Function at 0x44d65c
Capabilities:
Get common file path
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3bc
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00448afa
call fcn.0040cfb5
xor ebx, ebx
push 0x4bcbf0
mov dword [0x4d617c], ebx
call fcn.004415ae
mov esi, 0x4d6de0
cmp byte [0x4d4f1d], 1
je 0x44d6e1
push 0x4bcb88
push 0x44b382
push str.start
push str.StartupScreen
call fcn.00448ce4
sub eax, ebx
je 0x44dc01
push 2
pop ecx
sub eax, ecx
je 0x44dc01
sub eax, 0x3e6
je 0x44db0c
dec eax
je 0x44d7e3
dec eax
jne 0x44d7e9
mov dword [0x4d6494], ebx
push ebx
push 0x44c7e1
push str.view1
push str.SelFileView
call fcn.00448ce4
xor edi, edi
inc edi
mov dword [ebp - 0x314], eax
cmp eax, edi
je 0x44d712
cmp eax, 3
jne 0x44d7d0
push 0x50
lea eax, [ebp - 0x3b8]
push ebx
push eax
mov dword [ebp - 0x3bc], ebx
call fcn.00450230
push 0x50
lea eax, [ebp - 0x364]
push ebx
push eax
mov dword [ebp - 0x368], ebx
call fcn.00450230
add esp, 0x18
push edi
lea eax, [ebp - 0x368]
push eax
push 0x46c02c
push dword [0x49efd8]
call fcn.00442cad
push eax
call fcn.00421a88
cmp eax, edi
je 0x44d6e7
push edi
lea eax, [ebp - 0x3bc]
push eax
mov edi, 0x46c02c
push edi
push dword [0x49efd8]
mov byte [ebp - 0x20c], bl
call fcn.00442cad
push eax
call fcn.00421aa2
test eax, eax
jne 0x44d7ab
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [0x49efd8]
call fcn.00442cad
push eax
call fcn.00419b4d
test eax, eax
je 0x44d693
xor eax, eax
cmp dword [ebp - 0x314], 3
sete al
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [0x49efd8]
call fcn.0044708e
jmp 0x44d6e7
cmp byte [0x4d4f1d], 1
jne 0x44d69c
push edi
call fcn.00451974
mov dword [0x4d6494], ecx
push ebx
push 0x44d51a
push str.rest1
push str.SelFileRestore
call fcn.00448ce4
cmp eax, 1
jne 0x44d693
push ebx
push 0x44c9e1
push str.rest2
push str.SelDriveSave
call fcn.00448ce4
cmp eax, 1
jne 0x44d7e9
push 0x50
lea eax, [ebp - 0x364]
push ebx
push eax
mov dword [ebp - 0x368], ebx
call fcn.00450230
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00450230
add esp, 0x18
push 0x104
push 0x46c02c
push dword [0x49efd8]
call fcn.00442cad
push eax
push dword [0x49efd8]
call fcn.00451260
add esp, 0xc
push 1
lea eax, [ebp - 0x368]
push eax
push dword [0x49efd8]
call fcn.00421aa2
test eax, eax
jne 0x44d8c9
mov eax, dword [ebp - 0x364]
lea ecx, [eax + 0x104]
push ecx
push eax
lea eax, [ebp - 0x108]
push 0x46aaa0
push eax
call fcn.00450c76
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push dword [0x49efd8]
call fcn.00419b4d
test eax, eax
je 0x44d693
push 0x104
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemDirectoryA]
test eax, eax
je 0x44da41
mov al, byte [0x4d6de0]
cmp al, byte [ebp - 0x310]
jne 0x44da41
cmp dword [0x4cd334], ebx
jne 0x44da41
push esi
push dword [0x49efd8]
push esi
push str.Restoring_your_system_disk__s_with_the_operating_system_running_is_impossible_but_we_can_schedule_a_restore_for_the_next_reboot._n_nDo_you_want_to_restore__s_nto__s_during_the_next_boot_
call fcn.0042f614
add esp, 0x10
push eax
push 0x44b772
push str.start
push str.RegNative
call fcn.00448ce4
xor edi, edi
inc edi
cmp eax, edi
jne 0x44d9ce
push ebx
cmp byte [ebp - 0x108], bl
je 0x44d94d
push dword [0x49efd8]
lea eax, [ebp - 0x108]
push eax
jmp 0x44d954
push ebx
push dword [0x49efd8]
push esi
call fcn.0043cd29
push ebx
cmp eax, edi
jne 0x44d9bf
push 4
push str.Success
push esi
push dword [0x49efd8]
push str.we_will_restore__s_to__s_nduring_the_next_boot._nDo_you_want_to_reboot_the_system_now__n
call fcn.0042f614
add esp, 0xc
push eax
push 0x34
push dword [0x4d617c]
call fcn.0041ee88
cmp eax, 6
jne 0x44d693
push str.SeShutdownPrivilege
call fcn.0040a59c
push ebx
push 2
call dword [sym.imp.e_to_open__s_ExitWindowsEx]
test eax, eax
jne 0x44d693
push str.Unable_to_reboot._nPlease_reboot_manually._n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xc1b
jmp 0x44da2f
push ebx
push str.Error
push str.scheduling_restore_for_next_reboot_failed_n
push 0x35
jmp 0x44da0e
lea eax, [ebp - 0x314]
push eax
mov dword [ebp - 0x314], ebx
call fcn.0043c85c
cmp eax, edi
jne 0x44da1e
cmp dword [ebp - 0x314], edi
jne 0x44d693
push ebx
push ebx
push str.Success
push esi
push dword [0x49efd8]
push str.The_scheduled_restore_from__n__s_to__s_n_was_removed_successfully
call fcn.0042f614
add esp, 0xc
push eax
push 0x36
push dword [0x4d617c]
call fcn.0041ee88
jmp 0x44d693
push str.Cant_remove_scheduled_restore_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xc37
push str.WINSHOT
call fcn.0044dc85
add esp, 0x10
jmp 0x44d693
push ebx
push 4
push 0x469ec0
push str._s___last_warning
call fcn.0042f614
pop ecx
pop ecx
push eax
push dword [0x49efd8]
push esi
push str.This_will_overwrite_all_data_on__s_with_the_data_given_in_file__s_n_nDo_you_want_to_continue_
call fcn.0042f614
add esp, 0xc
push eax
push 0x2e
push dword [0x4d617c]
call fcn.0041ee88
cmp eax, 6
jne 0x44d693
mov ecx, dword [esi]
mov eax, 0x46a5ac
cmp ecx, dword [eax]
je 0x44daa3
push esi
lea eax, [ebp - 0x20c]
push str.._s
push eax
call fcn.00450c76
add esp, 0xc
jmp 0x44dab7
xor eax, eax
mov cl, byte [eax + 0x4d6de0]
mov byte [ebp + eax - 0x20c], cl
inc eax
cmp cl, bl
jne 0x44daa5
cmp byte [ebp - 0x108], bl
je 0x44dae1
push 1
push 0x46c02c
push dword [0x49efd8]
call fcn.00442cad
push eax
call fcn.004503c5
pop ecx
push eax
lea eax, [ebp - 0x108]
jmp 0x44daf3
push ebx
push ebx
push 0x46c02c
push dword [0x49efd8]
call fcn.00442cad
push eax
call fcn.004503c5
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0044b591
jmp 0x44d693
xor edi, edi
inc edi
mov dword [0x4d6494], edi
push edi
push 0x44c9e1
push str.back1
push str.SelDriveSave
call fcn.00448ce4
cmp eax, edi
jne 0x44dbf2
push ebx
push 0x44d0cb
push str.back2
push str.SelFileSave
call fcn.00448ce4
cmp eax, edi
jne 0x44db15
push dword [0x49efd8]
push esi
push str.we_will_save__s_to__s_n
call fcn.00450f5c
mov eax, dword [0x4d586c]
mov dword [0x4cd2b0], eax
xor eax, eax
add esp, 0xc
cmp dword [0x4d5f6c], ebx
sete al
cmp dword [0x4cd308], 3
mov dword [0x4cd2a0], eax
jne 0x44db8c
mov eax, dword [0x49f028]
mov dword [0x4cd308], eax
cmp dword [0x4cd314], edi
je 0x44dbcd
cmp dword [0x49f02c], ebx
je 0x44dbc7
push 0x104
push str..hsh
push dword [0x49efd8]
call fcn.00442bcb
push eax
call fcn.00442cad
push eax
push 0x4cd33c
call fcn.00451260
add esp, 0xc
jmp 0x44dbcd
mov byte [0x4cd33c], bl
push ebx
push ebx
push esi
push 0x46c02c
push dword [0x49efd8]
call fcn.00442cad
push eax
call fcn.004503c5
pop ecx
push eax
call fcn.0044b591
call fcn.00417370
mov dword [0x4cd308], 3
jmp 0x44d693
push 1
jmp 0x44d7de