Function at 0x44abf8
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
xor eax, eax
mov edi, ecx
mov esi, eax
mov ebx, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test edi, edi
je 0x44ad0d
mov edx, edi
call fcn.00440b2f
test eax, eax
je 0x44acb7
mov ecx, edi
push 2
lea edx, [ecx + 2]
pop ebx
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x44ac42
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 0xd]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
jne 0x44ac7b
mov eax, 0x8007000e
jmp 0x44ae80
mov edx, edi
mov eax, ebx
call fcn.0042c88c
mov edi, eax
push esi
test edi, edi
jns 0x44ac99
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, edi
jmp 0x44ae80
call fcn.004402ab
push 0x404630
mov eax, ebx
mov edi, esi
call fcn.0042c8f1
mov ebx, eax
test ebx, ebx
jns 0x44ad0d
jmp 0x44ae76
push edi
call fcn.00440bc3
test eax, eax
je 0x44ad0d
mov ecx, edi
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44acc8
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x44ac71
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edx, edi
call fcn.0042c88c
xor edi, edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
test esi, esi
je 0x44ad31
push esi
call fcn.00440bc3
test eax, eax
jne 0x44ad2d
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov esi, edi
test esi, esi
jne 0x44ad9c
push 0x208
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x44ae3d
mov ebx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edi, ebx
call fcn.0044948f
test eax, eax
js 0x44ad97
mov edx, dword [ebx + reloc.ADVAPI32.dll_TraceMessage]
mov edi, 0x104
mov eax, edi
call fcn.0042c88c
test eax, eax
js 0x44ad97
push esi
call fcn.004402ab
mov eax, edi
push 0x404630
mov edi, esi
call fcn.0042c8f1
push esi
push ebx
call fcn.0044ab49
mov ebx, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jmp 0x44ad9c
mov ebx, 0x80004005
test ebx, ebx
js 0x44adaf
push dword [ebp - 0x21c]
mov edi, esi
call fcn.00455553
mov ebx, eax
cmp ebx, 0xc00d1388
jne 0x44adc9
test esi, esi
je 0x44ae21
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
xor edi, edi
pop ecx
mov esi, edi
jmp 0x44ae23
cmp ebx, 0x80040154
jne 0x44ae42
push 0x103
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44ae21
push 0x41fb34
mov eax, 0x104
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8f1
xor edi, edi
push edi
push 1
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.00443700
test eax, eax
js 0x44ae23
push dword [ebp - 0x21c]
mov edi, esi
call fcn.00455553
mov ebx, eax
jmp 0x44ae42
xor edi, edi
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 2
inc eax
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
cmp eax, ecx
jl 0x44ad15
jmp 0x44ae42
mov ebx, 0x8007000e
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x44ae72
test esi, esi
je 0x44ae7e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x44ae6b
xor ecx, ecx
mov word [eax], cx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test esi, esi
je 0x44ae7e
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4