Function at 0x44a160
Capabilities:
Create process on windows
Delete file
Get common file path
Get session user name
Read .ini file

Disassembly:
sub esp, 0x608
mov al, byte [0x481910]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x514], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x515]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x514]
push 0x104
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
stosb byte es:[edi], al
call fcn.0042b3a0
push 0x104
lea edx, [esp + 0x520]
push 0x469570
push edx
call fcn.0042f1f0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x14
lea eax, [esp + 0x514]
push eax
push ebp
push 0x47d3c0
push 0x46954c
call esi
lea ecx, [esp + 0x514]
mov dword [esp + 0x28], eax
push ecx
push 1
push 0x47d3ac
push 0x46954c
call esi
mov dl, byte [0x481910]
mov ebx, eax
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x81]
mov byte [esp + 0x80], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x411]
mov byte [esp + 0x410], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x410]
push 0x104
push edx
mov dword [esp + 0x1c], ebp
stosb byte es:[edi], al
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], 0x30
call fcn.0042b3a0
push 0x104
lea eax, [esp + 0x41c]
push 0x46dda4
push eax
call fcn.0042f1f0
lea ecx, [esp + 0x424]
push ecx
call fcn.0042b3e0
add esp, 0x18
test eax, eax
jne 0x44a288
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x608
ret
mov edi, dword [esp + 0x620]
cmp edi, ebp
jne 0x44a2b2
call fcn.004455e0
test eax, eax
jne 0x44a2b2
call fcn.00445b80
test eax, eax
je 0x44a2b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x608
ret
call fcn.004455e0
test eax, eax
jne 0x44a33a
cmp edi, ebp
je 0x44a33a
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x44a32d
mov dl, byte [0x481910]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x309]
mov byte [esp + 0x308], dl
mov dword [esp + 0x24], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x24]
lea ecx, [esp + 0x308]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x308]
push 0x47d3a4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x44a323
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp esi, ebp
jne 0x44a33a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x608
ret
mov eax, dword [0x481b80]
lea ecx, [esp + 0x80]
push eax
push 0x47d3a0
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov dl, byte [0x481910]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x105]
mov byte [esp + 0x104], dl
mov byte [esp + 0x20c], dl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x20d]
add esp, 0xc
mov dword [esp + 0x3c], 0x44
rep stosd dword es:[edi], eax
mov dword [esp + 0x44], 0x4731d0
mov word [esp + 0x6c], 0xa
mov dword [esp + 0x68], 1
call fcn.0042b620
mov esi, eax
cmp esi, ebp
je 0x44a3c6
push ebp
call fcn.0042b5e0
add esp, 4
lea edx, [esp + 0xf8]
push 0x105
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0xf8]
push eax
call ebp
mov cl, byte [esp + eax + 0xf7]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x44a40a
lea ecx, [esp + 0xf8]
push 0x4695f4
push ecx
call edi
lea edx, [esp + 0xf8]
push 0x46f0bc
push edx
call edi
test ebx, ebx
je 0x44a4d6
lea eax, [esp + 0xf8]
lea ecx, [esp + 0x200]
push eax
push 0x105
push ecx
push 0x481910
push 0x46f0b4
push 0x46f0b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x44a4d6
lea edx, [esp + 0x200]
push edx
call ebp
test eax, eax
je 0x44a4d6
mov al, byte [0x481910]
mov ecx, 0x41
mov byte [esp + 0x308], al
xor eax, eax
lea edi, [esp + 0x309]
push 0x105
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x204]
lea edx, [esp + 0x30c]
push ecx
push edx
call fcn.0042f1a0
push 0x105
lea eax, [esp + 0x210]
push 0x47d394
push eax
call fcn.0042f1a0
lea ecx, [esp + 0x320]
push 0x105
lea edx, [esp + 0x21c]
push ecx
push edx
call fcn.0042f1f0
lea eax, [esp + 0x224]
add esp, 0x24
mov dword [esp + 0x44], eax
lea ecx, [esp + 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x44a4f2
push 1
call fcn.0042b5e0
add esp, 4
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebp, dword [esp + 0x620]
test ebp, ebp
je 0x44a554
mov eax, dword [esp + 0x28]
test eax, eax
je 0x44a554
push 0x473c24
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x44a554
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x473c0c
push esi
call ebx
push 0x473bf4
push esi
mov edi, eax
call ebx
test edi, edi
mov dword [esp + 0x20], eax
je 0x44a554
push 0
lea edx, [esp + 0x1c]
push ebp
push edx
call edi
test eax, eax
mov edi, 0x430
jne 0x44a558
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x620]
test eax, eax
jne 0x44a5fd
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
push ecx
push 0
push 0
push edi
push 0
push 0
lea edx, [esp + 0x9c]
push 0
lea eax, [esp + 0x430]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x44a694
call ebx
cmp eax, 0xe9
jne 0x44a67c
mov ecx, dword [esp + 0x14]
mov edx, ecx
inc ecx
cmp edx, 5
mov dword [esp + 0x14], ecx
jge 0x44a67c
mov ecx, dword [0x485b08]
test ecx, ecx
je 0x44a67c
mov ecx, dword [0x485b0c]
test ecx, ecx
jne 0x44a67c
push 0
call esi
push 0x3e8
call esi
push 0
call esi
jmp 0x44a56a
push 0
call ebp
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
push ecx
push 0
push edx
mov edx, dword [esp + 0x630]
push edi
push 0
push 0
lea eax, [esp + 0x9c]
push 0
lea ecx, [esp + 0x430]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x44a6ab
call ebx
cmp eax, 0xe9
jne 0x44a6a3
mov ecx, dword [esp + 0x14]
mov edx, ecx
inc ecx
cmp edx, 5
mov dword [esp + 0x14], ecx
jge 0x44a6a3
mov ecx, dword [0x485b08]
test ecx, ecx
je 0x44a6a3
mov ecx, dword [0x485b0c]
test ecx, ecx
jne 0x44a6a3
push 0
call esi
push 0x3e8
call esi
push 0
call esi
jmp 0x44a56a
push eax
push 0x47d324
call fcn.00446e00
add esp, 8
mov dword [esp + 0x10], 0
jmp 0x44a6c0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x44a6c0
cmp eax, 0xffffffff
je 0x44a6c0
jmp 0x44a6b8
push eax
push 0x47d2b4
jmp 0x44a682
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x44a6c0
cmp eax, 0xffffffff
je 0x44a6c0
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44a6d3
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x44a6d3
push eax
call ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x608
ret