Function at 0x44d900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x303fc
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x44]
push ecx
call fcn.00401350
add esp, 4
lea edx, [ebp - 0x40c]
mov dword [ebp - 0x14], ebx
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x3040c]
push eax
push ecx
call fcn.004c1b70
add esp, 8
lea ecx, [ebp - 0x8c]
push 1
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x8c]
push edx
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 1
call fcn.004f0727
push 0x50de38
push 0xddc094
mov dword [ebp - 0x24], ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44db0f
push 0xddc094
mov byte [ebp - 0x38c], bl
call fcn.00415640
add esp, 4
mov esi, eax
push 0x5147b4
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
cmp edi, ebx
jne 0x44daab
cmp eax, ebx
jne 0x44daab
push esi
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x44]
push 0xddc094
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x51fad0
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
cmp eax, ebx
jne 0x44daa2
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
cmp eax, ebx
lea eax, [ebp - 0x38c]
push eax
push ecx
push edx
jne 0x44da85
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea eax, [ebp - 0x38c]
push eax
jmp 0x44daf2
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x38c]
push eax
jmp 0x44daf2
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x44]
push eax
push 0xddc094
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x51faa8
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
xor esi, esi
mov dword [ebp - 0x18], esi
cmp esi, dword [ebp - 0x14]
jge 0x44deed
lea esi, [esi + esi*2]
shl esi, 7
lea ebx, [ebp + esi - 0x3038c]
push ebx
call fcn.004fa6c0
mov edi, eax
push str.:endp
push edi
mov dword [ebp - 0x20], edi
call fcn.004f2d80
add esp, 0xc
test eax, eax
jne 0x44dedf
push str.NULL
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44dedf
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jl 0x44dedf
push str.svchost.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44db93
lea edx, [ebp + esi - 0x3040c]
push edx
jmp 0x44ded7
push str.winlogon.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dbb1
lea eax, [ebp + esi - 0x3040c]
jmp 0x44ded6
push str.csrss.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dbd0
lea ecx, [ebp + esi - 0x3040c]
push ecx
jmp 0x44ded7
push str.smss.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dbef
lea edx, [ebp + esi - 0x3040c]
push edx
jmp 0x44ded7
push str.services.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dc0d
lea eax, [ebp + esi - 0x3040c]
jmp 0x44ded6
lea esi, [ebp + esi - 0x3040c]
push str.regedit.exe
push esi
mov dword [ebp - 0x1c], esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dc32
push esi
call fcn.004c1db0
add esp, 4
push str.taskmgr.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dc4d
push esi
call fcn.004c1db0
add esp, 4
push str.ntsd__d
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dc77
push str.Your_Image_File_Name_Here_without_a_path
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x44dc77
push esi
jmp 0x44ded7
push str.ntsd__d
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dca2
push str.Your_Image_File_Name_Here_without_a_path
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x44dedf
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x44dcc9
lea ecx, [ebx - 0x180]
push ecx
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44dcc9
cmp dword [ebp - 0x14], 0x14
jle 0x44dcc9
push esi
jmp 0x44ded7
mov edi, dword [ebp - 0x20]
mov byte [ebp - 0x38c], 0
push edi
call fcn.0046b0c0
add esp, 4
mov ebx, eax
push 0x5147b4
push ebx
call fcn.004f2d80
push 0x5144fc
push ebx
mov esi, eax
call fcn.004f2d80
add esp, 0x10
test esi, esi
jne 0x44de69
test eax, eax
jne 0x44de69
push ebx
call fcn.004fa6c0
mov edx, dword [ebp - 0x1c]
add esp, 4
lea ecx, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x14]
push edi
push edx
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x51fa34
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x20
test eax, eax
jne 0x44ddaa
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x38c]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x44dd8d
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44dda4
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov ecx, dword [0xe56d68]
inc ecx
mov dword [0xe56d68], ecx
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push 0x517564
push ebx
call fcn.004f2d80
push 0x51755c
push ebx
mov esi, eax
call fcn.004f2d80
push 0x516f08
push ebx
mov edi, eax
call fcn.004f2d80
push 0x51fa2c
push ebx
mov dword [ebp - 0x20], eax
call fcn.004f2d80
add esp, 0x20
test esi, esi
jne 0x44de24
test edi, edi
jne 0x44de24
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x44de24
test eax, eax
je 0x44de30
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004c1db0
add esp, 4
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
mov dword [ebp - 0x24], 1
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov esi, eax
jmp 0x44db14
push ebx
call fcn.004fa6c0
mov ecx, dword [ebp - 0x14]
add esp, 4
lea edx, [ebp - 0x44]
push eax
push edi
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x51fa04
push ecx
call fcn.004f175f
add esp, 0x1c
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
cmp dword [ebp - 0x14], 5
jle 0x44dedf
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004c1db0
add esp, 4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov esi, eax
jmp 0x44db14
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x44dfb1
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x38c], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x51f9d8
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44df8d
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x38c]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x44df70
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44df87
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x8c]
call fcn.004f076e
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x78]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret