Function at 0x44bea0
Capabilities:
Create process on windows
Get common file path
Get startup folder
Hide graphical window
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xd8
mov eax, dword [0x4b4050]
xor eax, esp
mov dword [esp + 0xd4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
push 0x18
mov dword [esp + 0x1c], eax
call fcn.00456359
xorps xmm0, xmm0
mov dword [0x4b75e0], eax
xor ecx, ecx
movaps xmmword [esp + 0x54], xmm0
add esp, 4
mov dword [esp + 0x60], ecx
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
xor eax, eax
push 0x208
mov dword [esp + 0x68], 7
mov word [esp + 0x54], ax
mov word [esp + 0x6c], ax
mov dword [esp + 0x70], 0x1f8
mov dword [esp + 0x74], 0x175
mov byte [esp + 0x78], al
call fcn.00456725
add esp, 4
mov edi, eax
mov dword [esp + 0x10], edi
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x18
call fcn.00456359
mov esi, eax
mov ecx, edi
xorps xmm0, xmm0
add esp, 4
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 2]
mov dword [esi + 0x14], 7
mov word [esi], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44bf70
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov ecx, esi
sar eax, 1
push eax
push edi
call fcn.00421e60
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0044bc50
cmp dword [eax + 0x14], 8
jb 0x44bfa1
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push eax
push str.curdir
call edi
mov ecx, dword [esp + 0x34]
cmp ecx, 8
jb 0x44bfeb
mov edx, dword [esp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44bfe1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c66d
push ecx
push edx
call fcn.004566f4
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x4b761c
call fcn.0041eda0
lea ecx, [esp + 0x38]
call fcn.00452360
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x44c00e
mov eax, dword [eax]
push eax
push str.curconfdir
call edi
mov ecx, dword [esp + 0x34]
cmp ecx, 8
jb 0x44c052
mov edx, dword [esp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c048
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c672
push ecx
push edx
call fcn.004566f4
add esp, 8
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x28
push 0
movq qword [eax], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 0x10]
push str.userprofile
call edi
sub esp, 0x18
mov ecx, esp
push 0x4b761c
call fcn.0041eda0
lea ecx, [esp + 0x38]
call fcn.00452360
mov ecx, esp
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
xor ecx, ecx
mov word [eax], cx
lea ecx, [esp + 0x68]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
call fcn.00417780
mov ecx, dword [esp + 0x4c]
add esp, 0x18
cmp ecx, 8
jb 0x44c110
mov edx, dword [esp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c106
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c677
push ecx
push edx
call fcn.004566f4
add esp, 8
cmp byte [esp + 0x68], 1
jne 0x44c1e0
lea eax, [esp + 0x1c]
xor edi, edi
push eax
push 8
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44c16c
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 4
push eax
push 4
lea eax, [esp + 0xb8]
push eax
push 0x14
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne edi, dword [esp + 0xb0]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44c17b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 1
je 0x44c1e0
cmp dword [esi + 0x14], 8
jb 0x44c188
mov esi, dword [esi]
push dword [ebp + 0x14]
push 0
push dword [esp + 0x20]
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor esi, esi
mov ecx, dword [esp + 0x64]
cmp ecx, 8
jb 0x44c655
mov edx, dword [esp + 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c64b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c67c
jmp 0x44c64b
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x44c219
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x44c20f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c67c
mov eax, edx
push ecx
push eax
call fcn.004566f4
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
push 0x18
push esi
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.004566f4
push dword [esp + 0x18]
call fcn.0045614b
mov ecx, dword [esp + 0x24]
add esp, 0xc
call fcn.004488c0
test eax, eax
je 0x44c19f
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 8
push eax
mov dword [esp + 0xc0], 0x4000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push str.riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
mov dword [esp + 0x2c], 0
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x28], 0x30
mov dword [esp + 0x3c], eax
mov dword [esp + 0x50], str.LogDlg
mov dword [esp + 0x30], 0x44e560
call edi
mov esi, dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x44], 5
call esi
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
push 0x7f00
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], 0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x54], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], 0x30
call edi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x4c], str.CustomButton
mov dword [esp + 0x2c], 0x44d1e0
mov dword [esp + 0x34], 0x15
call esi
mov edx, 4
lea ecx, [esp + 0x50]
call fcn.0044edd0
sub esp, 0x18
lea eax, [esp + 0x68]
mov ecx, esp
push eax
call fcn.0041eda0
call fcn.00416a90
add esp, 0x18
lea eax, [esp + 0x50]
cmp dword [esp + 0x64], 8
mov ecx, 0x4b4af8
cmovae eax, dword [esp + 0x50]
push dword [esp + 0x60]
push eax
call fcn.00421e60
cmp byte [esp + 0x69], 1
jne 0x44c4ac
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x15
movups xmmword [ecx], xmm0
push str._USERPROFILE_Desktop
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0042bb40
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x34], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov edi, dword [0x4b4b14]
sub edi, dword [0x4b4b10]
sar edi, 7
test edi, edi
je 0x44c49e
cmp edi, 0x1ffffff
ja 0x44c681
shl edi, 7
cmp edi, 0x1000
jb 0x44c446
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x44c686
push eax
call fcn.00456359
add esp, 4
test eax, eax
je 0x44c67c
mov ecx, dword [esp + 0x34]
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x44c45d
test edi, edi
je 0x44c45b
push edi
call fcn.00456359
mov ecx, dword [esp + 0x38]
add esp, 4
mov esi, eax
jmp 0x44c45d
xor esi, esi
mov dword [ecx], esi
lea eax, [esi + edi]
mov dword [ecx + 4], esi
mov dword [ecx + 8], eax
mov eax, dword [0x4b4b14]
mov edi, dword [0x4b4b10]
mov dword [esp + 0xd4], eax
cmp edi, eax
je 0x44c49b
nop
push edi
mov ecx, esi
call fcn.00446a60
sub edi, 0xffffff80
sub esi, 0xffffff80
cmp edi, dword [esp + 0xd4]
jne 0x44c480
mov ecx, dword [esp + 0x34]
mov dword [ecx + 4], esi
call fcn.0044bcd0
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
add esp, 0x24
cmp byte [esp + 0x74], 0
mov eax, 0xcb0000
mov esi, 0xcf0000
mov dword [esp + 0x88], 0
push 0x7f00
cmovne esi, eax
mov dword [esp + 0xa0], 0
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push 0
movlpd qword [esp + 0x98], xmm0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xa0], eax
mov dword [esp + 0x94], 0x44c6c0
call edi
mov dword [esp + 0xa0], eax
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0xa8], 5
mov dword [esp + 0xb0], str.MainWndName
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push dword [esp + 0x18]
push 0
push 0
push dword [esp + 0x80]
push dword [esp + 0x80]
push 0x80000000
push 0x80000000
push esi
push str.USB_Menu
push str.MainWndName
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x44c585
push eax
push str.Crittcal_Error_Occurred
push str.Windows_Creation_Failed._Application_halting
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x44c19f
push dword [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0xc0]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x44c5dc
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop
lea eax, [esp + 0xc0]
push eax
call edi
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0xcc]
push eax
call esi
test eax, eax
jg 0x44c5b0
mov esi, dword [0x4b75e0]
test esi, esi
je 0x44c639
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x44c61b
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x44c611
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c67c
mov eax, edx
push ecx
push eax
call fcn.004566f4
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
push 0x18
push esi
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.004566f4
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [esp + 0xc8]
jmp 0x44c1a1
push ecx
push edx
call fcn.004566f4
add esp, 8
mov ecx, dword [esp + 0xdc]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0045613d
mov esp, ebp
pop ebp
ret 0x10
call fcn.0047361e
call fcn.0047361e
call fcn.0047361e
call fcn.0047361e
call fcn.00421bc0
call fcn.00401490
int3