Function at 0x441a70
Capabilities:
Get common file path
Get file size
Read file on windows
Set current directory

Disassembly:
push ebp
mov eax, 0xc
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00403a80
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x441c98
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x441c98
cmp byte [0x446810], 0
je 0x441cac
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp + 8]
cmp byte [eax + edx - 1], 0x5d
je 0x441cd0
mov edx, 1
lea eax, [eax + eax*2 + 0x11]
mov edi, 0x45655f
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403a80
mov edx, eax
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.004408b0
mov dword [esp], ebx
mov eax, 0x4467f8
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
cld
mov eax, dword [ebp - 0x24]
mov ecx, 9
mov esi, dword [ebp + 8]
mov dword [eax], 1
repe cmpsb byte [esi], byte es:[edi]
je 0x441d60
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
test eax, eax
je 0x441dd0
mov dword [esp], 0x208
mov eax, 0x4463d0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
mov dword [esp], 0x446810
call sub.KERNEL32.dll_SetCurrentDirectoryA
mov dword [ebp - 0x20], 0xffffffff
sub esp, 4
test eax, eax
jne 0x441e5b
mov dword [esp], 0x4463d0
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
cmp dword [ebp - 0x20], 0xffffffff
je 0x441f00
xor edx, edx
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov edi, eax
mov eax, 1
mov dword [esp + 4], eax
lea eax, [edi + 0x10]
mov dword [esp], eax
call fcn.00403a80
mov dword [ebp - 0x1c], eax
xor eax, eax
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], edi
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x441ee1
mov dword [esp], ebx
call fcn.00403f40
mov dword [esp], 1
mov eax, 0xc
mov dword [esp + 4], eax
call fcn.00403a80
mov ebx, dword [ebp - 0x1c]
mov esi, eax
mov eax, dword [ebp - 0x24]
lea edi, [ebx + edi]
cmp edi, ebx
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
jbe 0x441c7f
nop
mov dword [esi], ebx
mov eax, 0x5c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strchr
test eax, eax
mov ebx, eax
je 0x441c7f
mov byte [eax], 0
inc ebx
mov eax, 0x5c
mov dword [esi + 4], ebx
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strchr
test eax, eax
mov ebx, eax
je 0x441c7f
mov byte [eax], 0
mov eax, 0xc
add ebx, 2
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00403a80
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [esi + 8], eax
mov esi, eax
mov dword [eax + 4], 0
cmp edi, ebx
ja 0x441c10
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [0x446810], 0
mov dword [ebp + 8], 0x45655f
jne 0x441ab5
call fcn.00440c20
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp + 8]
cmp byte [eax + edx - 1], 0x5d
jne 0x441ace
lea esi, [esi]
inc eax
mov esi, 1
mov ebx, 0x5b
mov dword [esp + 4], esi
mov edi, 0x45655f
mov dword [esp], eax
call fcn.00403a80
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strrchr
mov byte [eax - 1], 0
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea eax, [eax + eax*2 + 1]
mov ecx, 1
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00403a80
mov edx, eax
mov ebx, eax
mov eax, esi
call fcn.004408b0
mov dword [esp], esi
call fcn.00403f40
cld
mov edx, dword [ebp - 0x24]
mov ecx, 9
mov esi, dword [ebp + 8]
mov dword [edx], 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x441b1f
mov esi, esi
lea edi, [edi]
mov dword [esp], 0x208
mov eax, 0x4463d0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
mov dword [esp], 0x446810
call sub.KERNEL32.dll_SetCurrentDirectoryA
mov dword [ebp - 0x20], 0xffffffff
sub esp, 4
test eax, eax
jne 0x441e9e
mov dword [esp], 0x4463d0
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
cmp dword [ebp - 0x20], 0xffffffff
je 0x441e19
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [eax], 1
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x24]
sub esp, 4
mov eax, dword [eax]
test eax, eax
jne 0x441b2c
nop
mov dword [esp], 0x80000001
lea eax, [ebp - 0x14]
mov ecx, str.SoftwareSimonTathamPuTTYSessions
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
test eax, eax
je 0x441e27
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov dword [eax], 0
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
mov dword [esp], ebx
call fcn.00403f40
jmp 0x441c8d
mov edx, dword [ebp - 0x24]
mov dword [edx], 0
jmp 0x441b1f
mov dword [esp + 4], ebx
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
test eax, eax
je 0x441e4b
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
jmp 0x441dfa
mov dword [esp], ebx
xor eax, eax
mov ecx, 0x80000000
mov dword [esp + 0x18], eax
mov eax, pe_nt_image_headers32
xor edi, edi
mov dword [esp + 0x14], eax
mov esi, 1
mov eax, 3
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x20], eax
sub esp, 0x1c
jmp 0x441b62
mov dword [esp], ebx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x18], eax
mov edx, 1
mov eax, 0x80000000
mov dword [esp + 0xc], ecx
mov edi, pe_nt_image_headers32
mov esi, 3
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x20], eax
sub esp, 0x1c
jmp 0x441d96
mov dword [esp + 4], ebx
mov dword [esp], 0x4565c8
call fcn.00440770
mov dword [esp], ebx
call fcn.00403f40
xor eax, eax
jmp 0x441c90
mov dword [esp + 4], ebx
mov dword [esp], 0x4565d9
jmp 0x441eec