Function at 0x44a7c1
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x528278
call fcn.0051f0b4
sub esp, 0x484
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 0x10]
add ecx, 0xf
add eax, 5
push esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
add eax, 0x1c
add ecx, 0x1e
push edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
call fcn.0041d0d6
test eax, eax
je 0x44a88c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
call fcn.0041fc46
sub esp, 0x10
mov edi, esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push 0x666666
movsd dword es:[edi], dword [esi]
push ebx
push 1
push ecx
movsd dword es:[edi], dword [esi]
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x541cec
movsd dword es:[edi], dword [esi]
call fcn.00401f01
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x28], esp
push ebx
call fcn.00401f01
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x64]
push 0x581464
push eax
lea ecx, [ebp - 0x44]
call fcn.0042085a
add esp, 0x2c
cmp eax, ebx
je 0x44a9c2
push 0x1ef9b6
call fcn.0040753c
push eax
call fcn.00455e6c
push ebx
jmp 0x44a918
call fcn.0041d305
test eax, eax
je 0x44a925
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
call fcn.0041fc46
sub esp, 0x10
mov edi, esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x666666
movsd dword es:[edi], dword [esi]
push ebx
xor esi, esi
inc esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x543790
call fcn.00401f01
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00401f01
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x64]
push 0x581484
push eax
lea ecx, [ebp - 0x44]
call fcn.0042085a
add esp, 0x2c
cmp eax, ebx
je 0x44a9c2
push 0x1efa16
call fcn.0040753c
push eax
call fcn.00455e6c
push ebx
mov esi, dword [ebp + 0x10]
call fcn.0041ce02
jmp 0x44a9c2
mov ecx, ebx
call fcn.0041cf39
test eax, eax
je 0x44a944
call fcn.0041d404
test eax, eax
jne 0x44a944
mov dword [ebp - 0x20], 1
xor ebx, ebx
jmp 0x44a949
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
call fcn.0041fc46
sub esp, 0x10
mov edi, esp
xor eax, eax
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
setne al
push 0x666666
movsd dword es:[edi], dword [esi]
push ebx
push eax
push ecx
movsd dword es:[edi], dword [esi]
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x543788
movsd dword es:[edi], dword [esi]
call fcn.00401f01
push ecx
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00401f01
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x64]
push 0x581404
push eax
lea ecx, [ebp - 0x44]
call fcn.0042085a
add esp, 0x2c
cmp eax, ebx
je 0x44a9c2
mov edi, dword [ebp + 0x10]
call fcn.0041d504
mov ebx, dword [ebp + 0x10]
call fcn.0041d305
test eax, eax
mov eax, 0x543780
jne 0x44a9d8
mov eax, 0x541cd4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401f01
mov dword [ebp - 4], 3
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
call fcn.0041fc46
sub esp, 0x10
mov edi, esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push 0x666666
movsd dword es:[edi], dword [esi]
push ebx
push 1
push ecx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], esp
mov ecx, esp
push eax
movsd dword es:[edi], dword [esi]
call fcn.004015d6
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00401f01
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
add eax, 0x1c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x18], ecx
push 0x581424
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0042085a
add esp, 0x2c
cmp eax, ebx
je 0x44aaab
mov esi, dword [ebp + 0x10]
mov ebx, esi
call fcn.0041d305
test eax, eax
jne 0x44aa80
push 0x1ef9b7
jmp 0x44aa85
push 0x1efa17
call fcn.0040753c
push eax
call fcn.00455e6c
push 0
push 1
call fcn.0041d7e3
test eax, eax
je 0x44aaa9
push 1
push 0
push dword [ebp + 8]
call fcn.0044ac85
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
call fcn.0041fc46
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push 0x666666
movsd dword es:[edi], dword [esi]
push ebx
push 1
push ecx
movsd dword es:[edi], dword [esi]
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0x54379c
movsd dword es:[edi], dword [esi]
call fcn.00401f01
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push ebx
mov byte [ebp - 4], 5
call fcn.00401f01
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
add eax, 0x1c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x18], ecx
push 0x581444
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0042085a
add esp, 0x2c
cmp eax, ebx
je 0x44ac69
mov ebx, dword [ebp + 0x10]
call fcn.0041d305
test eax, eax
jne 0x44ab41
push 0x1ef9b8
jmp 0x44ab46
push 0x1efa18
call fcn.0040753c
push eax
call fcn.00455e6c
lea eax, [ebp + 0x10]
push eax
push ebx
call fcn.0041c770
push 0x53f8bc
push 0x5437ac
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 6
call fcn.0040476b
push dword [ebp + 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
je 0x44ac09
xor eax, eax
push 0x40e
mov word [ebp - 0x490], ax
xor esi, esi
lea eax, [ebp - 0x48e]
push esi
push eax
call fcn.004ee670
add esp, 0xc
push dword [ebp + 0x10]
mov eax, 0x410
push str.__select____s_
lea edi, [ebp - 0x490]
call fcn.00445e60
pop ecx
mov eax, edi
mov dword [ebp - 0x6c], eax
pop ecx
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], str.open
mov dword [ebp - 0x70], str.explorer.exe
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x48], esi
je 0x44ac5e
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44ac5e
push 0x5c
lea esi, [ebp + 0x10]
call fcn.004116a7
inc eax
lea ebx, [ebp + 0xc]
mov ecx, esi
call fcn.00404af0
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00404918
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040297c
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x44ac59
push 1
xor eax, eax
push eax
push dword [ebp + 0x10]
push str.explorer
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x44ac5e
call fcn.0044f37c
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc