Function at 0x444ee0
Capabilities:
Delete file
Enumerate files on windows
Enumerate processes
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x140
lea eax, [ebp - 0x148]
mov dword [ebp - 0x280], 0xffffffff
push 0
or ebx, 0xffffffff
push eax
mov dword [ebp - 0x278], ebx
call fcn.005f46f0
add esp, 0xc
push 1
push 0x400
call fcn.0060b9f0
push 1
push 0x400
mov esi, eax
call fcn.0060b9f0
add esp, 0x10
mov dword [ebp - 0x284], 0
mov edi, eax
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x274], edi
push 0x6f19c0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ecx, eax
mov dword [ebp - 0x28c], ecx
test ecx, ecx
je 0x445494
push str.QueryFullProcessImageName
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x288], eax
test eax, eax
je 0x445488
test esi, esi
je 0x445488
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov dword [ebp - 0x280], eax
cmp eax, ebx
je 0x445488
push 0x124
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], 0x128
push 0
push eax
call fcn.005f46f0
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.DLL_Process32First]
test eax, eax
je 0x445488
lea edi, [ebx + 3]
mov ebx, dword [ebp - 0x288]
lea eax, [ebp - 0x24c]
push str.makecab.exe
push eax
call fcn.00623db6
add esp, 8
test eax, eax
je 0x445069
lea eax, [ebp - 0x24c]
push str.calc.exe
push eax
call fcn.00623db6
add esp, 8
test eax, eax
je 0x445069
lea eax, [ebp - 0x24c]
push str.notepad.exe
push eax
call fcn.00623db6
add esp, 8
test eax, eax
je 0x445069
lea eax, [ebp - 0x24c]
push str.iexplore.exe
push eax
call fcn.00623db6
add esp, 8
test eax, eax
je 0x445069
lea eax, [ebp - 0x24c]
push str.thunder5.exe
push eax
call fcn.00623db6
add esp, 8
test eax, eax
jne 0x4450ae
push 0
push dword [ebp - 0x268]
call dword [0x7170b0]
push 3
mov edx, str.Old_Moon_process_termination
mov ecx, str.Old_Moon
call fcn.0041cb10
add esp, 0xc
cmp dword [0x741728], 1
je 0x4450ae
mov eax, dword [0x71702c]
cmp eax, 2
mov dword [0x741728], 1
cmovg eax, edi
mov dword [0x71702c], eax
lea ecx, [ebp - 0x24c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4450b7
sub ecx, edx
cmp ecx, 9
jne 0x445134
push dword [ebp - 0x268]
push 0
push 0x411
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x44512f
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x400
push eax
push esi
push 0
push edi
call ebx
test eax, eax
je 0x445128
push 0x400
push esi
call fcn.00623ca1
push str.appdatalocal_temp_
push esi
call fcn.00623f6c
add esp, 0x10
test eax, eax
je 0x445128
push 0
push dword [ebp - 0x268]
call dword [0x7170b0]
add esp, 8
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, 2
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
jne 0x444ff1
push esi
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov ebx, dword [ebp - 0x278]
mov edi, dword [ebp - 0x274]
test eax, eax
je 0x445488
push esi
push 0x400
push edi
call fcn.0061ab74
add esp, 0xc
push 0x6f1a80
push 0x400
push esi
call fcn.0061ad41
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0x278], ebx
cmp ebx, 0xffffffff
je 0x445488
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
nop dword [eax]
push dword [ebp - 0x274]
push 0x400
push esi
call fcn.0061ab74
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x400
push esi
call fcn.0061ad41
add esp, 0xc
push esi
call ebx
push 3
mov edx, str.Old_Moon_File
mov ecx, str.Old_Moon
call fcn.0041cb10
add esp, 4
cmp dword [0x741728], 1
je 0x445228
mov eax, dword [0x71702c]
mov ecx, 2
cmp eax, 2
mov dword [0x741728], 1
cmovg eax, ecx
mov dword [0x71702c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x278]
call edi
test eax, eax
jne 0x4451c0
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0x5c
push dword [ebp - 0x274]
call fcn.00623ba9
push 0x5c
push dword [ebp - 0x274]
mov byte [eax], 0
call fcn.00623ba9
push dword [ebp - 0x274]
push 0x400
push esi
mov byte [eax + 1], 0
call fcn.0061ab74
add esp, 0x1c
push 0x6f1a80
push 0x400
push esi
call fcn.0061ad41
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x278], eax
cmp eax, 0xffffffff
je 0x44547c
nop dword [eax]
push dword [ebp - 0x274]
push 0x400
push esi
call fcn.0061ab74
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x400
push esi
call fcn.0061ad41
add esp, 0xc
push esi
call ebx
push 3
mov edx, str.Old_Moon_File
mov ecx, str.Old_Moon
call fcn.0041cb10
add esp, 4
cmp dword [0x741728], 1
je 0x445318
mov eax, dword [0x71702c]
mov ecx, 2
cmp eax, 2
mov dword [0x741728], 1
cmovg eax, ecx
mov dword [0x71702c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x278]
call edi
test eax, eax
jne 0x4452b0
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x278], 0xffffffff
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x445477
push dword [ebp - 0x274]
push dword [ebp - 0x27c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x44547c
push 0x6e9fec
push 0x400
push dword [ebp - 0x274]
call fcn.0061ad41
add esp, 0xc
push dword [ebp - 0x274]
push 0x400
push esi
call fcn.0061ab74
add esp, 0xc
push 0x6f1aa4
push 0x400
push esi
call fcn.0061ad41
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x278], eax
cmp eax, 0xffffffff
je 0x44547c
lea eax, [ebp - 0x11c]
push 0x6ea750
push eax
call fcn.00623f6c
add esp, 8
test eax, eax
je 0x445454
push dword [ebp - 0x274]
push 0x400
push esi
call fcn.0061ab74
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x400
push esi
call fcn.0061ad41
add esp, 0xc
push esi
call ebx
push 3
mov edx, str.Old_Moon_File
mov ecx, str.Old_Moon
call fcn.0041cb10
add esp, 4
cmp dword [0x741728], 1
je 0x445454
mov eax, dword [0x71702c]
mov ecx, 2
cmp eax, 2
mov dword [0x741728], 1
cmovg eax, ecx
mov dword [0x71702c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x278]
call edi
test eax, eax
jne 0x4453d4
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.DLL_FindClose]
or ebx, 0xffffffff
jmp 0x445482
mov ebx, dword [ebp - 0x278]
mov edi, dword [ebp - 0x274]
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x4454af
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov dword [ebp - 0x27c], 0
test ebx, ebx
je 0x4454ba
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
test edi, edi
je 0x4454c7
push edi
call fcn.005fa0fb
add esp, 4
test esi, esi
je 0x4454d4
push esi
call fcn.005fa0fb
add esp, 4
mov eax, dword [ebp - 0x280]
cmp eax, 0xffffffff
je 0x4454e6
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret