Function at 0x44d2d4
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf0
mov ebp, edx
mov esi, eax
mov byte [esp + 8], 0
xor edi, edi
mov eax, dword [esi + 0xc]
call fcn.004aecd8
mov edx, eax
lea eax, [esp + 0x110]
call fcn.004b81b0
cmp bp, 0x26fa
jne 0x44d31a
fld xword [0x44d698]
fild qword [esi + 0x10]
fcompp
fnstsw ax
sahf
jbe 0x44d31a
mov bp, 0x26ec
test bp, bp
jne 0x44d323
mov bp, 0x26fa
cmp bp, 0x26fa
jne 0x44d4ca
mov eax, dword [0x4bee68]
cmp byte [eax], 6
jae 0x44d350
mov ax, 0x349
call fcn.004aa600
mov edx, 4
call fcn.004b12a8
jmp 0x44d68d
fild qword [esi + 0x10]
call fcn.004028e8
mov dword [esp + 0xc], eax
push 4
push 0x1000
mov eax, dword [esp + 0x14]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
jne 0x44d395
fild dword [esp + 0xc]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x44d68d
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov eax, esi
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x10]
mov eax, dword [esp + 0xc]
push eax
lea edx, [esp + 4]
mov ecx, ebx
mov eax, esi
mov ebp, dword [eax + 0x1a0]
call dword [ebp + 0x18]
cmp eax, dword [esp + 0xc]
jge 0x44d409
push 0x4000
mov eax, dword [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_VirtualFree_1
mov eax, esi
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
jmp 0x44d68d
mov eax, esi
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebx]
cmp eax, 0x47455243
je 0x44d436
cmp eax, 0x66676572
jne 0x44d47c
push 0x4000
mov eax, dword [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [0x4bea3c]
cmp dword [eax], 0
jne 0x44d470
push 0x400
push 0x320
mov eax, dword [0x4be960]
mov eax, dword [eax]
mov ecx, 0x64
mov edx, 0x64
call fcn.0047fe64
mov eax, esi
call fcn.00480184
jmp 0x44d68d
mov eax, dword [esi + 0xc]
call fcn.004aed10
mov edx, eax
mov ecx, dword [esp + 0xc]
mov eax, ebx
call fcn.0044785c
test al, al
je 0x44d4aa
push 0x4000
mov eax, dword [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_VirtualFree_1
jmp 0x44d68d
push 0x44d6a4
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x44d4c6
mov bp, 0x26ea
jmp 0x44d4ca
mov bp, 0x26ec
cmp byte [esi + 0x96], 0
je 0x44d4e3
cmp bp, 0x26eb
je 0x44d4fe
cmp byte [esi + 0xa0], 0
jne 0x44d4fe
cmp byte [esi + 0x90], 0
jne 0x44d4fe
cmp dword [esi + 0x5c], 0
jne 0x44d4fe
cmp dword [esi + 0x3c], 0
jne 0x44d4fe
cmp dword [esi + 0x48], 0
je 0x44d502
xor ebx, ebx
jmp 0x44d504
mov bl, 1
test bl, bl
je 0x44d516
lea eax, [esp + 0x10]
mov edx, dword [esi + 0xc]
call fcn.004b81b0
jmp 0x44d58e
mov edx, dword [0x4be784]
add edx, 0x100
lea eax, [esp + 0x10]
call fcn.004b81b0
mov eax, dword [esi + 0xc]
call fcn.004aed10
push eax
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_lstrcatA
mov al, byte [esi + 0x90]
test al, al
jle 0x44d555
cmp al, 0x1a
jg 0x44d555
lea eax, [esp + 0x10]
call fcn.004b219c
cmp byte [esi + 0x90], 0
jne 0x44d564
cmp dword [esi + 0x5c], 0
je 0x44d573
push 0x44d6a8
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_lstrcatA
push 4
mov ax, word [esi + 0x92]
call fcn.004b1cb8
mov edx, eax
lea ecx, [esp + 0x14]
mov eax, esi
call fcn.00419530
cmp bp, 0x26eb
jne 0x44d5a3
mov edi, dword [0x4be784]
add edi, 0x500
jmp 0x44d5f8
cmp bp, 0x26ea
jne 0x44d5af
mov edi, 0x44d6b0
cmp bp, 0x26ec
jne 0x44d5c2
mov edi, dword [0x4be784]
add edi, 0x1c7a
cmp bp, 0x26ed
jne 0x44d5d5
mov edi, dword [0x4be784]
add edi, 0x221f
cmp bp, 0x26ee
jne 0x44d5e8
mov edi, dword [0x4be784]
add edi, 0x231f
test edi, edi
jne 0x44d5f8
mov edi, dword [0x4be784]
add edi, 0x1c7a
push 1
push 0x44d6c0
lea eax, [esp + 0x18]
push eax
push edi
push 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x4be438]
mov dword [edx], eax
mov eax, dword [0x4be438]
cmp dword [eax], 0x20
ja 0x44d662
mov eax, dword [0x4be438]
cmp dword [eax], 0
jbe 0x44d662
mov edx, edi
mov ax, 7
call fcn.004acdac
test bl, bl
jne 0x44d68d
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44d68d
lea edx, [esp + 0x10]
mov ax, 4
call fcn.004acdac
jmp 0x44d68d
mov eax, 0xfa
call fcn.004ae058
mov eax, dword [0x4bef84]
mov byte [eax], 1
test bl, bl
jne 0x44d68d
cmp byte [esp + 8], 0
jne 0x44d68d
lea edx, [esp + 0x10]
mov eax, dword [0x4be3a8]
call fcn.004aa39c
add esp, 0x210
pop ebp
pop edi
pop esi
pop ebx
ret