Function at 0x44ce30
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x41c]
sub esp, 0x41c
push 0xffffffffffffffff
push 0x4a495d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4db064]
xor eax, ebp
mov dword [ebp + 0x418], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x4c00e4
mov edx, 0x4bfa6c
lea ecx, [ebp]
call fcn.00405e40
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.0041f670
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x44cea1
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00403b70
cmp ebx, 0xffffffff
jne 0x44ced7
or edi, ebx
jmp 0x44d0c2
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 4
push 0
call fcn.00477749
xor ebx, ebx
add esp, 4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
test esi, esi
je 0x44cf47
cmp word [esi], bx
je 0x44cf47
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xfde9
call ebx
mov edi, eax
test edi, edi
jle 0x44cf45
push edi
call fcn.0047774e
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call ebx
mov ebx, dword [ebp - 0x10]
jmp 0x44cf47
xor ebx, ebx
lea esi, [ebp + 0x30]
mov ecx, str._InternetShortcut__r_nURL
mov edx, esi
mov edi, ebx
mov al, 0x5b
sub ecx, edx
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x44cf57
mov byte [esi], al
cmp byte [ebx], al
je 0x44cff7
mov al, byte [ebx]
nop dword [eax]
lea edi, [edi + 1]
cmp al, 0x61
jl 0x44cf7b
cmp al, 0x7a
jle 0x44cfe1
cmp al, 0x41
jl 0x44cf83
cmp al, 0x5a
jle 0x44cfe1
cmp al, 0x30
jl 0x44cf8b
cmp al, 0x39
jle 0x44cfe1
mov ecx, str.__.____:_______
mov dl, 0x2d
cmp dl, al
je 0x44cfa0
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x44cf92
jmp 0x44cfa8
sub ecx, str.__.____:_______
jns 0x44cfe1
mov dl, al
mov byte [esi], 0x25
sar dl, 4
and al, 0xf
and dl, 0xf
cmp dl, 0xa
sbb cl, cl
and cl, 0xf9
add cl, 0x37
add cl, dl
mov byte [esi + 1], cl
cmp al, 0xa
jae 0x44cfd5
add al, 0x30
mov byte [esi + 2], al
mov eax, 3
jmp 0x44cfe8
add al, 0x37
mov byte [esi + 2], al
mov eax, 3
jmp 0x44cfe8
mov byte [esi], al
mov eax, 1
add esi, eax
mov byte [esi], 0
mov al, byte [edi]
test al, al
jne 0x44cf70
mov edi, dword [ebp - 0x18]
lea eax, [ebp + 0x30]
mov word [esi], 0xa0d
add esi, 2
push 0
mov byte [esi], 0
sub esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
test esi, esi
je 0x44d0a0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.0041f670
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x44d044
mov eax, dword [eax]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
push 0
push eax
push str.open
push 0
call esi
mov edi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.00403b70
cmp edi, 0x20
ja 0x44d0a0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.0041f670
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x44d085
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0
push 0
call esi
mov edi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.00403b70
xor eax, eax
cmp edi, 0x20
cmova edi, eax
mov byte [ebp - 4], al
push ebx
call fcn.00477749
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00403b70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x418]
xor ecx, ebp
call fcn.00477280
lea esp, [ebp + 0x41c]
pop ebp
ret