Function at 0x44e5e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0xc], eax
push str.__debugbreak
mov eax, dword [ebp + 0x10]
push eax
call fcn.00420b20
add esp, 8
test eax, eax
je 0x44e60e
call dword [sym.imp.KERNEL32.dll_DebugBreak]
call fcn.0044d380
test eax, eax
jne 0x44e61f
or eax, 0xffffffff
jmp 0x44ed51
push 0
push 0x7dd2b0
lea ecx, [ebp - 0xbd]
call fcn.00456ee0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0043cd80
mov ecx, eax
call fcn.0043aa00
lea ecx, [ebp - 0x28]
call fcn.0040cd50
push 0x7dd2cc
lea ecx, [ebp - 0xe4]
call fcn.00403bf0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0xe4]
push eax
call fcn.00615fc0
add esp, 8
lea ecx, [ebp - 0xe4]
call fcn.00403c30
lea ecx, [ebp - 0x28]
call fcn.00403c80
push eax
call fcn.00422de0
mov ecx, eax
call fcn.0041b4d0
push 4
call fcn.00704930
add esp, 4
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x44e6b8
mov ecx, dword [ebp - 0xe8]
call fcn.0044f2e0
mov dword [ebp - 0x148], eax
jmp 0x44e6c2
mov dword [ebp - 0x148], 0
mov ecx, dword [ebp - 0x148]
push ecx
call fcn.00403df0
mov ecx, eax
call fcn.00401c10
call fcn.00635500
movzx edx, al
test edx, edx
je 0x44e77b
call fcn.006350c0
test eax, eax
jne 0x44e77b
lea ecx, [ebp - 0xc4]
call fcn.00405e90
push 0x104
push 0x105
lea ecx, [ebp - 0xc4]
call fcn.00406620
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xc4]
call fcn.00403ba0
push 5
push 0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00405e80
push eax
push 0x7dd2f8
push 0
call sub.SHELL32.dll_ShellExecuteW
mov dword [ebp - 0xec], 0
lea ecx, [ebp - 0xc4]
call fcn.00405ef0
lea ecx, [ebp - 0x28]
call fcn.00403c30
lea ecx, [ebp - 0xbd]
call fcn.00456fc0
mov eax, dword [ebp - 0xec]
jmp 0x44ed51
call fcn.0040a840
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44e8fe
push 0
push 0x7dd304
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x44e8d6
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44e8d6
call fcn.0043b4e0
mov ecx, eax
call fcn.0051ec50
test eax, eax
jne 0x44e823
push 0
push 0
push 0x52d
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0xf0], esp
push 0
call fcn.00432bb0
push 1
push 0
call fcn.0043cd80
mov ecx, eax
call fcn.0043ad40
mov ecx, eax
call fcn.00403c80
push eax
push 0x7dd32c
call fcn.00403df0
mov ecx, eax
call fcn.00402730
push 0x7dd338
lea ecx, [ebp - 0x110]
call fcn.00403bf0
lea eax, [ebp - 0x110]
push eax
call fcn.0043cd80
mov ecx, eax
call fcn.0043b080
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0x110]
call fcn.00403c30
cmp dword [ebp - 0xf4], 0
je 0x44e876
push 0
push 1
push 0x5fd
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043b4e0
mov ecx, eax
call fcn.0051ec70
test eax, eax
jne 0x44e89c
push 0
push 0
push 0x5fe
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp + 0x10], 0
je 0x44e8c5
mov eax, dword [ebp + 0x10]
push eax
call fcn.0072073b
add esp, 4
test eax, eax
jbe 0x44e8c5
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
call fcn.0044d6e0
add esp, 8
push 0x3e8
call fcn.00403df0
mov ecx, eax
call fcn.00403130
mov dword [ebp - 0x114], 0
lea ecx, [ebp - 0x28]
call fcn.00403c30
lea ecx, [ebp - 0xbd]
call fcn.00456fc0
mov eax, dword [ebp - 0x114]
jmp 0x44ed51
call fcn.00407a10
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [ebp - 0xb8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.0044f2b0
add esp, 4
push 1
push 2
push 0x14
call sub.urlmon.dll_CoInternetSetFeatureEnabled
push 0x7dd344
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x44e983
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0044fb10
mov ecx, eax
call fcn.00576f20
test eax, eax
je 0x44e983
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x28]
call fcn.00403c30
lea ecx, [ebp - 0xbd]
call fcn.00456fc0
mov eax, dword [ebp - 0x118]
jmp 0x44ed51
push 0
push str.start_svc_at_exe_start
call fcn.00422de0
mov ecx, eax
call fcn.0041b960
cmp eax, 1
jne 0x44e9a5
push 0
call fcn.00409040
add esp, 4
push 0
push str.stop_svc_at_exe_start
call fcn.00422de0
mov ecx, eax
call fcn.0041b960
cmp eax, 1
jne 0x44e9c7
push 0
call fcn.00409060
add esp, 4
call fcn.0044e570
call fcn.0044e1a0
call fcn.0044e3f0
lea edx, [ebp - 0x60]
push edx
call fcn.0044ee20
add esp, 4
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x11c], esp
push 0
call fcn.00432bb0
push 1
push 0
call fcn.0043cd80
mov ecx, eax
call fcn.0043ad40
mov ecx, eax
call fcn.00403c80
push eax
push 0x7dd390
call fcn.00403df0
mov ecx, eax
call fcn.00402730
push 0
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.00452430
push 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 4]
push ecx
call sub.gdiplus.dll_GdiplusStartup
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov ecx, 0x89e710
call fcn.0044f3b0
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00596650
add esp, 4
lea ecx, [ebp - 0x58]
call fcn.0040cd50
push 0x7dd39c
lea ecx, [ebp - 0x138]
call fcn.00403bf0
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x138]
push edx
call fcn.00615fc0
add esp, 8
lea ecx, [ebp - 0x138]
call fcn.00403c30
lea ecx, [ebp - 0xb4]
call fcn.00405e90
lea eax, [ebp - 0xb4]
push eax
push 0x7dd3ac
lea ecx, [ebp - 0x58]
call fcn.00403c80
push eax
lea ecx, [ebp - 0xbc]
push ecx
call fcn.006193d0
add esp, 0x10
lea ecx, [ebp - 0xb4]
call fcn.00405e80
push eax
call fcn.00596680
add esp, 4
push 1
push str.skin.ui
call fcn.0059c400
add esp, 8
call fcn.0043b4e0
mov ecx, eax
call fcn.00517880
push 0xf0
push 1
call fcn.00422de0
mov ecx, eax
call fcn.0041b650
call fcn.00432d70
mov ecx, eax
call fcn.0045d530
call fcn.0043ce50
mov ecx, eax
call fcn.0046fef0
call fcn.00432e40
mov ecx, eax
call fcn.004da4e0
call fcn.0044fd10
mov ecx, eax
call fcn.0042f780
call fcn.0044fde0
mov ecx, eax
call fcn.004a4b70
call fcn.00637df0
call fcn.0043cd80
mov ecx, eax
call fcn.0043a510
call fcn.0044feb0
mov ecx, eax
call fcn.0043e790
call fcn.0043b4e0
mov ecx, eax
call fcn.0051ec50
test eax, eax
jne 0x44eba9
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x13c], esp
push 0
call fcn.00432bb0
push 1
push 0
call fcn.0043cd80
mov ecx, eax
call fcn.0043ad40
mov ecx, eax
call fcn.00403c80
push eax
push 0x7dd3dc
call fcn.00403df0
mov ecx, eax
call fcn.00402730
push 0
push 1
call fcn.0043b4e0
mov ecx, eax
call fcn.00516fd0
call fcn.0043b4e0
mov ecx, eax
call fcn.00517800
call fcn.0044feb0
mov ecx, eax
call fcn.0043e980
call fcn.0040a880
lea edx, [ebp - 0x68]
push edx
call fcn.0044ee20
add esp, 4
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
sbb ecx, dword [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0xb0]
call fcn.00452470
lea ecx, [ebp - 0xb0]
call fcn.00452490
push 0
push 5
push edx
push eax
call fcn.00725cd0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x44ec21
mov dword [ebp - 0x3c], 1
xor edx, edx
mov word [ebp - 0xa8], dx
push 0x3e
push 0
lea eax, [ebp - 0xa6]
push eax
call fcn.007202b0
add esp, 0xc
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x7dd3e8
push 0x20
lea edx, [ebp - 0xa8]
push edx
call fcn.007259fa
add esp, 0x10
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x140], esp
push 0
call fcn.00432bb0
push 1
push 0
lea eax, [ebp - 0xa8]
push eax
push str.open_tm
call fcn.00403df0
mov ecx, eax
call fcn.00402730
call fcn.0044f980
call fcn.0044fde0
mov ecx, eax
call fcn.004a4c50
call fcn.0044fd10
mov ecx, eax
call fcn.0042f7f0
call fcn.00432e40
mov ecx, eax
call fcn.004da630
call fcn.0043ce50
mov ecx, eax
call fcn.00470080
call fcn.00432d70
mov ecx, eax
call fcn.0045d5f0
call fcn.00422de0
mov ecx, eax
call fcn.0041b6c0
call fcn.00422de0
mov ecx, eax
call fcn.0041b750
call fcn.0044fcb0
call fcn.0044fc40
call fcn.0044fab0
call fcn.0044fbe0
call fcn.0044fcb0
mov ecx, dword [ebp - 4]
push ecx
call sub.gdiplus.dll_GdiplusShutdown
mov ecx, 0x89e710
call fcn.0044f570
call dword [sym.imp.ole32.dll_OleUninitialize]
mov dword [ebp - 0x144], 0
lea ecx, [ebp - 0xbc]
call fcn.00405ef0
lea ecx, [ebp - 0xb4]
call fcn.00405ef0
lea ecx, [ebp - 0x58]
call fcn.00403c30
lea ecx, [ebp - 0x28]
call fcn.00403c30
lea ecx, [ebp - 0xbd]
call fcn.00456fc0
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret 0x10