Function at 0x443788
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Get file attributes
Identify system language via api
Query or enumerate registry value
Read .ini file
Resume thread
Set current directory
Set registry value
Terminate process

Disassembly:
cld
call sub.KERNEL32.dll_GetUserDefaultUILanguage
mov cl, 8
cmp al, 0x22
je 0x44379c
mov cl, 4
cmp al, 0x19
je 0x44379c
mov cl, 0
mov byte [0x454128], cl
call sub.KERNEL32.dll_GetCommandLineA
mov edx, eax
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4437a9
cmp dword [eax - 5], 0x656e7554
jne 0x4437c7
cmp word [eax - 7], 0x2d20
jne 0x4437c7
call fcn.00443e10
ret
mov ah, byte [edx]
inc edx
test ah, ah
je 0x4437ed
cmp ah, 0x22
je 0x4437d5
mov ah, 0x20
mov al, byte [edx]
test al, al
je 0x4437ed
inc edx
cmp al, ah
jne 0x4437d5
mov al, byte [edx]
test al, al
je 0x4437ed
cmp al, 0x20
jne 0x4437ed
inc edx
jmp 0x4437e0
mov al, byte [edx]
test al, al
jne 0x4437f5
xor edx, edx
mov dword [0x4544a4], edx
push 0x4544c8
call sub.KERNEL32.dll_GetStartupInfoA
mov esi, 0x454230
push 0x104
push esi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
mov edi, 0x4543a0
test eax, eax
mov al, 0xc
je 0x443bf0
xor edx, edx
xor ecx, ecx
mov al, byte [esi + ecx]
mov byte [edi + ecx], al
inc ecx
test al, al
je 0x44383d
cmp al, 0x2e
jne 0x44382a
mov edx, ecx
jmp 0x44382a
test edx, edx
je 0x44381e
mov dword [esi + edx], 0x696e69
mov dword [edi + edx], 0x6c6c64
xchg byte [0x45450d], al
test al, al
je 0x4438a4
push esi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4438a4
mov edx, dword [0x454128]
push 0x24
push dword [edx + 0x443048]
push dword [edx + 0x443054]
push 0
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x4438a4
push 0
push 0
call sub.ole32.dll_CoInitializeEx
test eax, eax
jne 0x4438a4
push 0
call fcn.00443ca0
push 1
call fcn.00443ca0
call sub.ole32.dll_CoUninitialize
cmp byte [0x45450c], 1
jl 0x4438ce
push esi
push 0x103
push 0x45412c
push 0
push 0x4430bd
push 0x4432ec
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp eax, 8
jae 0x443905
mov eax, dword [0x454128]
mov eax, dword [eax + 0x443060]
mov dword [0x454384], eax
push 0x454354
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x443bce
push esi
push 0x45412c
push 0x4430bd
push 0x4432ec
call sub.KERNEL32.dll_WritePrivateProfileStringA
push esi
push 0
push 0x443379
push 0x4432ec
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4544bc], eax
cmp eax, 0xc8
ja 0x4439b3
cmp eax, 1
jb 0x4439b3
push 0x4544b8
push 0x20003
push 0
push 0x443343
push reloc.WS2_32.dll_accept
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4439b3
push ecx
mov ecx, esp
mov eax, 0x4544c0
mov dword [eax], 4
push eax
push 0x4544c4
push ecx
push 0
push 0x443376
push dword [0x4544b8]
call sub.ADVAPI32.dll_RegQueryValueExA
pop ecx
test eax, eax
jne 0x44398d
cmp ecx, 4
jne 0x44398d
mov eax, dword [0x4544bc]
cmp eax, dword [0x4544c4]
je 0x4439a8
push 4
push 0x4544bc
push 4
push 0
push 0x443376
push dword [0x4544b8]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [0x4544b8]
call sub.ADVAPI32.dll_RegCloseKey
mov edi, 0x4432ef
push esi
push 0xfe
push 0x4432f5
push edi
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4544a8], eax
push esi
push 0xfe
push 0x4432f9
push edi
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4544ac], eax
push esi
push 0xa
push 0x4432fd
push edi
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4544b0], eax
push esi
push 0
push 0x443302
push edi
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [0x4544b4], eax
push esi
push 0
push 0x4432ec
push 0x4432ec
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, 0x443342
mov edx, ecx
mov edi, ecx
test al, 1
je 0x443a2e
mov ecx, 0x443331
test al, 2
je 0x443a37
mov edx, 0x44333a
test al, 4
je 0x443a40
mov edi, 0x443329
mov eax, dword [0x4544a4]
test eax, eax
je 0x443a67
push eax
push edi
push edx
push ecx
push 0x45412c
push 0x443311
push 0x104
push esi
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x20
jmp 0x443a82
push edi
push edx
push ecx
push 0x45412c
push 0x443306
push 0x104
push esi
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x1c
push 0x4544b8
push 0x4544c8
push 0
push 0
push 0x24
push 0
push 0
push 0
push esi
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x443ac6
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x443ab3
cmp eax, 3
jne 0x443abf
dec byte [0x45450c]
jge 0x443805
mov al, 0
jmp 0x443bf0
mov edi, 0x45412c
xor edx, edx
mov al, byte [edi]
inc edi
test al, al
je 0x443adc
cmp al, 0x5c
jne 0x443acd
mov edx, edi
jmp 0x443acd
test edx, edx
mov cl, 1
je 0x443bdb
mov byte [edx - 1], 0
push 0x45412c
call sub.KERNEL32.dll_SetCurrentDirectoryA
test eax, eax
mov cl, 2
je 0x443bdb
push dword [0x4544b4]
push dword [0x4544b0]
push dword [0x4544ac]
push dword [0x4544a8]
push dword [0x4544b8]
push 0
call fcn.00408b30
add esp, 0x18
test eax, eax
mov cl, 5
je 0x443bdb
push 0x1a
push 0x4013cb
call fcn.00443c27
mov al, 0x24
jb 0x443be0
mov esi, 0x454230
mov edi, 0x4434b0
mov ecx, 0x1a
repe cmpsb byte [esi], byte es:[edi]
jne 0x443be0
push 0x104
push 0x4543a0
push 0x400ef0
call fcn.00443c49
mov cl, 6
jb 0x443bdb
push 4
push 0x44307c
push 0x4013cc
call fcn.00443c49
mov cl, 7
jb 0x443bdb
mov esi, 0x44306c
mov edi, dword [esi]
test edi, edi
je 0x443bb9
push 1
push edi
call fcn.00443c27
jb 0x443bb4
mov al, byte [esi + 4]
cmp al, byte [0x454230]
jne 0x443bb4
lea eax, [esi + 5]
push 1
push eax
push edi
call fcn.00443c49
add esi, 6
jmp 0x443b8d
push dword [0x4544bc]
call sub.KERNEL32.dll_ResumeThread
push 1
call fcn.00408b30
add esp, 4
push 2
call fcn.00408b30
add esp, 4
xor eax, eax
ret
mov al, 0x18
movzx ecx, cl
push eax
push ecx
push esp
push dword [0x4544b8]
call sub.KERNEL32.dll_TerminateProcess
pop ecx
pop eax
movzx eax, al
mov esi, 0x454230
mov edi, dword [0x454128]
mov eax, dword [edi + eax + section.SGROUP]
push ecx
push eax
push 0x104
push esi
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x10
push 0x10
push dword [edi + 0x443030]
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x443bce