Function at 0x444dac
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff64
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4adfd0
call fcn.00454f7c
test bl, bl
je 0x444de0
test al, 1
jne 0x444de0
xor eax, eax
jmp 0x4450d0
call fcn.00447c1c
mov edi, eax
mov byte [0x4b300d], 0
xor eax, eax
call fcn.0044f618
lea edx, [ebp - 0x9c]
mov eax, 0x4adfd0
call fcn.00459040
mov ecx, 0x4a88b8
mov edx, 0x4a84b8
mov eax, 0x4adfd0
call fcn.0045900c
mov edx, dword [ebp - 0x8c]
mov dword [0x4a7c9c], edx
mov byte [0x4a77c2], bl
mov dword [0x4a7c84], 1
xor ecx, ecx
mov dword [0x4a7778], ecx
xor eax, eax
mov dword [0x4a779c], eax
call fcn.0043adc8
lea edx, [ebp - 0x49c]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.0045900c
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x49c]
push edx
cmp dword [ebp - 0x28], 0
setne al
and eax, 1
push eax
mov eax, 0x4b300d
mov dl, byte [ebp + 8]
push edx
mov edx, 0x495a5d
call fcn.004459f4
cmp byte [ebp - 1], 0
je 0x444e9b
xor eax, eax
call fcn.0043acd4
test al, al
jne 0x444e9b
xor eax, eax
jmp 0x4450d0
cmp byte [ebp - 2], 0
je 0x444eb2
mov edx, 0x495b9e
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
jmp 0x444f23
mov eax, 0x4ad5bc
mov edx, dword [0x4a90b8]
call fcn.0045ec40
test al, al
jne 0x444ecd
xor eax, eax
jmp 0x4450d0
mov edx, dword [0x4a90b8]
cmp dword [edx + 0x30], 0
jne 0x444f23
lea edx, [ebp - 0x89c]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.00458fe0
cmp byte [ebp - 0x89c], 0
je 0x444eff
lea eax, [ebp - 0x89c]
call fcn.0040adfc
push 0x495b9e
lea edx, [ebp - 0x89c]
push edx
call fcn.00482924
add esp, 8
lea edx, [ebp - 0x89c]
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
cmp dword [ebp - 0x28], 0
je 0x444fbf
cmp byte [ebp - 7], 0
jne 0x444fbf
lea edx, [ebp - 0xc9c]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.00458fe0
mov eax, 0x4ad5bc
call fcn.0045eafc
mov esi, eax
test esi, esi
je 0x444f70
cmp byte [ebp - 0xc9c], 0
jne 0x444fbf
mov eax, 0x4ad5bc
call fcn.0045eb2c
cmp esi, eax
jne 0x444fbf
test esi, esi
jne 0x444f7b
mov edx, 1
jmp 0x444f9d
push 0x4a84b8
push 0x43ba61
push dword [0x4ad5a8]
push str.ASKPROCESSVOLDLG
push dword [0x49edec]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x444fa9
sub edx, 2
je 0x444fb0
jmp 0x444fbf
xor eax, eax
jmp 0x4450d0
mov edx, 0x495b9e
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
mov byte [ebp - 0x109c], 0
test bl, bl
jne 0x44501f
cmp byte [0x4b300d], 0
je 0x44501f
lea ecx, [ebp - 0x109c]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4b300d
xor ecx, ecx
xor edx, edx
call fcn.004095e0
push 0x4b300d
call fcn.00484424
pop ecx
inc eax
jne 0x44501f
push 0x4b300d
mov eax, 0x1f7
call fcn.00410804
push eax
call fcn.00447a48
add esp, 8
xor eax, eax
jmp 0x4450d0
mov eax, 0x4adfd0
xor edx, edx
call fcn.00454abc
cmp byte [ebp - 0x109c], 0
je 0x445041
lea ecx, [ebp - 0x109c]
push ecx
call fcn.00484424
pop ecx
call fcn.00447c1c
cmp edi, eax
jne 0x445053
cmp dword [0x4afc1c], 0
je 0x445057
xor eax, eax
jmp 0x44505c
mov eax, 1
mov byte [ebp - 3], al
test bl, bl
je 0x44508c
cmp byte [ebp - 3], 0
je 0x44508c
push 0x40
mov eax, 0x3a7
call fcn.00410804
push eax
mov eax, 0x3a8
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
mov byte [0x4adb40], 0
mov eax, 0x4adb14
call fcn.00441fd8
test bl, bl
jne 0x4450cd
cmp dword [0x4afc1c], 0
jne 0x4450cd
cmp byte [0x4b3415], 0
je 0x4450cd
push 1
push 0x495a5d
push 0
push 0x4b300d
push 0x495f07
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4