Function at 0x44e900
Capabilities:
Check if file exists
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ba3e3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4474
call fcn.0049b530
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x4470], eax
push ebx
push esi
push edi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x4488]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x1f2]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov word [esp + 0x1f8], bx
call fcn.00499a30
add esp, 0xc
push 0x206
lea edx, [esp + 0x3fa]
push ebx
push edx
mov word [esp + 0x400], bx
call fcn.00499a30
add esp, 0xc
push 0xf9e
lea eax, [esp + 0xdd2]
push ebx
push eax
mov word [esp + 0xdd8], bx
call fcn.00499a30
add esp, 0xc
lea ecx, [esp + 0x1d0]
call fcn.00475600
lea ecx, [esp + 0x1d0]
push ecx
push 0x6c
mov dword [esp + 0x4498], ebx
call fcn.00476de0
add esp, 8
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1d8]
mov edi, 7
push edx
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1bc], edi
mov dword [esp + 0x1b8], ebx
mov word [esp + 0x1a8], bx
call fcn.004031a0
cmp dword [esp + 0x1b0], 8
mov ecx, dword [esp + 0x19c]
jae 0x44ea17
lea ecx, [esp + 0x19c]
lea edx, [esp + 0x1ec]
mov edi, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x44ea20
lea eax, [esp + 0x1ec]
lea edx, [eax + 2]
jmp 0x44ea40
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44ea40
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x1ea], 0x5c
jne 0x44ea7b
lea eax, [esp + 0x1ec]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44ea64
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x1ea], bx
lea eax, [esp + 0x1ec]
push eax
push str._sGoogleChromeUser_DataDefault
push 0x208
mov ecx, eax
push 0x104
push ecx
call fcn.00496163
lea eax, [esp + 0x200]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44eaa7
sub eax, edx
sar eax, 1
je 0x44ef46
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x1ec]
push edx
call esi
test eax, eax
je 0x44ef46
lea eax, [esp + 0x1ec]
push eax
push str._sPreferences
push 0x208
lea ecx, [esp + 0x400]
push 0x104
push ecx
call fcn.00496163
add esp, 0x14
lea edx, [esp + 0x3f4]
push edx
call esi
test eax, eax
je 0x44ef46
mov dword [esp + 0x194], edi
mov dword [esp + 0x190], ebx
mov word [esp + 0x180], bx
lea eax, [esp + 0x3f4]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x4498], 2
call fcn.0044f980
mov byte [esp + 0x4490], 3
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx + 4]
mov eax, dword [esp + ecx + 0x24]
lea ecx, [esp + ecx + 0x1c]
and al, 6
neg al
sbb eax, eax
not eax
test ecx, eax
je 0x44f2c6
push 0xa
call fcn.00451140
lea ecx, [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x184]
call fcn.004514c0
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
add esp, 8
neg al
sbb eax, eax
not eax
test ecx, eax
je 0x44ec35
mov esi, 8
nop
cmp dword [esp + 0x194], esi
mov ecx, dword [esp + 0x180]
jae 0x44ebb7
lea ecx, [esp + 0x180]
mov edx, str._homepage_:
call fcn.0044d760
cmp eax, ebx
jge 0x44ec06
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 4]
push 0xa
lea ecx, [esp + ecx + 0x20]
call fcn.00451140
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x17c]
push eax
push edx
call fcn.004514c0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
add esp, 8
neg dl
sbb edx, edx
not edx
test ecx, edx
jne 0x44eba0
jmp 0x44ec35
cmp dword [esp + 0x194], esi
mov ecx, dword [esp + 0x180]
jae 0x44ec1d
lea ecx, [esp + 0x180]
lea edx, [esp + 0xdcc]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x44ec24
lea edi, [esp + 0x1c]
call fcn.0044fab0
lea ecx, [esp + 0x17c]
call fcn.00421b30
mov edx, str.WWW.QQ.COM
lea ecx, [esp + 0xdcc]
call fcn.0044d760
cmp eax, ebx
jl 0x44ec6c
mov eax, dword [esp + 0x18]
mov byte [eax + 0x1c], 1
jmp 0x44ef24
mov ecx, dword [esp + 0x18]
push 0xf9e
lea edx, [esp + 0x34e2]
push ebx
push edx
mov byte [ecx + 0x1c], bl
mov word [esp + 0x34e8], bx
call fcn.00499a30
add esp, 0xc
mov dword [esp + 0x1cc], 7
mov dword [esp + 0x1c8], ebx
mov word [esp + 0x1b8], bx
cmp byte [ebp + 0xc], bl
mov byte [esp + 0x4490], 4
je 0x44ef18
push 0xf9e
lea eax, [esp + 0x2542]
push ebx
push eax
mov word [esp + 0x2548], bx
call fcn.00499a30
add esp, 0xc
push 0x7cf
lea ecx, [esp + 0x1d71]
push ebx
push ecx
mov byte [esp + 0x1d78], bl
call fcn.00499a30
add esp, 0xc
push 0x7cf
lea edx, [esp + 0x601]
push ebx
push edx
mov byte [esp + 0x608], bl
call fcn.00499a30
add esp, 0xc
lea eax, [esp + 0x3f4]
push 0x4d2cdc
push eax
call fcn.0049736b
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x44efb3
push esi
push 0x7d0
lea ecx, [esp + 0x1d74]
push 1
push ecx
call fcn.00497ff3
push esi
call fcn.00497048
lea eax, [esp + 0x1d80]
add esp, 0x14
lea edx, [eax + 1]
jmp 0x44ed60
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x44ed60
push 0x7d0
sub eax, edx
lea edx, [esp + 0x2540]
push edx
push eax
lea eax, [esp + 0x1d78]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x253c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44ed93
sub eax, edx
sar eax, 1
je 0x44eff3
lea eax, [esp + 0x253c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44edb2
sub eax, edx
sar eax, 1
cmp eax, 0x7d0
jae 0x44eff3
lea eax, [esp + 0xdcc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44edd6
sub eax, edx
sar eax, 1
je 0x44eff3
lea ecx, [esp + 0x253c]
push ecx
lea ecx, [esp + 0x1b8]
call fcn.0040cc80
push str.____homepage_:__http:__www.qq.com___
lea ecx, [esp + 0xb4]
call fcn.00405140
lea edx, [esp + 0xdcc]
push edx
lea ecx, [esp + 0x164]
mov byte [esp + 0x4494], 5
call fcn.00405140
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x164]
push ecx
lea edx, [esp + 0x1bc]
push ebx
push edx
mov byte [esp + 0x44a0], 6
call fcn.0047e8a0
add esp, 0x10
lea ecx, [esp + 0x160]
call fcn.00402400
lea ecx, [esp + 0xb0]
call fcn.00402400
cmp dword [esp + 0x1cc], 8
mov eax, dword [esp + 0x1b8]
jae 0x44ee85
lea eax, [esp + 0x1b8]
push eax
push 0x4cc9fc
push 0xfa0
lea eax, [esp + 0x34e8]
push 0x7d0
push eax
call fcn.00496163
add esp, 0x14
push ebx
push ebx
push 0x7d0
lea ecx, [esp + 0x608]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x34f0]
push edx
push 0x200
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x3f4]
push 0x4d2dac
push eax
call fcn.0049736b
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x44efb3
lea eax, [esp + 0x5fc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x44eef3
push esi
sub eax, edx
push eax
lea ecx, [esp + 0x604]
push 1
push ecx
call fcn.00497223
push esi
call fcn.00497048
add esp, 0x14
lea ecx, [esp + 0x1b4]
call fcn.00402400
lea eax, [esp + 0x1c]
mov byte [esp + 0x4490], 2
call fcn.0044e8e0
lea ecx, [esp + 0x17c]
call fcn.00402400
mov edi, 7
cmp dword [esp + 0x1b0], 8
jb 0x44ef60
mov eax, dword [esp + 0x19c]
push eax
call fcn.00495fd1
add esp, 4
mov dword [esp + 0x1b0], edi
mov dword [esp + 0x1ac], ebx
mov word [esp + 0x19c], bx
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x4490], 0xffffffff
call fcn.00475620
mov ecx, dword [esp + 0x4488]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4470]
xor ecx, esp
call fcn.00495cb8
mov esp, ebp
pop ebp
ret 8
push ebx
call fcn.00497048
add esp, 4
lea ecx, [esp + 0x1b4]
call fcn.00402400
lea eax, [esp + 0x1c]
mov byte [esp + 0x4490], 2
call fcn.0044e8e0
lea ecx, [esp + 0x17c]
call fcn.00402400
lea ecx, [esp + 0x198]
call fcn.00402400
jmp 0x44ef76
lea eax, [esp + 0x253c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f000
sub eax, edx
sar eax, 1
je 0x44ef18
lea eax, [esp + 0x253c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f020
sub eax, edx
sar eax, 1
cmp eax, 0x7d0
ja 0x44ef18
lea eax, [esp + 0xdcc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f044
sub eax, edx
sar eax, 1
jne 0x44ef18
mov dword [esp + 0x178], 7
mov dword [esp + 0x174], ebx
mov word [esp + 0x164], bx
lea edx, [esp + 0x3f4]
push edx
lea eax, [esp + 0xd0]
push eax
mov byte [esp + 0x4498], 7
call fcn.0044f980
lea ecx, [esp + 0x160]
mov byte [esp + 0x4490], 8
xor edi, edi
call fcn.00421b30
mov ecx, dword [esp + 0xcc]
mov eax, dword [ecx + 4]
mov edx, dword [esp + eax + 0xd4]
lea eax, [esp + eax + 0xcc]
and dl, 6
neg dl
sbb edx, edx
not edx
test eax, edx
je 0x44f2b8
lea eax, [esp + 0x160]
push eax
lea esi, [esp + 0xd0]
call fcn.00451350
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
add esp, 4
neg dl
sbb edx, edx
not edx
test ecx, edx
je 0x44f1c9
cmp edi, ebx
je 0x44f12f
push str.____homepage_:__http:__www.qq.com___
lea eax, [esp + 0xdd0]
push eax
push str._s_s_r_n
push 0xfa0
mov ecx, eax
push 0x7d0
push ecx
call fcn.00496163
add esp, 0x18
xor edi, edi
mov eax, dword [esp + 0x164]
mov esi, 8
cmp dword [esp + 0x178], esi
jae 0x44f14b
lea eax, [esp + 0x164]
push eax
lea edx, [esp + 0xdd0]
push edx
push str._s_s_r_n
push 0xfa0
mov eax, edx
push 0x7d0
push eax
call fcn.00496163
mov ecx, dword [esp + 0x17c]
add esp, 0x18
cmp dword [esp + 0x178], esi
jae 0x44f185
lea ecx, [esp + 0x164]
mov edx, str._geoid_at_install_
call fcn.0044d760
cmp eax, ebx
jl 0x44f198
mov edi, 1
lea ecx, [esp + 0x160]
push ecx
lea esi, [esp + 0xd0]
call fcn.00451350
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
add esp, 4
neg al
sbb eax, eax
not eax
test ecx, eax
jne 0x44f102
lea edi, [esp + 0xcc]
call fcn.0044fab0
lea eax, [esp + 0xdcc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f1e0
sub eax, edx
sar eax, 1
je 0x44f265
push ebx
push ebx
push 0x7d0
lea ecx, [esp + 0x608]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0xde0]
push edx
push 0x200
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x3f4]
push 0x4d2dac
push eax
call fcn.0049736b
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x44f28a
lea eax, [esp + 0x5fc]
lea edx, [eax + 1]
jmp 0x44f240
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x44f240
push esi
sub eax, edx
push eax
lea ecx, [esp + 0x604]
push 1
push ecx
call fcn.00497223
push esi
call fcn.00497048
add esp, 0x14
lea eax, [esp + 0xcc]
mov byte [esp + 0x4490], 7
call fcn.0044e8e0
lea ecx, [esp + 0x160]
call fcn.00402400
jmp 0x44ef18
push ebx
call fcn.00497048
add esp, 4
lea eax, [esp + 0xcc]
mov byte [esp + 0x4490], 7
call fcn.0044e8e0
lea ecx, [esp + 0x160]
call fcn.00402400
jmp 0x44efbc
lea edi, [esp + 0xcc]
call fcn.0044fab0
jmp 0x44f293
lea edi, [esp + 0x1c]
call fcn.0044fab0
lea ecx, [esp + 0x74]
mov byte [esp + 0x4490], 2
call fcn.0044fa40
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x78], vtable.std::ios_base.0
call fcn.004953b0
add esp, 4
jmp 0x44efd9