Function at 0x44d795
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487fb3
mov eax, dword fs:[0]
push eax
mov eax, 0x12e8
call fcn.0046a820
mov eax, dword [0x4bfcf0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x12dc], 0
push 0xd
mov edi, ecx
mov ebx, 0x4c22d8
push 1
mov ecx, ebx
call fcn.004568ba
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
je 0x44d808
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x12e0], esp
mov esi, esp
push eax
call fcn.00417b88
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00449c6b
push 0xd
push 2
mov ecx, ebx
call fcn.004568ba
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
je 0x44d83b
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x12e0], esp
mov esi, esp
push eax
call fcn.00417b88
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00449796
push 0xd
push 3
mov ecx, ebx
call fcn.004568ba
mov eax, dword [edi + 0x18]
cmp dword [eax - 0xc], 0
je 0x44d86e
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x12e0], esp
mov esi, esp
push eax
call fcn.00417b88
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00449a82
push 0xd
push 4
mov ecx, ebx
call fcn.004568ba
mov ecx, edi
call fcn.00449370
push 0xd
push 5
mov ecx, ebx
call fcn.004568ba
mov ecx, edi
call fcn.00449002
push 0xd
push 6
mov ecx, ebx
call fcn.004568ba
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x1050], ax
lea eax, [ebp - 0x104e]
push eax
call fcn.00466c70
push dword [edi + 0xc]
lea eax, [ebp - 0x1050]
push eax
call fcn.0046b81a
lea eax, [ebp - 0x1050]
push str.office6cfgsoeminfo
push eax
call fcn.0046b7e9
push 1
lea eax, [ebp - 0x1050]
push 1
push eax
call fcn.00446ff6
add esp, 0x28
test eax, eax
jne 0x44d8fa
mov dword [ebp - 0x12dc], 1
push 0xd
push 7
mov ecx, ebx
call fcn.004568ba
xor eax, eax
push esi
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.00466c70
push dword [edi + 0xc]
lea eax, [ebp - 0x628]
push eax
call fcn.0046b81a
lea eax, [ebp - 0x628]
push 0x493bec
push eax
call fcn.0046b7e9
push 1
lea eax, [ebp - 0x628]
push 1
push eax
call fcn.00446ff6
add esp, 0x28
test eax, eax
jne 0x44d959
inc dword [ebp - 0x12dc]
push 0xd
push 8
mov ecx, ebx
call fcn.004568ba
xor eax, eax
push esi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00466c70
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x420]
push str.ShellNew
push eax
call fcn.0046b7e9
xor eax, eax
push esi
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
call fcn.00466c70
xor eax, eax
push esi
push eax
mov word [ebp - 0xa38], ax
lea eax, [ebp - 0xa36]
push eax
call fcn.00466c70
xor eax, eax
push esi
push eax
mov word [ebp - 0xe48], ax
lea eax, [ebp - 0xe46]
push eax
call fcn.00466c70
xor eax, eax
push esi
push eax
mov word [ebp - 0x1290], ax
lea eax, [ebp - 0x128e]
push eax
call fcn.00466c70
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00466c70
add esp, 0x44
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0046b81a
lea eax, [ebp - 0x830]
push str._newfile.wps
push eax
call fcn.0046b7e9
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.0046b81a
lea eax, [ebp - 0xa38]
push str._newfile.et
push eax
call fcn.0046b7e9
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xe48]
push eax
call fcn.0046b81a
push str._newfile.dps
lea eax, [ebp - 0xe48]
push eax
call fcn.0046b7e9
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x1290]
push eax
call fcn.0046b81a
lea eax, [ebp - 0x1290]
push str._newfile.xlsx
push eax
call fcn.0046b7e9
add esp, 0x40
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0046b81a
lea eax, [ebp - 0x218]
push 0x4974dc
push eax
call fcn.0046b7e9
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44dae8
inc dword [ebp - 0x12dc]
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44daff
inc dword [ebp - 0x12dc]
lea eax, [ebp - 0xe48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44db16
inc dword [ebp - 0x12dc]
lea eax, [ebp - 0x1290]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004471ce
pop ecx
pop ecx
push 0xd
push 9
mov ecx, ebx
call fcn.004568ba
cmp dword [edi + 0x1c], 0
jne 0x44dbc5
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00466c70
add esp, 0xc
lea eax, [ebp - 0x12e0]
push eax
mov ecx, edi
call fcn.0044c964
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call fcn.0046b81a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x12e0]
add ecx, 0xfffffff0
call fcn.00417891
lea eax, [ebp - 0x218]
push str.kingsoftKRM
push eax
call fcn.0046b7e9
push 1
lea eax, [ebp - 0x218]
push 1
push eax
call fcn.00446ff6
add esp, 0x14
test eax, eax
jne 0x44dbc5
inc dword [ebp - 0x12dc]
push 0xd
push 0xa
mov ecx, ebx
call fcn.004568ba
cmp dword [edi + 0x1c], 0
jne 0x44dc4a
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00466c70
add esp, 0xc
lea eax, [ebp - 0x12e0]
push eax
mov ecx, edi
call fcn.0044c964
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call fcn.0046b81a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x12e0]
add ecx, 0xfffffff0
call fcn.00417891
lea eax, [ebp - 0x218]
push str.kingsoftwpslive
push eax
call fcn.0046b7e9
push 1
lea eax, [ebp - 0x218]
push 1
push eax
call fcn.00446ff6
add esp, 0x14
test eax, eax
jne 0x44dc4a
inc dword [ebp - 0x12dc]
push 0xd
push 0xb
mov ecx, ebx
call fcn.004568ba
cmp dword [edi + 0x1c], 0
jne 0x44df7c
xor eax, eax
push esi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00466c70
add esp, 0xc
lea eax, [ebp - 0x12e0]
push eax
mov ecx, edi
call fcn.0044c964
push dword [eax]
lea eax, [ebp - 0x420]
push eax
call fcn.0046b81a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x12e0]
add ecx, 0xfffffff0
call fcn.00417891
lea eax, [ebp - 0x420]
push str.kingsoftoffice6
push eax
call fcn.0046b7e9
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00466c70
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0046b81a
lea eax, [ebp - 0x218]
push 0x49265c
push eax
call fcn.0046b7e9
add esp, 0x24
lea eax, [ebp - 0x12d8]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x12e0], eax
cmp eax, 0xffffffff
je 0x44df7c
test byte [ebp - 0x12d8], 0x10
je 0x44deaf
and dword [ebp - 0x12ec], 0
and dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0x12e4]
push dword [eax + 0x4be894]
lea eax, [ebp - 0x12ac]
push eax
call fcn.00468eeb
pop ecx
pop ecx
test eax, eax
je 0x44dd62
add dword [ebp - 0x12e4], 4
cmp dword [ebp - 0x12e4], 0x10
jb 0x44dd32
jmp 0x44dd6c
mov dword [ebp - 0x12ec], 1
push str.Setup_EnableSavingAdditionalFolders
lea ecx, [ebp - 0x106c]
call fcn.00424491
mov ecx, dword [edi + 0xcc]
and dword [ebp - 4], 0
lea eax, [ebp - 0x106c]
push eax
lea eax, [ebp - 0x1088]
push eax
call fcn.0042ab8e
cmp dword [eax + 0x14], 8
jb 0x44dda1
mov eax, dword [eax]
push str.true
push eax
call fcn.00468eeb
pop ecx
pop ecx
neg eax
sbb al, al
push 0
inc al
push 1
lea ecx, [ebp - 0x1088]
mov byte [ebp - 0x12e5], al
call fcn.0041f501
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x106c]
call fcn.0041f501
cmp byte [ebp - 0x12e5], 0
je 0x44de26
and dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0x12e4]
push dword [eax + 0x4be890]
lea eax, [ebp - 0x12ac]
push eax
call fcn.00468eeb
pop ecx
pop ecx
test eax, eax
je 0x44de1c
add dword [ebp - 0x12e4], 4
cmp dword [ebp - 0x12e4], 4
jb 0x44ddec
jmp 0x44de26
mov dword [ebp - 0x12ec], 1
cmp dword [ebp - 0x12ec], 0
jne 0x44df55
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x12f4]
call fcn.00418067
push 0x48c634
mov dword [ebp - 4], 1
call fcn.00468f76
pop ecx
push eax
push 0x48c634
lea ecx, [ebp - 0x12f4]
call fcn.00417d0b
lea eax, [ebp - 0x12ac]
push eax
call fcn.00468f76
pop ecx
push eax
lea eax, [ebp - 0x12ac]
push eax
lea ecx, [ebp - 0x12f4]
call fcn.00417d0b
push 1
push 1
push dword [ebp - 0x12f4]
call fcn.00446ff6
add esp, 0xc
test eax, eax
jne 0x44dea4
inc dword [ebp - 0x12dc]
mov ecx, dword [ebp - 0x12f4]
jmp 0x44df49
lea eax, [ebp - 0x12ac]
push str.CUSTOM.DIC
push eax
call fcn.00468eeb
pop ecx
pop ecx
test eax, eax
je 0x44df55
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x12f0]
call fcn.00418067
push 0x48c634
mov dword [ebp - 4], 2
call fcn.00468f76
pop ecx
push eax
push 0x48c634
lea ecx, [ebp - 0x12f0]
call fcn.00417d0b
lea eax, [ebp - 0x12ac]
push eax
call fcn.00468f76
pop ecx
push eax
lea eax, [ebp - 0x12ac]
push eax
lea ecx, [ebp - 0x12f0]
call fcn.00417d0b
push 0
push dword [ebp - 0x12f0]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x12f0]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44df43
inc dword [ebp - 0x12dc]
mov ecx, dword [ebp - 0x12f0]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00417891
lea eax, [ebp - 0x12d8]
push eax
push dword [ebp - 0x12e0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44dd17
push dword [ebp - 0x12e0]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xd
push 0xc
mov ecx, ebx
call fcn.004568ba
cmp dword [edi + 0xc4], 0
mov ecx, edi
je 0x44df9c
push dword [edi + 0x1c]
call fcn.0044c8e5
jmp 0x44dfa1
call fcn.0044c202
mov ecx, edi
call fcn.00449412
push 0xd
push 0xd
mov ecx, ebx
call fcn.004568ba
push ecx
xor ebx, ebx
mov eax, esp
mov dword [ebp - 0x12e0], esp
mov ecx, edi
push eax
cmp dword [edi + 0xc4], ebx
je 0x44dfd7
call fcn.0044ab6f
mov ecx, edi
call fcn.0044a16e
jmp 0x44dfe2
call fcn.0044ab6f
call fcn.004546aa
pop ecx
mov ecx, edi
call fcn.0044cb01
call fcn.00429598
test eax, eax
je 0x44e012
push dword [edi + 0x94]
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
mov ecx, edi
call fcn.0044932a
push eax
push 0x67
call fcn.00427022
add esp, 0xc
cmp dword [edi + 0x1c], ebx
jne 0x44e07e
xor eax, eax
push esi
mov word [ebp - 0xc40], ax
lea eax, [ebp - 0xc3e]
push ebx
push eax
call fcn.00466c70
add esp, 0xc
lea eax, [ebp - 0x12ec]
push eax
mov ecx, edi
call fcn.0044c964
push dword [eax]
lea eax, [ebp - 0xc40]
push eax
call fcn.0046b81a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x12ec]
add ecx, 0xfffffff0
call fcn.00417891
lea eax, [ebp - 0xc40]
push str.kingsoft
push eax
call fcn.0046b7e9
lea eax, [ebp - 0xc40]
push ebx
push eax
call fcn.004471ce
add esp, 0x10
xor eax, eax
cmp dword [ebp - 0x12dc], ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00466576
leave
ret