Function at 0x441750
Capabilities:
Create shortcut via ishelllink
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf534
mov eax, dword fs:[0]
push eax
sub esp, 0x70c
mov eax, dword [0x4f4164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6d8], 0
call fcn.0040ba10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
jns 0x441875
mov ecx, dword [0x4f8ee0]
add ecx, dword [0x4f8edc]
je 0x441829
lfence
mov dword [ebp - 0x704], 0
call fcn.0040ba10
mov dword [ebp - 0x708], eax
lock inc dword [ebp - 0x704]
cmp dword [ebp - 0x708], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x6d8], 1
jne 0x4417f7
call fcn.0040ba10
mov dword [ebp - 0x708], eax
lock inc dword [ebp - 0x704]
mov eax, dword [ebp - 0x708]
lea ecx, [ebp - 0x6e4]
push esi
push str.CoInitialize_failed_hr_8.8x
push str.migrate::MigrateShortcut32to64
push 0x400000
push ecx
push 0
push eax
mov dword [ebp - 0x6e4], 4
call fcn.0040df80
add esp, 0x1c
mov eax, dword [ebp - 0x6d8]
test al, 1
je 0x4428d2
and eax, 0xfffffffe
mov dword [ebp - 0x6d8], eax
or eax, 0xffffffff
mov dword [ebp - 0x708], 0
lock xadd dword [ebp - 0x704], eax
js 0x441869
call fcn.0040dfb0
or eax, 0xffffffff
lock xadd dword [ebp - 0x704], eax
jns 0x441857
lock inc dword [ebp - 0x704]
jmp 0x4428d2
mov dword [ebp - 0x6f4], 0
mov dword [ebp - 0x6f0], 0
push 0x40
lfence
call fcn.00450e28
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x6f4], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6e8], 0
push 0x40
lfence
call fcn.00450e28
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x6ec], eax
lea eax, [ebp - 0x6f8]
mov byte [ebp - 4], 2
push eax
push 0
push 0
push 0x4d1780
mov dword [ebp - 0x6f8], 0
call sub.SHELL32.dll_SHGetKnownFolderPath
mov edi, eax
test edi, edi
js 0x44215a
mov esi, dword [ebp - 0x6f8]
test esi, esi
je 0x44215a
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441923
sub ecx, edx
sar ecx, 1
jne 0x441a0e
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x4419bb
mov dword [ebp - 0x70c], 0
call fcn.0040ba10
mov dword [ebp - 0x710], eax
lock inc dword [ebp - 0x70c]
cmp dword [ebp - 0x710], 0
mov byte [ebp - 4], 4
mov dword [ebp - 0x6d8], 4
jne 0x44198a
call fcn.0040ba10
mov dword [ebp - 0x710], eax
lock inc dword [ebp - 0x70c]
mov eax, dword [ebp - 0x710]
lea ecx, [ebp - 0x6fc]
push str.pszCommonPrograms_is_empty
push str.migrate::MigrateShortcut32to64
push 0x400000
push ecx
push 0
push eax
mov dword [ebp - 0x6fc], 4
call fcn.0040df80
add esp, 0x18
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 4], 2
test al, 4
je 0x44222c
and eax, 0xfffffffb
mov dword [ebp - 0x6d8], eax
or eax, 0xffffffff
mov dword [ebp - 0x710], 0
lock xadd dword [ebp - 0x70c], eax
js 0x441a02
call fcn.0040dfb0
or eax, 0xffffffff
lock xadd dword [ebp - 0x70c], eax
jns 0x4419f0
lock inc dword [ebp - 0x70c]
jmp 0x44222c
push 0x250
lea eax, [ebp - 0x6d0]
push 0
push eax
call fcn.00495790
mov ecx, esi
mov dword [ebp - 0x438], 0
add esp, 0xc
mov dword [ebp - 0x428], 0
xor eax, eax
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441a50
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x438]
call fcn.004038a0
mov ecx, dword [ebp - 0x428]
mov byte [ebp - 4], 5
test ecx, ecx
jne 0x441ac7
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x44222c
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x441ab8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
jmp 0x44222c
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x441af5
push 1
push 0x4c9bb8
lea ecx, [ebp - 0x438]
call fcn.004052f0
push 1
push 0x4c9bcc
lea ecx, [ebp - 0x438]
call fcn.004052f0
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x6d0]
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x441ce9
mov edx, dword [ebp - 0x6f8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441b66
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x468]
call fcn.004038a0
lea eax, [ebp - 0x6ec]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x6f4]
push eax
push 1
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.00442900
mov edx, dword [ebp - 0x454]
add esp, 0x14
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x441bf0
mov ecx, dword [ebp - 0x468]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x441be6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
xor eax, eax
mov word [ebp - 0x468], ax
lea eax, [ebp - 0x6d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x441ce2
nop
mov edx, dword [ebp - 0x6f8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441c42
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x468]
call fcn.004038a0
lea eax, [ebp - 0x6ec]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x6f4]
push eax
push 1
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.00442900
mov edx, dword [ebp - 0x454]
add esp, 0x14
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x441ccc
mov ecx, dword [ebp - 0x468]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x441cc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
lea eax, [ebp - 0x6d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x441c10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x6ec]
mov esi, dword [eax]
cmp esi, eax
je 0x442105
nop dword [eax]
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6e0], eax
jb 0x441d20
mov ecx, dword [ecx]
mov dword [ebp - 0x6d4], ecx
mov edi, eax
cmp eax, 8
jae 0x441d52
movups xmm0, xmmword [ecx]
mov ecx, 7
mov dword [ebp - 0x6d8], ecx
or edi, ecx
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x43c], ecx
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x6dc], ecx
jmp 0x441db3
or edi, 7
mov ecx, SysReAllocString
cmp edi, 0x7ffffffe
mov eax, edi
cmova eax, ecx
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x6d8], eax
inc eax
push eax
call fcn.00403d40
mov ecx, dword [ebp - 0x6e0]
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x450], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x6d4]
push eax
call fcn.00495210
mov ecx, dword [ebp - 0x6d8]
add esp, 0xc
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x44202d
push 0x250
lea eax, [ebp - 0x6d0]
push 0
push eax
call fcn.00495790
mov edx, dword [ebp - 0x424]
lea eax, [ebp - 0x450]
mov ecx, dword [ebp - 0x6e0]
add esp, 0xc
cmp dword [ebp - 0x6d8], 8
mov dword [ebp - 0x6fc], edx
cmovae eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x6e4], eax
cmp ecx, edx
ja 0x441e51
lea edi, [ecx + ecx]
mov dword [ebp - 0x428], ecx
cmp edx, 8
lea eax, [ebp - 0x438]
push edi
cmovae eax, dword [ebp - 0x438]
push dword [ebp - 0x6e4]
mov dword [ebp - 0x6fc], eax
push eax
call fcn.00495210
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
xor ecx, ecx
mov word [eax + edi], cx
mov ecx, dword [ebp - 0x438]
jmp 0x441f29
cmp ecx, 0x7ffffffe
ja 0x4428ed
cmp edi, 0x7ffffffe
jbe 0x441e6c
mov edi, SysReAllocString
jmp 0x441e8a
mov ecx, edx
mov eax, SysReAllocString
shr ecx, 1
sub eax, ecx
cmp edx, eax
jbe 0x441e82
mov edi, SysReAllocString
jmp 0x441e8a
lea eax, [edx + ecx]
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x438]
call fcn.00403d40
mov ecx, dword [ebp - 0x6e0]
mov edx, eax
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x6d4], edx
mov dword [ebp - 0x428], ecx
lea edi, [ecx + ecx]
push edi
push dword [ebp - 0x6e4]
push edx
call fcn.00495210
mov ecx, dword [ebp - 0x6d4]
xor eax, eax
add esp, 0xc
mov word [ecx + edi], ax
mov eax, dword [ebp - 0x6fc]
cmp eax, 8
jb 0x441f23
mov ecx, dword [ebp - 0x438]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x441f08
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
lfence
call fcn.00450975
mov ecx, dword [ebp - 0x6d4]
add esp, 8
mov dword [ebp - 0x438], ecx
jmp 0x441f2f
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x6d4], ecx
mov edx, dword [ebp - 0x428]
test edx, edx
je 0x4420c1
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, ecx
cmp word [eax + edx*2 - 2], 0x5c
je 0x441f67
push 1
push 0x4c9bb8
lea ecx, [ebp - 0x438]
call fcn.004052f0
push 1
push 0x4c9bcc
lea ecx, [ebp - 0x438]
call fcn.004052f0
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x6d0]
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44202d
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x6f4]
push eax
push 0
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.00442900
add esp, 0x14
lea eax, [ebp - 0x6d0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x442018
nop
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x6f4]
push eax
push 0
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.00442900
add esp, 0x14
lea eax, [ebp - 0x6d0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x441fe0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x450]
jmp 0x442039
mov eax, dword [ebp - 0x6d8]
mov ecx, dword [ebp - 0x6dc]
mov byte [ebp - 4], 5
cmp eax, 8
jb 0x442071
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442067
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x442097
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x442093
cmp esi, dword [eax + 8]
jne 0x442093
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x442083
mov esi, eax
jmp 0x4420ad
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4420ad
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4420a1
cmp esi, dword [ebp - 0x6ec]
jne 0x441d00
mov edx, dword [ebp - 0x438]
jmp 0x442113
mov eax, dword [ebp - 0x6d8]
mov byte [ebp - 4], 5
cmp eax, 8
jb 0x44210d
mov ecx, dword [ebp - 0x6dc]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4420fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
mov edx, dword [ebp - 0x438]
jmp 0x442113
mov edx, dword [ebp - 0x6d4]
mov ecx, dword [ebp - 0x424]
mov byte [ebp - 4], 2
cmp ecx, 8
jb 0x44222c
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44214b
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push ecx
push edx
call fcn.00450975
add esp, 8
jmp 0x44222c
mov eax, dword [0x4f8ee0]
add eax, dword [0x4f8edc]
je 0x4421e2
mov dword [ebp - 0x714], 0
call fcn.0040ba10
mov dword [ebp - 0x718], eax
lock inc dword [ebp - 0x714]
cmp dword [ebp - 0x718], 0
mov byte [ebp - 4], 3
mov dword [ebp - 0x6d8], 2
jne 0x4421b0
call fcn.0040ba10
mov dword [ebp - 0x718], eax
lock inc dword [ebp - 0x714]
mov eax, dword [ebp - 0x718]
lea ecx, [ebp - 0x700]
push edi
push str.SHGetKnownFolderPath_failed_hr_8.8x
push str.migrate::MigrateShortcut32to64
push 0x400000
push ecx
push 0
push eax
mov dword [ebp - 0x700], 4
call fcn.0040df80
add esp, 0x1c
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 4], 2
test al, 2
je 0x44222c
and eax, 0xfffffffd
mov dword [ebp - 0x6d8], eax
or eax, 0xffffffff
mov dword [ebp - 0x718], 0
lock xadd dword [ebp - 0x714], eax
js 0x442225
call fcn.0040dfb0
or eax, 0xffffffff
lock xadd dword [ebp - 0x714], eax
jns 0x442213
lock inc dword [ebp - 0x714]
mov eax, dword [ebp - 0x6f4]
mov esi, dword [eax]
cmp esi, eax
je 0x442868
nop dword [eax]
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x6e0], ecx
jb 0x44227e
mov eax, dword [eax]
mov dword [ebp - 0x6e4], eax
cmp ecx, 8
jae 0x442294
movups xmm0, xmmword [eax]
mov edi, 7
movups xmmword [ebp - 0x480], xmm0
jmp 0x4422df
mov edi, ecx
mov eax, SysReAllocString
or edi, 7
lea ecx, [ebp - 0x480]
cmp edi, 0x7ffffffe
cmova edi, eax
lea eax, [edi + 1]
push eax
call fcn.00403d40
mov ecx, dword [ebp - 0x6e0]
mov dword [ebp - 0x480], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x6e4]
push eax
call fcn.00495210
mov ecx, dword [ebp - 0x6e0]
add esp, 0xc
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x470], ecx
test ecx, ecx
je 0x4427e2
mov dword [ebp - 0x6d4], 0
lea eax, [ebp - 0x6d4]
push eax
push 0x4d1790
push 1
push 0
push 0x4d1810
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x6d4]
test eax, eax
je 0x4427c4
mov dword [ebp - 0x6dc], 0
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
mov edi, dword [ecx]
lea ecx, [ebp - 0x6dc]
push ecx
push 0x4ce88c
push eax
mov ecx, edi
call dword [0x4c758c]
call edi
mov ecx, dword [ebp - 0x6dc]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x6dc], ecx
mov byte [ebp - 4], 0xc
test ecx, ecx
je 0x4427a6
mov eax, dword [ecx]
cmp dword [ebp - 0x46c], 8
push edx
mov edi, dword [eax + 0x14]
lea eax, [ebp - 0x480]
cmovae eax, dword [ebp - 0x480]
push eax
push ecx
mov ecx, edi
call dword [0x4c758c]
call edi
test eax, eax
js 0x4427a0
mov eax, dword [ebp - 0x6d4]
push 0x21
push 0
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x4c]
mov ecx, edi
call dword [0x4c758c]
call edi
test eax, eax
js 0x4427a0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00495790
mov eax, dword [ebp - 0x6d4]
add esp, 0xc
mov ecx, dword [eax]
push 4
push 0
push 0x104
mov edi, dword [ecx + 0xc]
lea ecx, [ebp - 0x218]
push ecx
push eax
mov ecx, edi
call dword [0x4c758c]
call edi
test eax, eax
js 0x4427a0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x442410
sub ecx, edx
sar ecx, 1
je 0x4427a0
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004988db
lea ecx, [ebp - 0x218]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x442442
sub ecx, edx
sar ecx, 1
cmp ecx, 0x13
jbe 0x4427a0
lea eax, [ecx*2 - 0x26]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x700], eax
add edi, eax
push str._antispam32obk.exe
push edi
call fcn.00498d5f
add esp, 8
test eax, eax
jne 0x4427a0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x450], eax
mov word [edi], ax
lea edx, [ecx + 2]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4424b0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.004038a0
xor eax, eax
mov dword [ebp - 0x468], 0
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x458], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x442506
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x468]
call fcn.004038a0
push 8
push str.OBK.exe
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0xe
call fcn.004052f0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6e0], 0
mov dword [ebp - 0x6d8], 0
mov ecx, dword [eax]
mov edi, dword [ecx + 0x10]
lea ecx, [ebp - 0x6e0]
push ecx
push eax
mov ecx, edi
call dword [0x4c758c]
call edi
mov edi, dword [ebp - 0x6e0]
test edi, edi
je 0x442616
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00495790
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0x104
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListEx]
test eax, eax
je 0x44260a
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4425b5
sub ecx, edx
sar ecx, 1
cmp ecx, 0x13
jbe 0x44260a
mov eax, dword [ebp - 0x700]
lea ecx, [ebp - 0x420]
add eax, ecx
push str._antispam32obk.exe
push eax
call fcn.00498d5f
add esp, 8
test eax, eax
jne 0x44260a
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov dword [ebp - 0x6d8], eax
push dword [ebp - 0x6e0]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 0x6d4]
lea eax, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
cmovae eax, dword [ebp - 0x450]
mov edx, dword [ecx]
push eax
push ecx
mov edi, dword [edx + 0x50]
mov ecx, edi
call dword [0x4c758c]
call edi
test eax, eax
js 0x4426ce
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0x454], 8
mov ecx, dword [eax]
mov edi, dword [ecx + 0x24]
lea ecx, [ebp - 0x468]
cmovae ecx, dword [ebp - 0x468]
push ecx
push eax
mov ecx, edi
call dword [0x4c758c]
call edi
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0x43c], 8
push 0xffffffffffffff9c
mov ecx, dword [eax]
mov edi, dword [ecx + 0x44]
lea ecx, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
push ecx
push eax
mov ecx, edi
call dword [0x4c758c]
call edi
mov edx, dword [ebp - 0x6d8]
test edx, edx
je 0x4426ce
mov eax, dword [ebp - 0x6d4]
push edx
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x14]
mov ecx, edi
call dword [0x4c758c]
call edi
push dword [ebp - 0x6d8]
call dword [sym.imp.SHELL32.dll_ILFree]
mov eax, dword [ebp - 0x6dc]
cmp dword [ebp - 0x46c], 8
push 1
mov ecx, dword [eax]
mov edi, dword [ecx + 0x18]
lea ecx, [ebp - 0x480]
cmovae ecx, dword [ebp - 0x480]
push ecx
push eax
mov ecx, edi
call dword [0x4c758c]
call edi
mov edx, dword [ebp - 0x454]
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x44273f
mov ecx, dword [ebp - 0x468]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442735
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
mov edx, dword [ebp - 0x43c]
xor eax, eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov byte [ebp - 4], 0xc
cmp edx, 8
jb 0x4427a0
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442796
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edx
push ecx
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0x6dc]
mov byte [ebp - 4], 0xf
test ecx, ecx
je 0x4427be
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4c758c]
call edi
mov eax, dword [ebp - 0x6d4]
mov byte [ebp - 4], 0x10
test eax, eax
je 0x4427dc
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x4c758c]
call edi
mov edi, dword [ebp - 0x46c]
mov byte [ebp - 4], 2
cmp edi, 8
jb 0x442820
mov ecx, dword [ebp - 0x480]
lea edi, [edi*2 + 2]
mov eax, ecx
cmp edi, 0x1000
jb 0x442816
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4428f2
push edi
push ecx
call fcn.00450975
add esp, 8
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x442846
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x442842
cmp esi, dword [eax + 8]
jne 0x442842
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x442832
mov esi, eax
jmp 0x44285c
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x44285c
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x442850
cmp esi, dword [ebp - 0x6f4]
jne 0x442240
mov eax, dword [ebp - 0x6f8]
test eax, eax
je 0x442879
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0040dfb0
mov eax, dword [ebp - 0x6ec]
push dword [eax + 4]
lea eax, [ebp - 0x6ec]
push eax
mov ecx, eax
call fcn.00441300
push 0x40
push dword [ebp - 0x6ec]
call fcn.00450975
mov eax, dword [ebp - 0x6f4]
add esp, 8
push dword [eax + 4]
lea eax, [ebp - 0x6f4]
push eax
mov ecx, eax
call fcn.00441300
push 0x40
push dword [ebp - 0x6f4]
call fcn.00450975
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret
call fcn.00401e30
call fcn.004984ff
int3