Function at 0x44f1c0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57fdf5
push eax
mov dword fs:[0], esp
lea eax, [ebp - 0x248]
sub esp, 0x240
push ebx
push esi
push edi
push eax
push 0
push 0
push edx
push 0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
or edi, 0xffffffff
test esi, esi
js 0x44f30d
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebx]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00430c90
test eax, eax
je 0x44f687
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.ZkhyBTUgkaHCY
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00430f00
test al, al
jne 0x44f261
push 0xe
push str.ZkhyBTUgkaHCY
lea ecx, [ebp - 0x10]
call fcn.00431230
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x10]
push ecx
add ebx, 0xfffffff0
mov esi, esp
mov ecx, ebx
mov dword [ebp - 0x14], esi
call fcn.004305b0
add eax, 0x10
lea ecx, [ebp - 0x20]
mov dword [esi], eax
call fcn.00447160
add esp, 4
push dword [eax]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
mov edx, dword [ebp - 0x20]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f2b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x44f2ea
lock xadd dword [ebx + 0xc], edi
dec edi
test edi, edi
jg 0x44f2d7
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x44f30d
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f687
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push str.U0RwvTSM2cHykmEJwQ
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.00430f00
test al, al
jne 0x44f34e
push 0x13
push str.U0RwvTSM2cHykmEJwQ
lea ecx, [ebp - 0x2c]
call fcn.00431230
mov dword [ebp - 4], 3
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f691
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
push str.OHlj1c0sRwDAFMwGhYH2Zx0GYH10NoBixdYCxEcjSg
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00430f00
test al, al
jne 0x44f393
push 0x2c
push str.OHlj1c0sRwDAFMwGhYH2Zx0GYH10NoBixdYCxEcjSg
lea ecx, [ebp - 0x28]
call fcn.00431230
mov byte [ebp - 4], 5
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f69b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
push str.SjhT0ci97KblcS
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.00430f00
test al, al
jne 0x44f3d5
push 0xe
push str.SjhT0ci97KblcS
lea ecx, [ebp - 0x24]
call fcn.00431230
mov byte [ebp - 4], 8
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f6a5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
push esi
push ecx
add eax, 0xfffffff0
mov esi, esp
mov ecx, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], eax
call fcn.004305b0
add eax, 0x10
lea ecx, [ebp - 0x10]
mov dword [esi], eax
call fcn.00447160
add esp, 4
mov byte [ebp - 4], 0xa
push dword [eax]
lea eax, [ebp - 0x20]
push eax
call fcn.00422bb0
mov byte [ebp - 4], 9
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f44e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f6af
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x597b10
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call fcn.00430f00
test al, al
jne 0x44f48c
push 0
push 0x597b10
lea ecx, [ebp - 0x10]
call fcn.00431230
mov byte [ebp - 4], 0xc
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f6b9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x597b10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call fcn.00430f00
test al, al
jne 0x44f4ce
push 0
push 0x597b10
lea ecx, [ebp - 0x1c]
call fcn.00431230
mov byte [ebp - 4], 0xe
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x44f6c3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x18]
mov esi, dword [ebp - 0x20]
push esi
call fcn.00430f00
test al, al
jne 0x44f529
test esi, esi
jne 0x44f508
xor ecx, ecx
jmp 0x44f51f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44f510
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00431230
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x28]
push ecx
add eax, 0xfffffff0
mov edi, esp
mov ecx, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x3c], eax
call fcn.004305b0
add eax, 0x10
lea ecx, [ebp - 0x34]
mov dword [edi], eax
call fcn.00447160
mov ebx, eax
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov dword [ebp - 0x14], edi
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.004305b0
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [edi], eax
call fcn.00447160
add esp, 4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x12
push ecx
lea ecx, [ebp - 0x1c]
mov edx, ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.0045c260
mov edx, dword [ebp - 0x30]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f5b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f5cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f5e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f600
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f61a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44f631
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x38]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f648
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3c]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f65f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44f674
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
int3