebx
push eax
push edx
call fcn.004243f0
mov edi, eax
mov eax, dword [ebx + 0x14]
cmp eax, 8
jb 0x44924e
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x30]
call fcn.00404bbf
add esp, 8
mov eax, dword [esi + 0x24]
cmp eax, 8
jb 0x449269
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x10]
call fcn.00404bbf
add esp, 8
test edi, edi
je 0x449275
xor ebx, ebx
inc ebx
jmp 0x44941b
xorps xmm0, xmm0
movsd qword [esi + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [esi + 0x30], xmm0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 8
mov edx, ecx
jb 0x449294
mov edx, dword [ecx]
mov dword [esi + 0x98], 0
lea ecx, [esi + 0x30]
push eax
push edx
call fcn.00405036
xorps xmm0, xmm0
lea ecx, [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
movaps xmmword [ecx], xmm0
mov dword [esi + 0x98], 1
push 8
push str..bak.exe
call fcn.004051ae
mov dword [esi + 0x98], 3
lea ecx, [esi + 0x30]
lea eax, [esi + 0x10]
push eax
call fcn.0041d5ee
mov eax, dword [esi + 0x24]
cmp eax, 8
jb 0x449300
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x10]
call fcn.00404bbf
add esp, 8
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0xffff
cmp dword [esi + 0x44], 8
lea ebx, [esi + 0x10]
lea eax, [esi + 0x30]
jb 0x44931d
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push 3
push ebx
push eax
call fcn.00541431
lea edi, [esi + 0x4c]
mov dword [edi + 8], eax
mov ecx, edi
push ebx
push eax
call fcn.0041028a
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], 0x727124
test eax, eax
je 0x449354
cmp eax, 1
mov edi, dword [ebp + 8]
je 0x44935f
jmp 0x449391
test ecx, ecx
mov edi, dword [ebp + 8]
jne 0x44946d
cmp dword [esi + 0x44], 8
jb 0x44936a
mov eax, dword [esi + 0x30]
jmp 0x44936d
lea eax, [esi + 0x30]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x449377
mov ecx, dword [edi]
push 0
push eax
push ecx
call fcn.0054123c
test edx, edx
jne 0x449433
test al, 1
jne 0x449391
xor ebx, ebx
inc ebx
jmp 0x449400
xorps xmm0, xmm0
lea ecx, [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
movaps xmmword [ecx], xmm0
mov dword [esi + 0x98], 1
push 0xd
push str.._ShimRun.exe
call fcn.004051ae
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4493c5
mov eax, dword [edi]
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x4493d1
mov ecx, dword [esi + 0x10]
push 2
push eax
push ecx
call fcn.0054123c
test edx, edx
jne 0x449450
mov ebx, eax
not ebx
mov eax, dword [esi + 0x24]
cmp eax, 8
jb 0x4493fd
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x10]
call fcn.00404bbf
add esp, 8
and ebx, 1
mov eax, dword [esi + 0x44]
cmp eax, 8
jb 0x44941b
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x30]
call fcn.00404bbf
add esp, 8
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [esi + 0x98], 1
lea eax, [esi + 0x30]
push eax
push edi
push edx
push str.copy_file
call fcn.00428036
add esp, 0x10
mov dword [esi + 0x98], 2
lea eax, [esi + 0x10]
push edi
push eax
push edx
push str.copy_file
call fcn.00428036
add esp, 0x10
mov dword [esi + 0x98], 1
lea eax, [esi + 0x30]
lea ecx, [esi + 0x64]
push eax
push ecx
push 0x7924a0
call fcn.004101d4
add esp, 0xc
lea esi, [ebp - 0x9c]
mov ebp, dword [esi + 0x84]
mov ebx, dword [esi + 0xc]
jmp 0x44941b