Function at 0x44cde8
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Get file attributes
Identify system language via api
Query or enumerate registry value
Read .ini file
Resume thread
Set current directory
Set registry value
Terminate process

Disassembly:
cld
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
mov cl, 8
cmp al, 0x22
je 0x44cdfc
mov cl, 4
cmp al, 0x19
je 0x44cdfc
mov cl, 0
mov byte [0x45c17c], cl
call sub.KERNEL32.DLL_GetCommandLineA
mov edx, eax
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x44ce09
cmp dword [eax - 5], 0x656e7554
jne 0x44ce27
cmp word [eax - 7], 0x2d20
jne 0x44ce27
call fcn.0044d470
ret
mov ah, byte [edx]
inc edx
test ah, ah
je 0x44ce4d
cmp ah, 0x22
je 0x44ce35
mov ah, 0x20
mov al, byte [edx]
test al, al
je 0x44ce4d
inc edx
cmp al, ah
jne 0x44ce35
mov al, byte [edx]
test al, al
je 0x44ce4d
cmp al, 0x20
jne 0x44ce4d
inc edx
jmp 0x44ce40
mov al, byte [edx]
test al, al
jne 0x44ce55
xor edx, edx
mov dword [0x45c4f8], edx
push 0x45c51c
call sub.KERNEL32.DLL_GetStartupInfoA
mov esi, 0x45c284
push 0x104
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edi, 0x45c3f4
test eax, eax
mov al, 0xc
je 0x44d250
xor edx, edx
xor ecx, ecx
mov al, byte [esi + ecx]
mov byte [edi + ecx], al
inc ecx
test al, al
je 0x44ce9d
cmp al, 0x2e
jne 0x44ce8a
mov edx, ecx
jmp 0x44ce8a
test edx, edx
je 0x44ce7e
mov dword [esi + edx], 0x696e69
mov dword [edi + edx], 0x6c6c64
xchg byte [0x45c561], al
test al, al
je 0x44cf04
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x44cf04
mov edx, dword [0x45c17c]
push 0x24
push dword [edx + 0x44e538]
push dword [edx + 0x44e544]
push 0
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x44cf04
push 0
push 0
call sub.OLE32.DLL_CoInitializeEx
test eax, eax
jne 0x44cf04
push 0
call fcn.0044d300
push 1
call fcn.0044d300
call sub.OLE32.DLL_CoUninitialize
cmp byte [0x45c560], 1
jl 0x44cf2e
push esi
push 0x103
push 0x45c180
push 0
push 0x44e5ad
push 0x44e7dc
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp eax, 8
jae 0x44cf65
mov eax, dword [0x45c17c]
mov eax, dword [eax + 0x44e550]
mov dword [0x45c3d8], eax
push 0x45c3a8
call sub.COMDLG32.DLL_GetOpenFileNameA
test eax, eax
je 0x44d22e
push esi
push 0x45c180
push 0x44e5ad
push 0x44e7dc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
push esi
push 0
push 0x44e869
push 0x44e7dc
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov dword [0x45c510], eax
cmp eax, 0xc8
ja 0x44d013
cmp eax, 1
jb 0x44d013
push 0x45c50c
push 0x20003
push 0
push 0x44e833
push reloc.WS2_32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x44d013
push ecx
mov ecx, esp
mov eax, 0x45c514
mov dword [eax], 4
push eax
push 0x45c518
push ecx
push 0
push 0x44e866
push dword [0x45c50c]
call sub.ADVAPI32.DLL_RegQueryValueExA
pop ecx
test eax, eax
jne 0x44cfed
cmp ecx, 4
jne 0x44cfed
mov eax, dword [0x45c510]
cmp eax, dword [0x45c518]
je 0x44d008
push 4
push 0x45c510
push 4
push 0
push 0x44e866
push dword [0x45c50c]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [0x45c50c]
call sub.ADVAPI32.DLL_RegCloseKey
mov edi, 0x44e7df
push esi
push 0xfe
push 0x44e7e5
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov dword [0x45c4fc], eax
push esi
push 0xfe
push 0x44e7e9
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov dword [0x45c500], eax
push esi
push 0xa
push 0x44e7ed
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov dword [0x45c504], eax
push esi
push 0
push 0x44e7f2
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov dword [0x45c508], eax
push esi
push 0
push 0x44e7dc
push 0x44e7dc
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov ecx, 0x44e832
mov edx, ecx
mov edi, ecx
test al, 1
je 0x44d08e
mov ecx, 0x44e821
test al, 2
je 0x44d097
mov edx, 0x44e82a
test al, 4
je 0x44d0a0
mov edi, 0x44e819
mov eax, dword [0x45c4f8]
test eax, eax
je 0x44d0c7
push eax
push edi
push edx
push ecx
push 0x45c180
push 0x44e801
push 0x104
push esi
call sub.SHLWAPI.DLL_wnsprintfA
add esp, 0x20
jmp 0x44d0e2
push edi
push edx
push ecx
push 0x45c180
push 0x44e7f6
push 0x104
push esi
call sub.SHLWAPI.DLL_wnsprintfA
add esp, 0x1c
push 0x45c50c
push 0x45c51c
push 0
push 0
push 0x24
push 0
push 0
push 0
push esi
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x44d126
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x44d113
cmp eax, 3
jne 0x44d11f
dec byte [0x45c560]
jge 0x44ce65
mov al, 0
jmp 0x44d250
mov edi, 0x45c180
xor edx, edx
mov al, byte [edi]
inc edi
test al, al
je 0x44d13c
cmp al, 0x5c
jne 0x44d12d
mov edx, edi
jmp 0x44d12d
test edx, edx
mov cl, 1
je 0x44d23b
mov byte [edx - 1], 0
push 0x45c180
call sub.KERNEL32.DLL_SetCurrentDirectoryA
test eax, eax
mov cl, 2
je 0x44d23b
push dword [0x45c508]
push dword [0x45c504]
push dword [0x45c500]
push dword [0x45c4fc]
push dword [0x45c50c]
push 0
call fcn.00408690
add esp, 0x18
test eax, eax
mov cl, 5
je 0x44d23b
push 0x1a
push 0x4013cb
call fcn.0044d287
mov al, 0x24
jb 0x44d240
mov esi, 0x45c284
mov edi, 0x44e9a0
mov ecx, 0x1a
repe cmpsb byte [esi], byte es:[edi]
jne 0x44d240
push 0x104
push 0x45c3f4
push 0x400ef0
call fcn.0044d2a9
mov cl, 6
jb 0x44d23b
push 4
push 0x44e56c
push 0x4013cc
call fcn.0044d2a9
mov cl, 7
jb 0x44d23b
mov esi, 0x44e55c
mov edi, dword [esi]
test edi, edi
je 0x44d219
push 1
push edi
call fcn.0044d287
jb 0x44d214
mov al, byte [esi + 4]
cmp al, byte [0x45c284]
jne 0x44d214
lea eax, [esi + 5]
push 1
push eax
push edi
call fcn.0044d2a9
add esi, 6
jmp 0x44d1ed
push dword [0x45c510]
call sub.KERNEL32.DLL_ResumeThread
push 1
call fcn.00408690
add esp, 4
push 2
call fcn.00408690
add esp, 4
xor eax, eax
ret
mov al, 0x18
movzx ecx, cl
push eax
push ecx
push esp
push dword [0x45c50c]
call sub.KERNEL32.DLL_TerminateProcess
pop ecx
pop eax
movzx eax, al
mov esi, 0x45c284
mov edi, dword [0x45c17c]
mov eax, dword [edi + eax + 0x44e4f0]
push ecx
push eax
push 0x104
push esi
call sub.SHLWAPI.DLL_wnsprintfA
add esp, 0x10
push 0x10
push dword [edi + 0x44e520]
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x44d22e