Function at 0x44440c
Capabilities:
Get common file path
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x850
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x848], eax
lea eax, [esp + 0xc]
mov dword [eax], 0
push eax
call fcn.00443b52
mov dword [0x8fc778], eax
test eax, eax
je 0x4446fd
mov edi, 0x208
xor ebx, ebx
lea eax, [esp + 0x640]
push edi
push ebx
push eax
call fcn.006030b0
add esp, 0xc
lea esi, [esp + 0x438]
push edi
push ebx
xor ebx, ebx
push esi
call fcn.006030b0
add esp, 0xc
mov eax, 0x103
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x640]
push ecx
push eax
push 0x6398ea
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edi, [esp + 0x230]
mov eax, 0x208
push eax
push ebx
push edi
call fcn.006030b0
add esp, 0xc
mov esi, 0x639712
push str.http:__doctor.browser.360.cn_chrome_insert
push esi
push edi
call fcn.00444713
add esp, 0xc
mov ecx, 0x899a80
call fcn.0048b640
mov ebx, 0x8f6fb0
push 0x1048
xor eax, eax
push eax
push ebx
call fcn.006030b0
add esp, 0xc
push edi
push esi
push 0x823
push ebx
mov ebx, 0x103
call fcn.00405a12
add esp, 0x10
mov edi, 0x8f6ba0
mov eax, 0x208
push eax
xor eax, eax
push eax
push edi
call fcn.006030b0
add esp, 0xc
lea eax, [esp + 0x640]
push eax
push esi
push ebx
push edi
call fcn.00405a6e
add esp, 0x10
mov dword [0x89c128], 0xbb8
lea esi, [esp + 0x28]
mov eax, 0x208
push eax
xor eax, eax
push eax
push esi
call fcn.006030b0
add esp, 0xc
lea edi, [esp + 0x10]
push 0x29
push str.___________________________7e423633050ec8
push edi
call fcn.0047cba0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x444563
mov edi, dword [esp + 0x10]
push edi
push str.multipart_form_data__boundary_s
mov eax, 0x103
push eax
push esi
call fcn.00404830
add esp, 0x10
cmp byte [esp + 0x1b], 0
jns 0x44458b
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, dword [0x8fc778]
mov dword [0x89bf00], ecx
mov dword [0x89bf04], eax
xor edi, edi
mov ebx, 0x89bf08
push 0x208
push edi
push ebx
call fcn.006030b0
add esp, 0xc
push esi
push 0x639712
push 0x103
push ebx
call fcn.00405a6e
add esp, 0x10
mov dword [esp + 4], edi
mov dword [esp], edi
mov dword [esp + 8], edi
lea eax, [esp + 0x24]
mov dword [eax], edi
lea ecx, [esp + 0x20]
mov dword [ecx], edi
lea edx, [esp + 0x1c]
mov dword [edx], edi
push edx
push ecx
push eax
call fcn.00492130
add esp, 0xc
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
call fcn.00487ac0
mov edx, str.__WOW64
cmp dword [eax + 0x40], 1
je 0x444629
call fcn.00487ad0
cmp eax, 1
je 0x444624
cmp eax, 2
jne 0x444633
mov edx, str.__Win64__IA64
jmp 0x444629
mov edx, str.__Win64__x64
lea ecx, [esp + 0x10]
push edx
call fcn.004684ce
cmp byte [esp + 0x1b], 0
jns 0x444640
mov eax, dword [esp + 0x10]
jmp 0x444644
lea eax, [esp + 0x10]
mov esi, esp
push eax
push dword [esp + 0x24]
push dword [esp + 0x2c]
push str.Mozilla_5.0__Windows_NT__d._d_s_
push esi
call fcn.0047c780
add esp, 0x14
cmp byte [esp + 0x1b], 0
jns 0x444670
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
movzx eax, byte [esp + 0xb]
test al, al
jns 0x444680
mov esi, dword [esp]
mov eax, dword [esp + 4]
lea edi, [esp + 0x10]
push eax
push esi
push edi
call fcn.0047cba0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x444699
mov edi, dword [esp + 0x10]
mov esi, 0x8fb2d0
push 0x1048
push 0
push esi
call fcn.006030b0
add esp, 0xc
push edi
push 0x639712
push 0x823
push esi
call fcn.00405a12
add esp, 0x10
cmp byte [esp + 0x1b], 0
jns 0x4446d5
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xb], 0
jns 0x4446e7
push dword [esp]
call fcn.00517bd6
add esp, 4
mov ecx, 0x899a80
call fcn.0048b370
mov ecx, 0x899a80
push 0xffffffffffffffff
call fcn.0048b7e0
mov ecx, dword [esp + 0x848]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret