Function at 0x44fcae
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2517
mov eax, dword fs:[0]
push eax
mov eax, 0x1374
call fcn.0045d530
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1378], edx
mov esi, ecx
mov dword [ebp - 0x1370], esi
xor ebx, ebx
mov dword [ebp - 0x1374], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x64
pop ecx
xor edx, edx
div ecx
lea eax, [edx + 1]
mov dword [ebp - 0x137c], eax
mov eax, dword [esi + 0x48]
mov dword [ebp - 0x136c], eax
lea eax, [ebp - 0x2d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x744]
call fcn.00410936
and dword [ebp - 4], ebx
lea eax, [ebp - 0x2d8]
push dword [esi]
push str._se_crashdump_
push eax
lea eax, [ebp - 0x744]
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
push 0x5f
pop edx
mov ecx, eax
call fcn.0041b2af
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
mov eax, dword [ebp - 0x1370]
push dword [eax + 0xc]
call fcn.004622ac
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.004108ce
push 0x5f
pop edx
mov ecx, eax
call fcn.0041b2af
push 0xa
mov esi, eax
lea eax, [ebp - 0x90]
push 0x20
push eax
mov eax, dword [ebp - 0x1370]
push dword [eax + 0x10]
call fcn.004622ac
lea eax, [ebp - 0x90]
push eax
push esi
call fcn.004108ce
add esp, 0x38
mov ecx, eax
push 0x5f
pop edx
call fcn.0041b2af
mov esi, eax
call edi
push 0xa
push 0x20
lea ecx, [ebp - 0xd0]
push ecx
push eax
call fcn.004622ac
add esp, 0x10
push str..zip
lea eax, [ebp - 0xd0]
push eax
push esi
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
lea ecx, [ebp - 0x744]
call fcn.00410b38
mov ecx, eax
call fcn.004577ec
mov esi, dword [ebp - 0x1370]
mov edi, eax
mov eax, dword [ebp - 0x136c]
mov dword [ebp - 0x1380], edi
cmp dword [ebp - 0x137c], eax
ja 0x44fe3e
push dword [ebp - 0x1378]
mov edx, esi
mov ecx, edi
call fcn.00450d6c
pop ecx
mov edx, esi
mov ecx, edi
call fcn.0045111c
mov eax, dword [ebp - 0x136c]
cmp dword [ebp - 0x137c], eax
ja 0x44fe67
cmp byte [ebp - 0x1378], 0
jne 0x44fe67
mov edx, esi
mov ecx, edi
call fcn.00450220
lea eax, [esi + 0x3c]
xor edi, edi
mov ecx, eax
mov dword [ebp - 0x136c], eax
call fcn.004115e4
test eax, eax
je 0x44ffa0
mov esi, dword [ebp - 0x136c]
push ecx
push ecx
push edi
mov ecx, esi
call fcn.004115c9
mov ecx, eax
call fcn.00415c25
mov ecx, esi
cmp eax, 0xffffffff
jne 0x44feb6
push edi
call fcn.004115c9
push eax
lea ecx, [ebp - 0x320]
call fcn.0040f3d7
or ebx, 1
jmp 0x44fed1
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x308]
push eax
push edi
call fcn.004115c9
mov ecx, eax
call fcn.00417003
or ebx, 2
push eax
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x1374], ebx
call fcn.00409c89
mov dword [ebp - 4], 2
test bl, 2
je 0x44ff03
and ebx, 0xfffffffd
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x1374], ebx
call fcn.00408cf0
mov byte [ebp - 4], 3
test bl, 1
je 0x44ff20
and ebx, 0xfffffffe
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x1374], ebx
call fcn.00408cf0
push 0xfde9
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.004138aa
add esp, 0xc
mov esi, eax
mov ecx, dword [ebp - 0x136c]
push edi
mov byte [ebp - 4], 4
call fcn.004115c9
mov ecx, eax
call fcn.00408b05
push eax
mov ecx, esi
call fcn.0041321d
mov ecx, dword [ebp - 0x1380]
mov edx, eax
call 0x4578e1
pop ecx
lea ecx, [ebp - 0x338]
call fcn.004134bc
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 0
call fcn.00408cf0
mov esi, dword [ebp - 0x136c]
inc edi
mov ecx, esi
call fcn.004115e4
cmp edi, eax
jb 0x44fe87
mov esi, dword [ebp - 0x1370]
mov ecx, dword [ebp - 0x1380]
call fcn.00457a0e
lea ecx, [ebp - 0xb50]
call fcn.00410936
push str..zip
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2d8]
push dword [esi]
push eax
lea eax, [ebp - 0xb50]
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0xb50]
push ebx
call fcn.00410b38
push eax
lea ecx, [ebp - 0x744]
call fcn.00410b38
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp byte [ebp - 0x1378], bl
jne 0x450028
lea ecx, [ebp - 0x744]
call fcn.00410b38
mov edx, esi
mov ecx, eax
call fcn.00450649
jmp 0x4500f4
lea ecx, [ebp - 0x1368]
call fcn.00410936
push 0x4bd32c
lea ecx, [ebp - 0xb50]
mov byte [ebp - 4], 6
call fcn.00410b38
push eax
lea eax, [ebp - 0x1368]
push str.Dump
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push 0x40040
push 0x4bd380
lea ecx, [ebp - 0x1368]
call fcn.00410b38
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0xf5c]
call fcn.00410936
lea ecx, [ebp - 0xb50]
mov byte [ebp - 4], 7
call fcn.00410b38
push eax
lea eax, [ebp - 0xf5c]
push str._e__select_
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push 1
push ebx
lea ecx, [ebp - 0xf5c]
call fcn.00410b38
push eax
push str.explorer.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xf5c]
call fcn.00410913
lea ecx, [ebp - 0x1368]
mov byte [ebp - 4], 5
call fcn.00410913
lea ecx, [ebp - 0x744]
call fcn.00410b38
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xb50]
call fcn.00410913
lea ecx, [ebp - 0x744]
call fcn.00410913
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c170
leave
ret