Function at 0x44579f
Capabilities:
Create process on windows

Disassembly:
push 0x324
mov eax, 0x5817e8
call fcn.004f495a
mov ebx, ecx
push 0x60ca14
mov edx, 0x5c3078
lea ecx, [ebp - 0x290]
call fcn.004277f0
pop ecx
xor esi, esi
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x280]
call fcn.0042ff80
push eax
lea edx, [ebp - 0x290]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
call fcn.00480900
pop ecx
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 3
call fcn.0040bb00
cmp dword [ebp - 0x264], 0x10
lea edx, [ebp - 0x278]
push dword [ebp - 0x268]
cmovae edx, dword [ebp - 0x278]
lea ecx, [ebp - 0x2c0]
call fcn.004808b0
pop ecx
push eax
mov edx, str._data
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2d8]
call fcn.00427790
pop ecx
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 6
call fcn.0040bb00
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.005065b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040ba80
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x248]
call fcn.00422400
push 0x14
push 0x5b9e1c
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 8
call fcn.004313b0
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 0x10
jb 0x4458bf
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.004304e0
push str.true
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2c0]
call fcn.00427110
add esp, 0xc
mov esi, eax
mov edi, 0x5b5db0
mov byte [ebp - 4], 0xb
push edi
lea ecx, [ebp - 0x248]
call fcn.004222e0
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00424980
lea ecx, [ebp - 0x2c0]
call fcn.0040ba40
lea ecx, [ebp - 0x2a8]
call fcn.0040ba40
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 8
call fcn.0040bb00
lea edx, [ebp - 0x2d8]
lea ecx, [ebp - 0x230]
call fcn.00430640
mov esi, eax
push edi
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xc
call fcn.004222e0
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00424980
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 8
call fcn.0040ba40
push 0x44
pop esi
push esi
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.005065b0
xor eax, eax
mov dword [ebp - 0x330], esi
add esp, 0xc
lea edi, [ebp - 0x2e8]
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
stosd dword es:[edi], eax
lea edx, [ebp - 0x2e8]
cmovae ecx, dword [ebp - 0x248]
cmp dword [ebp - 0x24c], 8
push edx
stosd dword es:[edi], eax
lea edx, [ebp - 0x330]
push edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x230]
test eax, eax
je 0x445a24
push 0x25
push 0x5b9df4
call fcn.004313b0
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x14], 0x10
jb 0x4459fa
mov eax, dword [eax]
push ecx
push ecx
push esi
xor edx, edx
mov ecx, eax
call fcn.004801d0
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x230]
call fcn.0040bb00
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x8c]
jmp 0x445a56
push 0x24
push 0x5b9dcc
call fcn.004313b0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 0x10
jb 0x445a3c
mov eax, dword [eax]
push ecx
push ecx
push esi
xor edx, edx
mov ecx, eax
call fcn.004801d0
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.0040bb00
lea ecx, [ebp - 0x248]
call fcn.0040ba40
lea ecx, [ebp - 0x260]
call fcn.0040ba40
lea ecx, [ebp - 0x2d8]
call fcn.0040bb00
lea ecx, [ebp - 0x278]
call fcn.0040bb00
lea ecx, [ebp - 0x290]
call fcn.0040bb00
call fcn.004f4915
ret