Function at 0x44eed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
test byte [0x5a9e28], 0x40
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], esi
je 0x44ef0a
mov edx, dword [esi]
push 0xb
push 0
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
test eax, eax
mov edx, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 5
je 0x44ef6c
cmp byte [eax], 0x2d
jne 0x44ef6c
push 0x6e
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x44ef46
mov dword [esp + 0x1c], 7
mov eax, dword [esi + 4]
push 0x70
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x44ef60
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 2
mov edx, dword [esp + 0x10]
mov eax, dword [esi + edx*4]
test eax, eax
lea ebx, [esi + edx*4]
jne 0x44ef8a
mov edx, dword [esi]
push eax
push eax
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [eax], 0x22
jne 0x44efbc
push 0
push 0x104
push edi
mov ecx, esi
call fcn.004f51f0
test eax, eax
jge 0x44f0c7
mov edx, dword [esi]
push 3
push 0
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 0
cmp dword [ebx], 0
je 0x44f0cc
mov dword [esp + 0x24], ebx
lea esp, [esp]
cmp byte [edi], 0
je 0x44f026
mov al, byte [edi + 1]
test al, al
je 0x44f026
mov ecx, dword [ebx]
push 0x3a
push ecx
call fcn.00570260
add esp, 8
test eax, eax
jne 0x44f0cc
mov esi, dword [ebp + 8]
push esi
push 0x585e88
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
ja 0x44f0cf
dec edi
jmp 0x44f010
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44f010
mov dx, word [0x5842b8]
mov word [edi], dx
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f030
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44f040
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, dword [ebx]
mov edx, esi
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x44f060
mov edx, 0x585e80
mov ecx, esi
call fcn.0041e320
test eax, eax
jne 0x44f0bf
mov edx, 0x585e78
mov ecx, esi
call fcn.0041e320
test eax, eax
jne 0x44f0bf
mov edx, 0x585e70
mov ecx, esi
call fcn.0041e320
test eax, eax
mov edi, dword [esp + 0x14]
jne 0x44f0c3
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add ebx, 4
inc edx
test eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ebx
jne 0x44efd0
jmp 0x44f0cc
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
mov edx, esi
mov byte [esi], 0
call fcn.004f4660
cmp byte [edi], 0
jne 0x44f0fe
cmp byte [esi], 0
je 0x44f0fe
mov edx, edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44f0f2
mov byte [esi], cl
xor eax, eax
mov ecx, 0xf9
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
test eax, eax
mov edi, dword [esp + 0x14]
je 0x44f151
push 0x5a15c8
push 0x5a14c8
push 0x5a13c8
push 0x5a13c0
push edi
call fcn.005706cf
push 0x5a13c8
push 0x5a13c0
lea ecx, [esp + 0x44]
push 0x583954
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov al, byte [esp + 0x28]
test al, al
jne 0x44f16f
xor eax, eax
jmp 0x44f160
mov cl, byte [eax + 0x5a9798]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x44f160
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x5b4314]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
push edi
push 0
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x44f1a8
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
push 4
push edi
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4