Function at 0x44fa00
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x620bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44fa48
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004085f0
mov dword [ebp - 4], 0
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x44fddf
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x44fde9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x28]
call fcn.004085f0
mov byte [ebp - 4], 3
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x44fdf3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push str..lnk
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00408fd0
test al, al
jne 0x44fae6
push 4
push str..lnk
lea ecx, [ebp - 0x20]
call fcn.0040b130
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 5
test eax, eax
je 0x44fdfd
mov esi, dword [ebp - 0x20]
push eax
push esi
call fcn.005f44d0
add esp, 8
mov byte [ebp - 4], 3
test eax, eax
lea edx, [esi - 0x10]
sete byte [ebp - 0xd]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44fb26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x44fbdb
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x44fe07
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
mov byte [ebp - 4], 6
jge 0x44fb72
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00407d40
mov edi, dword [ebp - 0x18]
push 1
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0044cfa0
push dword [edi - 8]
push edi
call fcn.005e6c78
add esp, 0x1c
test eax, eax
js 0x44fe11
cmp eax, dword [edi - 8]
jg 0x44fe11
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], ecx
jne 0x44fbbd
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040b930
mov edx, dword [ebp - 0x20]
mov eax, esi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44fbdb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi - 0xc], 0
jne 0x44fc63
test ebx, ebx
jne 0x44fbed
xor ecx, ecx
jmp 0x44fc01
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44fbf2
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040b130
mov edi, dword [ebp - 0x18]
mov esi, 1
mov ecx, esi
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x44fc34
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00407d40
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [edi - 8]
push edi
call fcn.005e6c78
add esp, 8
test eax, eax
js 0x44fe11
cmp eax, dword [edi - 8]
jg 0x44fe11
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
jmp 0x44fc68
mov esi, 1
push ebx
lea ecx, [ebp - 0x14]
call fcn.004085f0
push dword [ebp - 0x14]
xorps xmm0, xmm0
mov byte [ebp - 4], 7
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x64], 0x3c
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x44fcfc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
sub esi, dword [eax - 4]
sub ecx, 0x104
or ecx, esi
jge 0x44fcd2
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00407d40
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0x104
jl 0x44fe11
mov dword [eax - 0xc], 0x104
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov word [eax + 0x208], cx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
mov eax, str.runas
cmove eax, ecx
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x60], 0x440
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
mov dword [ebp - 0x20], eax
add edx, 0xfffffff0
mov byte [ebp - 4], 3
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44fd57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44fd75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44fd90
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x44fdab
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44fdca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407030
push 0x80004005
call fcn.00407030
push 0x80004005
call fcn.00407030
push 0x80004005
call fcn.00407030
push 0x80004005
call fcn.00407030
push 0x80070057
call fcn.00407030
int3