Function at 0x4404d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b517d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d0b90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
push ecx
mov ecx, 0x4793b78
call fcn.00475880
movzx edx, al
test edx, edx
je case.default.0x44030c
push 0xffffffffffffffff
mov ecx, 0x4793b78
call fcn.00474fe0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x100
jg 0x440313
cmp dword [ebp - 0x14], 0x100
je 0x44052d
cmp dword [ebp - 0x14], 7
ja case.default.0x44030c
mov edx, dword [ebp - 0x14]
jmp dword [edx*4 + 0x44056c]
cmp dword [ebp - 0x14], 0x101
je 0x440537
jmp case.default.0x44030c
mov ecx, 0x489f860
call fcn.00467090
mov ecx, 0x489f1d0
call fcn.0041cb50
push 1
mov ecx, 0x489f1d0
call fcn.00464950
push 0x65
mov ecx, 0x4927138
call fcn.004472f0
push 0x64
mov ecx, 0x4927138
call fcn.004472f0
push 0x6e
mov ecx, 0x4927138
call fcn.004472f0
push 0x66
mov ecx, 0x4927138
call fcn.004472f0
push 0x67
mov ecx, 0x4927138
call fcn.004472f0
push 0x68
mov ecx, 0x4927138
call fcn.004472f0
push 0x70
mov ecx, 0x4927138
call fcn.004472f0
mov ecx, 0x574b5f8
call fcn.00449f60
mov ecx, 0x4793b64
call fcn.0046c100
mov ecx, 0x489f1d0
call fcn.00463500
mov ecx, 0x489f1d0
call fcn.00465860
push 0
mov ecx, 0x69dd128
call fcn.00478290
mov ecx, 0x69dd128
call fcn.0048d340
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 3
push 0
push 1
push 8
mov ecx, 0x489f1d0
call fcn.00460e30
push 8
mov ecx, 0x489f1d0
call fcn.004113b0
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, 0x4d2930
call fcn.0046c8e0
mov ecx, 0x574b760
call fcn.0045e5f0
mov ecx, dword [ebp - 0x10]
call fcn.00440910
jmp case.default.0x44030c
mov ecx, 0x489f1d0
call fcn.0041cb50
push 1
mov ecx, 0x489f1d0
call fcn.00464950
mov ecx, dword [ebp - 0x10]
call fcn.00440980
jmp case.default.0x44030c
mov ecx, 0x489f1d0
call fcn.0041cb50
push 1
mov ecx, 0x489f1d0
call fcn.00464950
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 3
push 0
push 1
push 7
mov ecx, 0x489f1d0
call fcn.00460e30
mov ecx, dword [ebp - 0x10]
call fcn.00440910
jmp case.default.0x44030c
mov ecx, dword [ebp - 0x10]
call fcn.004409b0
jmp case.default.0x44030c
mov ecx, dword [ebp - 0x10]
call fcn.004409e0
jmp case.default.0x44030c
push 2
push 2
mov ecx, dword [ebp - 0x10]
call fcn.0041a1f0
movzx edx, al
test edx, edx
jne 0x4404c5
mov ecx, dword [ebp - 0x10]
call fcn.00440940
jmp case.default.0x44030c
mov ecx, dword [ebp - 0x10]
call fcn.00440a10
jmp case.default.0x44030c
lea ecx, [ebp - 0x28]
call fcn.004942b0
mov dword [ebp - 4], 0
mov ecx, 0x489f1d0
call fcn.00411390
push eax
lea ecx, [ebp - 0x28]
call fcn.00494370
push 0x4c5454
lea ecx, [ebp - 0x28]
call fcn.004943c0
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00411210
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004942f0
jmp case.default.0x44030c
mov ecx, dword [ebp - 0x10]
call fcn.00440940
jmp case.default.0x44030c
mov ecx, 0x48a70f4
call fcn.00415e80
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 1
mov ecx, dword [ebp - 0x10]
call fcn.00415cc0
mov ecx, 0x50a9e78
call fcn.00459e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret