Function at 0x441be0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x538010]
xor eax, ebp
mov dword [esp + 0x90], eax
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov word [ecx + 0x34], 0x101
lea eax, [ecx + 0x3c]
movups xmmword [ecx + 0x3c], xmm0
mov dword [esp + 8], ecx
mov dword [ecx + 0x38], eax
xor eax, eax
dec eax
lea esi, [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push esi
call fcn.005018c0
add esp, 4
mov dl, byte [esi + 0xb]
test dl, dl
mov eax, dword [esi + 4]
movzx ebx, dl
mov ecx, ebx
cmovs ecx, eax
test ecx, ecx
je 0x441cee
test dl, dl
jns 0x441c56
mov esi, dword [esp + 0x20]
cmp byte [esi], 0x7b
je 0x441cee
lea edi, [esp + 0x24]
lea ebx, [esp + 0x20]
lea esi, [esp + 0x6c]
push ebx
push 0x51fb0f
push esi
call fcn.0046ff50
add esp, 0xc
mov ecx, esi
push 1
push 0x51fb0d
call fcn.0046ea90
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov dword [esp + 0x7b], edx
mov dword [esp + 0x78], ecx
mov dl, byte [eax + 0xb]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
cmp byte [ebx + 0xb], 0
jns 0x441cbb
push dword [esp + 0x20]
mov ebx, edx
call fcn.004d05a5
mov edx, ebx
add esp, 4
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7b]
mov dword [edi + 3], ecx
mov dword [edi], eax
mov byte [esp + 0x2b], dl
cmp byte [esp + 0x77], 0
jns 0x441ce7
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
mov dl, byte [esp + 0x2b]
mov eax, dword [esp + 0x24]
movzx ebx, dl
test dl, dl
jns 0x441cfa
mov esi, dword [esp + 0x20]
mov ebx, eax
jmp 0x441cfe
lea esi, [esp + 0x20]
cmp ebx, 0x7ffffff0
jae 0x4425d4
cmp ebx, 5
jae 0x441d1c
lea eax, [esp + 0x6c]
mov byte [eax + 0xb], bl
test ebx, ebx
jne 0x441d46
jmp 0x441d57
mov edi, ebx
or edi, 7
inc edi
js 0x4425dd
lea eax, [edi + edi]
push eax
call fcn.004d0575
add esp, 4
mov dword [esp + 0x6c], eax
or edi, 0x80000000
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
xor ecx, ecx
movsx edx, byte [esi + ecx]
mov word [eax], dx
add eax, 2
inc ecx
cmp ebx, ecx
jne 0x441d48
mov ecx, dword [esp + 8]
lea edi, [ecx + 0x14]
mov word [eax], 0
cmp byte [esp + 0x77], 0
jns 0x441d70
mov eax, dword [esp + 0x6c]
jmp 0x441d74
lea eax, [esp + 0x6c]
push edi
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
cmp byte [esp + 0x77], 0
jns 0x441d91
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x441da4
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
test esi, esi
jns 0x441ddf
xorps xmm0, xmm0
movups xmmword [edi], xmm0
lea esi, [esp + 0x20]
mov ecx, esi
push 0xf2
push 0x51f9c0
push 2
call fcn.0044c760
lea ecx, [esp + 0x5c]
push 0x51f9dd
push str.uid_not_found__use_empty
call fcn.00415500
mov ecx, esi
call fcn.0044c9f0
mov eax, dword [esp + 8]
add eax, 0x24
mov dword [esp + 0xc], eax
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jns 0x441dfa
call fcn.00501860
lea esi, [esp + 0x20]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
mov edx, edi
call fcn.004425f0
movzx ebx, byte [esi + 0xb]
test bl, bl
jns 0x441e22
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
test ebx, ebx
js 0x4425cb
cmp ebx, 0xa
ja 0x441e3d
mov ecx, ebx
and cl, 0x7f
lea eax, [esp + 0x6c]
mov byte [eax + 0xb], cl
jmp 0x441e5e
mov edi, ebx
or edi, 0xf
inc edi
push edi
call fcn.004d0575
add esp, 4
mov dword [esp + 0x6c], eax
or edi, 0x80000000
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
test ebx, ebx
je 0x441e73
add ebx, ebx
xor ecx, ecx
mov dl, byte [esi + ecx]
mov byte [eax], dl
inc eax
add ecx, 2
cmp ebx, ecx
jne 0x441e66
mov byte [eax], 0
cmp byte [esp + 0x2b], 0
jns 0x441e89
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
lea edi, [esp + 0x20]
mov byte [edi + 0xb], 3
cmp edi, 0x51d4dc
mov ecx, dword [esp + 8]
ja 0x441eac
lea eax, [esp + 0x23]
cmp eax, 0x51d4dc
ja 0x4425ad
mov al, byte [0x51d4de]
mov byte [esp + 0x22], al
movzx eax, word [0x51d4dc]
mov word [esp + 0x20], ax
mov byte [esp + 0x23], 0
movzx eax, byte [esp + 0x77]
test al, al
jns 0x441ed3
mov eax, dword [esp + 0x70]
add ecx, 0x38
mov dword [esp + 4], ecx
test eax, eax
je 0x441f23
lea eax, [esp + 0x10]
mov dword [eax], edi
lea edx, [esp + 0x88]
lea esi, [esp + 0x78]
mov ecx, dword [esp + 4]
push edx
push eax
push 0x51fb1d
push edi
push esi
call fcn.0042a840
mov ecx, dword [esi]
add ecx, 0x1c
lea eax, [esp + 0x6c]
push eax
call fcn.00415420
cmp byte [esp + 0x2b], 0
jns 0x441f23
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x77], 0
jns 0x441f36
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
xor eax, eax
dec eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov ecx, edi
mov edx, dword [esp + 0xc]
call fcn.004425f0
movzx ebx, byte [esp + 0x2b]
test bl, bl
jns 0x441f61
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
test ebx, ebx
js 0x4425cb
cmp ebx, 0xa
ja 0x441f7c
mov ecx, ebx
and cl, 0x7f
lea eax, [esp + 0x6c]
mov byte [eax + 0xb], cl
jmp 0x441f9d
mov esi, ebx
or esi, 0xf
inc esi
push esi
call fcn.004d0575
add esp, 4
mov dword [esp + 0x6c], eax
or esi, 0x80000000
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], ebx
test ebx, ebx
je 0x441fb2
add ebx, ebx
xor ecx, ecx
mov dl, byte [edi + ecx]
mov byte [eax], dl
inc eax
add ecx, 2
cmp ebx, ecx
jne 0x441fa5
mov byte [eax], 0
cmp byte [esp + 0x2b], 0
jns 0x441fc8
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
lea esi, [esp + 0x20]
mov byte [esi + 0xb], 9
cmp esi, str.report_id
ja 0x441fe7
lea eax, [esp + 0x29]
cmp eax, str.report_id
ja 0x4425ad
mov dword [esp + 0x24], 0x695f7472
mov dword [esp + 0x20], 0x6f706572
mov word [esp + 0x28], 0x64
movzx eax, byte [esp + 0x77]
test al, al
jns 0x44200b
mov eax, dword [esp + 0x70]
test eax, eax
je 0x442054
lea eax, [esp + 0x10]
mov dword [eax], esi
lea edx, [esp + 0x88]
lea edi, [esp + 0x78]
mov ecx, dword [esp + 4]
push edx
push eax
push 0x51fb1d
push esi
push edi
call fcn.0042a840
mov ecx, dword [edi]
add ecx, 0x1c
lea eax, [esp + 0x6c]
push eax
call fcn.00415420
cmp byte [esp + 0x2b], 0
jns 0x442054
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x77], 0
jns 0x442067
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
mov byte [esp + 0x2b], 0xa
cmp esi, 0x51d4e8
ja 0x442083
lea eax, [esp + 0x2a]
cmp eax, 0x51d4e8
ja 0x4425ad
movzx eax, word [0x51d4f0]
mov word [esp + 0x28], ax
movsd xmm0, qword [0x51d4e8]
movsd qword [esp + 0x20], xmm0
mov byte [esp + 0x2a], 0
lea edi, [esp + 0x6c]
mov byte [edi + 0xb], 3
cmp edi, 0x51f9e8
ja 0x4420c1
lea eax, [esp + 0x6f]
cmp eax, 0x51f9e8
ja 0x4425ad
mov dword [esp + 0x6c], 0x726576
lea eax, [esp + 0x10]
mov dword [eax], edi
lea edx, [esp + 0x88]
lea ebx, [esp + 0x78]
mov ecx, dword [esp + 4]
push edx
push eax
push 0x51fb1d
push edi
push ebx
call fcn.0042a840
mov ecx, dword [ebx]
add ecx, 0x1c
push esi
call fcn.00415420
cmp byte [esp + 0x77], 0
jns 0x44210a
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x44211d
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
mov byte [esp + 0x2b], 5
cmp esi, str.Win32
ja 0x442139
lea eax, [esp + 0x25]
cmp eax, str.Win32
ja 0x4425ad
mov dword [esp + 0x20], 0x336e6957
mov word [esp + 0x24], 0x32
lea ebx, [esp + 0x70]
mov byte [ebx + 7], 4
cmp edi, str.plat
ja 0x442164
cmp ebx, str.plat
ja 0x4425ad
mov dword [esp + 0x6c], 0x74616c70
mov byte [esp + 0x70], 0
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 4]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x14]
push eax
push 0x51fb1d
push edi
lea eax, [esp + 0x88]
push eax
call fcn.0042a840
mov ecx, dword [esp + 0x78]
add ecx, 0x1c
push esi
call fcn.00415420
cmp byte [esp + 0x77], 0
jns 0x4421b9
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x4421cc
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
mov byte [esp + 0x2b], 6
cmp esi, 0x51f9f7
ja 0x4421e8
lea eax, [esp + 0x26]
cmp eax, 0x51f9f7
ja 0x4425ad
mov word [esp + 0x24], 0x7865
mov dword [esp + 0x20], 0x646e6159
mov byte [esp + 0x26], 0
mov byte [esp + 0x77], 4
cmp edi, str.prod
ja 0x442215
cmp ebx, str.prod
ja 0x4425ad
mov dword [esp + 0x6c], 0x646f7270
mov byte [esp + 0x70], 0
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 4]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x14]
push eax
push 0x51fb1d
push edi
lea eax, [esp + 0x88]
push eax
call fcn.0042a840
mov ecx, dword [esp + 0x78]
add ecx, 0x1c
push esi
call fcn.00415420
cmp byte [esp + 0x77], 0
jns 0x44226a
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x44227d
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
xor ecx, ecx
mov eax, dword [esp + 8]
cmp byte [eax + 0x35], 0
mov edx, 0x51fa03
mov eax, 0x51ee16
cmove eax, edx
sete cl
lea ebx, [ecx + 4]
mov byte [esp + 0x2b], bl
cmp esi, eax
ja 0x4422af
add ecx, esp
add ecx, 0x24
cmp ecx, eax
ja 0x4425ad
push ebx
push eax
push esi
call fcn.004d3ed0
add esp, 0xc
mov byte [esp + ebx + 0x20], 0
push 0x10
call fcn.004d0575
add esp, 4
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], 0x80000010
mov dword [esp + 0x70], 0xc
cmp eax, str.gzip_enabled
ja 0x4422f3
lea ecx, [eax + 0xc]
cmp ecx, str.gzip_enabled
ja 0x4425ad
mov dword [eax + 8], 0x64656c62
mov dword [eax + 4], 0x616e655f
mov dword [eax], 0x70697a67
mov byte [eax + 0xc], 0
movzx eax, byte [esp + 0x2b]
test al, al
jns 0x442318
mov eax, dword [esp + 0x24]
test eax, eax
je 0x442358
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 4]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x14]
push eax
push 0x51fb1d
push edi
lea eax, [esp + 0x88]
push eax
call fcn.0042a840
mov ecx, dword [esp + 0x78]
add ecx, 0x1c
push esi
call fcn.00415420
cmp byte [esp + 0x77], 0
jns 0x442364
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x442377
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
lea edi, [esp + 0x6c]
mov ecx, edi
mov edx, dword [esp + 0xc]
call fcn.004425f0
xor ebx, ebx
push 0x208
call fcn.004d0575
add esp, 4
mov esi, eax
mov eax, esi
add eax, ebx
je 0x44259a
mov word [eax], 0
add ebx, 2
cmp ebx, 0x208
jne 0x442397
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
dec eax
cmp eax, 0x102
ja 0x4423dc
lea ecx, [ebx + ebx]
cmp ebx, 4
ja 0x4423ec
and bl, 0x7f
mov byte [esp + 0x1b], bl
lea eax, [esp + 0x10]
jmp 0x44241c
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
jmp 0x442435
mov edi, ebx
or edi, 7
lea eax, [edi*2 + 2]
inc edi
push eax
mov dword [esp + 8], ecx
call fcn.004d0575
mov ecx, dword [esp + 8]
add esp, 4
mov dword [esp + 0x10], eax
or edi, 0x80000000
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
push ecx
push esi
push eax
mov edi, eax
mov ebx, ecx
call fcn.004d3ed0
add esp, 0xc
mov word [edi + ebx], 0
lea edi, [esp + 0x6c]
test esi, esi
je 0x442442
push esi
call fcn.004d05a5
add esp, 4
lea ecx, [esp + 0x10]
push 1
push 0x51fa20
call fcn.0046fa90
mov edx, dword [eax + 8]
lea ecx, [esp + 0x78]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
xor esi, esi
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x77]
test al, al
cmovs eax, dword [esp + 0x70]
cmovs edi, dword [esp + 0x6c]
push eax
push edi
call fcn.0046fa90
mov edx, dword [eax + 8]
lea ecx, [esp + 0x20]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push 4
push 0x51fa16
call fcn.0046fa90
mov edi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov dword [esp + 0x8b], edx
mov dword [esp + 0x88], ecx
mov bl, byte [eax + 0xb]
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 8], esi
mov esi, dword [esp + 8]
cmp byte [esi + 0xb], 0
jns 0x4424e1
push dword [esi]
call fcn.004d05a5
add esp, 4
mov dword [esi], edi
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x8b]
mov dword [esi + 4], eax
mov dword [esi + 7], ecx
mov byte [esi + 0xb], bl
cmp byte [esp + 0x2b], 0
jns 0x44250d
push dword [esp + 0x20]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x83], 0
jns 0x442523
push dword [esp + 0x78]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x1b], 0
jns 0x442536
push dword [esp + 0x10]
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x77], 0
jns 0x442549
push dword [esp + 0x6c]
call fcn.004d05a5
add esp, 4
push 0x51fa24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x44257c
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
je 0x44257c
push 0x4426d0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi + 0x48], eax
mov dword [0x53d944], esi
mov ecx, dword [esp + 0x90]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x25
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
jmp 0x4425c1
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1__n
push 0xf1
push str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s
call fcn.00448430
lea ecx, [esp + 0x6c]
call fcn.004154e0
lea ecx, [esp + 0x6c]
call fcn.004154e0
call fcn.004ffaa0
int3