Function at 0x44c710
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9f1e
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x542488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x2e0], esi
push eax
mov dword [ebp - 0x2dc], 0
call fcn.004b8860
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x44c7a4
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x505e80
mov byte [esi], 0
call fcn.0040c4f0
jmp 0x44c9f9
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00402260
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 4], 0
call fcn.00447a80
cmp dword [ebp - 0x258], 8
lea ecx, [ebp - 0x26c]
mov eax, dword [ebp - 0x25c]
cmovae ecx, dword [ebp - 0x26c]
mov byte [ebp - 4], 1
lea eax, [ecx + eax*2]
push eax
push ecx
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.0044d730
mov dword [ebp - 0x2dc], 2
push str.kingsoftoffice6configs
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 2
call fcn.00447180
mov edi, eax
mov ebx, 0x7f
cmp byte [edi + 0x1a], 0
jne 0x44c84e
mov byte [edi + 0x1a], 1
xor ecx, ecx
mov edi, edi
mov al, byte [ecx + edi]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ecx + edi], dl
inc ecx
cmp ecx, 0x19
jb 0x44c830
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44c853
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x254]
call fcn.00416190
mov edx, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x2dc], 6
mov ecx, dword [edx]
mov dword [ebp - 0x23c], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x238], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x234], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x230], ecx
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x22c], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x228], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov edx, dword [ebp - 0x240]
mov byte [ebp - 4], 4
cmp edx, 0x10
jb 0x44c90d
mov ecx, dword [ebp - 0x254]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44c903
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44cbb5
push edx
push ecx
call fcn.004b5e6a
add esp, 8
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x244], 0
cmovae eax, dword [ebp - 0x23c]
push eax
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x254], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44c950
test al, 0x10
jne 0x44ca17
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
push 0
cmovae eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x44ca17
push eax
mov dword [esi + 0x10], eax
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x505e80
mov byte [esi], al
call fcn.0040c4f0
mov edx, dword [ebp - 0x228]
cmp edx, 0x10
jb 0x44c9c8
mov ecx, dword [ebp - 0x23c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44c9be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44cbb0
push edx
push ecx
call fcn.004b5e6a
add esp, 8
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0xf
mov byte [ebp - 0x23c], 0
call fcn.004480e0
lea ecx, [ebp - 0x26c]
call fcn.00402400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5e78
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x224], 0x2e
mov byte [ebp - 0x223], 0x21
mov byte [ebp - 0x222], 0x2f
mov byte [ebp - 0x221], 0x43
mov byte [ebp - 0x220], 0x64
mov byte [ebp - 0x21f], 0x28
mov byte [ebp - 0x21e], 0x50
mov byte [ebp - 0x21d], 0x36
mov byte [ebp - 0x21c], 0x72
mov byte [ebp - 0x21b], 0x78
mov byte [ebp - 0x21a], 0
mov al, byte [ebp - 0x224]
mov byte [ebp - 0x219], 0
cmp byte [ebp - 0x219], 0
jne 0x44caa9
mov byte [ebp - 0x219], 1
xor ecx, ecx
mov al, byte [ebp + ecx - 0x224]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + ecx - 0x224], dl
inc ecx
cmp ecx, 0xa
jb 0x44ca83
lea ecx, [ebp - 0x224]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 4], 5
mov byte [esi], 0
mov dword [ebp - 0x2dc], 0xe
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44cad1
sub ecx, edx
mov edx, dword [ebp - 0x22c]
lea ebx, [edx + ecx]
cmp ebx, 0xf
jbe 0x44cb36
cmp ebx, 0x7fffffff
ja 0x44cbba
mov edi, ebx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x44cb08
mov edi, 0x7fffffff
jmp 0x44cb12
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.0040c490
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov cl, byte [esi]
mov byte [eax], cl
mov dword [esi], eax
mov edx, dword [ebp - 0x22c]
mov dword [esi + 0x10], 0
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
push edx
cmovae eax, dword [ebp - 0x23c]
mov ecx, esi
push eax
call fcn.00416190
lea ecx, [ebp - 0x224]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44cb60
sub ecx, edx
lea eax, [ebp - 0x224]
push ecx
push eax
mov ecx, esi
call fcn.00416190
mov edx, dword [ebp - 0x228]
cmp edx, 0x10
jb 0x44c9c8
mov ecx, dword [ebp - 0x23c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44c9be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44c9be
call fcn.004c19b9
call fcn.004c19b9
call fcn.004025f0
int3