Function at 0x44fa6e
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4c6758]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
je 0x44fa87
mov dword [eax + 0x14], edi
mov ebx, dword [ebp + 8]
mov eax, 0x10f48d
cmp ebx, eax
jg 0x44fd86
je 0x44fd7d
lea eax, [ebx - 0x1b207]
cmp eax, 0xd
ja case.0x44faac.111116
jmp dword [eax*4 + 0x44fdca]
push edi
push edi
mov ecx, esi
call fcn.00455229
jmp 0x44fdc0
mov ecx, dword [esi + 0xe4]
push 0xffffffffffffffff
push edi
call fcn.00478696
jmp 0x44fdc0
mov ecx, esi
call fcn.00459482
jmp 0x44fdc0
mov ecx, esi
call fcn.004592e3
jmp 0x44fdc0
mov ecx, esi
call fcn.004590fb
jmp 0x44fdc0
mov ecx, esi
call fcn.00458ff9
jmp 0x44fdc0
mov ecx, esi
call fcn.00454e3c
cmp eax, edi
je 0x44fdc0
push eax
lea eax, [esi + 0x1d0]
add esi, 0x1d4
lea ecx, [ebp - 0xc]
neg eax
sbb eax, eax
and eax, esi
push dword [eax]
call fcn.00489f3d
push ecx
lea ecx, [ebp - 0xc]
mov eax, esp
push 0x8000
push eax
call fcn.0048a019
call fcn.00402a6c
mov eax, esp
push ecx
fld st(0)
push ecx
fstp qword [esp]
push eax
fstp st(0)
call fcn.0041996f
add esp, 0xc
call fcn.0048f91b
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0048996a
jmp 0x44fdc0
mov eax, dword [0x4b0550]
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
mov eax, 0x400
push eax
push eax
call fcn.00403c58
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00403cd2
mov edi, 0x1b210
cmp ebx, edi
jle 0x44fbbf
push str.SysWOW64_
lea ecx, [ebp - 0x10]
call fcn.00403927
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 8]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x10]
jmp 0x44fbde
push str.System32_
lea ecx, [ebp - 0x14]
call fcn.00403927
mov eax, dword [ebp - 0x14]
lea ecx, [ebp + 8]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x14]
call fcn.004038fb
mov ecx, esi
call fcn.00454e3c
test eax, eax
je 0x44fd64
push eax
lea eax, [esi + 0x1d0]
add esi, 0x1d4
lea ecx, [ebp - 0x34]
neg eax
sbb eax, eax
and eax, esi
push dword [eax]
call fcn.00489f3d
mov eax, dword [0x4b0550]
mov esi, str.regsvr32.exe
mov dword [ebp - 8], eax
mov eax, esi
test eax, eax
je 0x44fc29
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.00403bd8
lea eax, [ebp + 8]
lea ecx, [ebp - 8]
push eax
call fcn.00403a8c
push 0x4bd614
lea ecx, [ebp - 4]
call fcn.00403927
cmp ebx, edi
je 0x44fc58
cmp ebx, 0x1b212
jne 0x44fc7c
push 0x4b682c
lea ecx, [ebp - 0x18]
call fcn.00403927
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x18]
call fcn.004038fb
push 0x4b1254
lea ecx, [ebp - 0x20]
call fcn.00403927
push 0x4b6828
lea ecx, [ebp - 0x1c]
call fcn.00403927
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push 0x8000
push eax
call fcn.0048a019
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00403b20
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0x28]
call fcn.004038fb
lea ecx, [ebp - 0x2c]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
xor esi, esi
lea ecx, [ebp - 8]
push esi
mov dword [ebp - 0x70], 0x3c
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x4b1138
call fcn.00403c58
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x60], eax
call fcn.00403c58
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x50], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x34]
call fcn.0048996a
lea ecx, [ebp + 8]
call fcn.004038fb
jmp 0x44fdc0
push 1
jmp 0x44fd74
push 2
mov ecx, esi
call fcn.004553bb
jmp 0x44fdc0
mov ecx, esi
call fcn.00458f8a
jmp 0x44fdc0
mov eax, ebx
sub eax, 0x10f48e
je 0x44fdb9
dec eax
je 0x44fdb0
dec eax
dec eax
je 0x44fd9a
xor eax, eax
jmp 0x44fdc3
push edi
push 0xa76c
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44fdc0
mov ecx, esi
call fcn.00458e8a
jmp 0x44fdc0
mov ecx, esi
call fcn.00458e3a
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4