Function at 0x44cafc
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb60
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4c219c
call fcn.0045dfec
test bl, bl
je 0x44cb30
test al, 1
jne 0x44cb30
xor eax, eax
jmp 0x44cede
call fcn.0044e3dc
mov edi, eax
mov byte [0x4c5248], 0
xor eax, eax
call fcn.00457054
lea edx, [ebp - 0xa0]
mov eax, 0x4c219c
call fcn.00462424
mov ecx, 0x4ba2b4
mov edx, 0x4b9eb4
mov eax, 0x4c219c
call fcn.004623f0
mov edx, dword [ebp - 0x90]
mov dword [0x4b8a6c], edx
mov byte [0x4b818a], bl
mov dword [0x4b864c], 1
xor ecx, ecx
mov dword [0x4b8120], ecx
xor eax, eax
mov dword [0x4b814c], eax
call fcn.00441e6c
lea edx, [ebp - 0x4a0]
mov eax, 0x4c219c
xor ecx, ecx
call fcn.004623f0
lea edx, [ebp - 0x8a0]
mov eax, 0x4c219c
xor ecx, ecx
call fcn.004623c4
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x4a0]
push edx
cmp dword [ebp - 0x2c], 0
setne al
and eax, 1
push eax
mov eax, 0x4c5248
mov dl, byte [ebp + 8]
push edx
mov edx, 0x4a3d11
call fcn.0044d864
cmp byte [ebp - 1], 0
je 0x44cc00
mov eax, 1
call fcn.00441cf7
test al, al
jne 0x44cc00
xor eax, eax
jmp 0x44cede
cmp byte [ebp - 0x8a0], 0
jne 0x44cc33
mov eax, 0x4c1454
call fcn.00468bbc
mov esi, eax
mov eax, 0x4c1454
call fcn.00468bf0
cmp esi, eax
jne 0x44cc33
cmp dword [ebp - 0x2c], 0
je 0x44cc2f
cmp byte [ebp - 0xb], 0
je 0x44cc33
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x44cc4a
mov edx, 0x4a3eb5
mov eax, dword [0x4baab4]
call fcn.0040f744
jmp 0x44ccc1
mov eax, 0x4c1454
xor ecx, ecx
mov edx, dword [0x4baab4]
call fcn.00468d04
test al, al
jne 0x44cc67
xor eax, eax
jmp 0x44cede
mov edx, dword [0x4baab4]
cmp dword [edx + 0x30], 0
jne 0x44ccc1
lea ecx, [ebp - 0x8a0]
push ecx
lea eax, [ebp - 0xca0]
push eax
call fcn.004949c8
add esp, 8
cmp byte [ebp - 0xca0], 0
je 0x44cc9d
lea eax, [ebp - 0xca0]
call fcn.0040bf34
push 0x4a3eb5
lea edx, [ebp - 0xca0]
push edx
call fcn.004948ec
add esp, 8
lea edx, [ebp - 0xca0]
mov eax, dword [0x4baab4]
call fcn.0040f744
cmp dword [ebp - 0x2c], 0
je 0x44cd43
cmp byte [ebp - 0xb], 0
jne 0x44cd43
mov eax, 0x4c1454
call fcn.00468bbc
mov esi, eax
test esi, esi
je 0x44ccf4
cmp byte [ebp - 0x8a0], 0
jne 0x44cd43
mov eax, 0x4c1454
call fcn.00468bf0
cmp esi, eax
jne 0x44cd43
test esi, esi
jne 0x44ccff
mov edx, 1
jmp 0x44cd21
push 0x4b9eb4
push 0x442e05
push dword [0x4c1440]
push str.ASKPROCESSVOLDLG
push dword [0x4ae754]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x44cd2d
sub edx, 2
je 0x44cd34
jmp 0x44cd43
xor eax, eax
jmp 0x44cede
mov edx, 0x4a3eb5
mov eax, dword [0x4baab4]
call fcn.0040f744
mov byte [ebp - 0x10a0], 0
test bl, bl
jne 0x44cdac
cmp byte [0x4c5248], 0
je 0x44cdac
cmp dword [0x4b8084], 5
je 0x44cdac
lea ecx, [ebp - 0x10a0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4c5248
xor ecx, ecx
xor edx, edx
call fcn.0040a090
push 0x4c5248
call fcn.0049635c
pop ecx
inc eax
jne 0x44cdac
push 0x4c5248
mov eax, 0x1f7
call fcn.00411fe8
push eax
call fcn.0044e1d4
add esp, 8
xor eax, eax
jmp 0x44cede
mov eax, 0x4c219c
xor ecx, ecx
xor edx, edx
call fcn.0045d418
cmp byte [ebp - 0x10a0], 0
je 0x44cdd0
lea eax, [ebp - 0x10a0]
push eax
call fcn.0049635c
pop ecx
call fcn.0044e3dc
cmp edi, eax
jne 0x44cde2
cmp dword [0x4c3df4], 0
je 0x44cde6
xor edx, edx
jmp 0x44cdeb
mov edx, 1
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x44ce53
test bl, bl
je 0x44ce1d
push 0x40
mov eax, 0x3a7
call fcn.00411fe8
push eax
mov eax, 0x3a8
call fcn.00411fe8
push eax
push dword [0x4c1440]
call sub.USER32.DLL_MessageBoxA
jmp 0x44ce53
cmp dword [0x4b927c], 0
je 0x44ce53
mov edx, 0x4ba2b4
mov eax, 0x4b9eb4
call fcn.0040a4d8
test al, al
jne 0x44ce53
mov eax, 0x4c1454
call fcn.00468ef0
test al, al
je 0x44ce53
mov eax, 0x4c1454
xor edx, edx
call fcn.0046364c
mov byte [0x4c19f0], 0
mov eax, 0x4c19c4
call fcn.004493b8
test bl, bl
jne 0x44cedb
cmp dword [0x4c3df4], 0
jne 0x44cedb
cmp byte [0x4c564d], 0
je 0x44cedb
push 0x4c5248
call fcn.004949f8
pop ecx
cmp eax, 0x3fe
jae 0x44cedb
push 0x4c5248
lea edx, [ebp - 0x14a0]
push edx
call fcn.004949c8
add esp, 8
lea eax, [ebp - 0x14a0]
call fcn.0040bf34
push 0x4a3db5
lea edx, [ebp - 0x14a0]
push edx
call fcn.004948ec
add esp, 8
push 1
push 0x4a3d11
push 0
lea ecx, [ebp - 0x14a0]
push ecx
push 0x4a4805
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4