Function at 0x44e410
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x260]
cmp dword [eax + 0x68], 0
jl 0x44e46f
mov ecx, dword [ebp - 0x260]
mov edx, dword [ecx + 0x68]
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax + edx*4 + 0x30]
push ecx
call fcn.0043dbf0
add esp, 4
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 1
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00440a30
add esp, 8
mov ecx, dword [ebp - 0x260]
mov edx, dword [ecx + 0x68]
mov ecx, dword [ebp - 0x260]
mov dword [ecx + edx*4 + 0x30], eax
mov edx, dword [ebp - 0x260]
mov eax, dword [edx + 0x68]
mov ecx, dword [ebp - 0x260]
cmp dword [ecx + eax*4 + 0x30], 0
je 0x44e4fa
push 0x81
push 0x4697bc
push 0
mov edx, dword [ebp - 0x260]
mov eax, dword [edx + 0x68]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ecx + eax*4 + 0x30]
push edx
call fcn.00440380
add esp, 0x10
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x260]
mov eax, dword [edx + ecx*4 + 0x30]
push eax
call fcn.0043dbf0
add esp, 4
mov byte [ebp - 0x180], 0
push 0x63
push 0
lea ecx, [ebp - 0x17f]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push str._c:_srvany.exe
lea ecx, [ebp - 0x180]
push ecx
call fcn.0041bfd7
add esp, 0xc
lea edx, [ebp - 0x180]
push edx
push 0x4697dc
push 0x98
mov ecx, dword [ebp - 0x260]
call fcn.0044bab0
mov byte [ebp - 0x1e9], al
movzx eax, byte [ebp - 0x1e9]
test eax, eax
je 0x44e568
mov dword [ebp - 0x264], 0x4697e4
jmp 0x44e572
mov dword [ebp - 0x264], 0x4697ec
mov ecx, dword [ebp - 0x264]
push ecx
push str.ExtractFile11_return__s_n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
push 0x64
push 0
lea edx, [ebp - 0x180]
push edx
call fcn.0041bda0
add esp, 0xc
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
push str._c:_sc.exe
lea edx, [ebp - 0x180]
push edx
call fcn.0041bfd7
add esp, 0xc
lea eax, [ebp - 0x180]
push eax
push 0x46981c
push 0x97
mov ecx, dword [ebp - 0x260]
call fcn.0044bab0
mov byte [ebp - 0x1e9], al
push 0x64
push 0
lea ecx, [ebp - 0x180]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push str._c:winbypass.exe
lea ecx, [ebp - 0x180]
push ecx
call fcn.0041bfd7
add esp, 0xc
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx + 0x60]
test eax, eax
je 0x44e63b
lea ecx, [ebp - 0x180]
push ecx
push 0x469838
push 0xa7
mov ecx, dword [ebp - 0x260]
call fcn.0044bab0
mov byte [ebp - 0x1e9], al
jmp 0x44e65d
lea edx, [ebp - 0x180]
push edx
push 0x469840
push 0xa6
mov ecx, dword [ebp - 0x260]
call fcn.0044bab0
mov byte [ebp - 0x1e9], al
mov byte [ebp - 0x1e8], 0
push 0x63
push 0
lea eax, [ebp - 0x1e7]
push eax
call fcn.0041bda0
add esp, 0xc
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
push edx
push 0x469848
lea eax, [ebp - 0x1e8]
push eax
call fcn.0041bfd7
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push str._c:patch.bat
lea ecx, [ebp - 0x108]
push ecx
call fcn.0041bfd7
add esp, 0xc
push 0x46986c
lea edx, [ebp - 0x108]
push edx
call fcn.0041de9a
add esp, 8
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
push eax
movsx ecx, byte [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x10c]
push edx
push str._PatchSystem__fopen_return__p__err:0x_x__samdrive:_c__sys:_s_n
push 0x47fcf0
call fcn.0043c100
add esp, 0x18
cmp dword [ebp - 0x10c], 0
je 0x44e866
lea eax, [ebp - 0x1e8]
push eax
movsx ecx, byte [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
lea ecx, [ebp - 0x1e8]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.reg_load_HKLMAddUser_SYSTEM__s______s_2_1__n_c:_sc_create_winbypass_Type_own_Start_auto_depend_SamSs_Binpath__c:_srvany.exe_Obj_LocalSystem_displayname_winbypass_group_MS_WindowsLocalValidation_____s_2_1__n
mov eax, dword [ebp - 0x10c]
push eax
call fcn.0041deb1
add esp, 0x1c
mov byte [ebp - 0x258], 0
push 0x63
push 0
lea ecx, [ebp - 0x257]
push ecx
call fcn.0041bda0
add esp, 0xc
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push str._c:clean.log
lea ecx, [ebp - 0x258]
push ecx
call fcn.0041bfd7
add esp, 0xc
push 0x469998
lea edx, [ebp - 0x258]
push edx
call fcn.0041de9a
add esp, 8
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
push eax
call fcn.0041e533
add esp, 4
lea ecx, [ebp - 0x1e8]
push ecx
movsx edx, byte [ebp + 0xc]
push edx
push str.reg_add_HKLMSYSTEMCurrentControlSet_serviceswinbypassParameters__v_Application__t_REG_SZ__d___c:winbypass.exe____f______s_2_1__n
mov eax, dword [ebp - 0x10c]
push eax
call fcn.0041deb1
add esp, 0x10
lea ecx, [ebp - 0x1e8]
push ecx
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x1e8]
push eax
lea ecx, [ebp - 0x1e8]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push str.reg_copy_HKLMSYSTEMCurrentControlSet_serviceswinbypass_HKLMAddUser_SYSTEMControlSet_03d_serviceswinbypass__s__f______s_2_1__nreg_unload_HKLMAddUser_SYSTEM______s_2_1__ndel__s_______s_2_1
mov eax, dword [ebp - 0x10c]
push eax
call fcn.0041deb1
add esp, 0x1c
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.0041e533
add esp, 4
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp - 0x260]
call fcn.0044bbb0
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44e859
lea ecx, [ebp - 0x258]
push ecx
push str._PathFileExists22__s__n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44e822
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x114], 0
je 0x44e890
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00440a30
add esp, 8
mov ecx, dword [ebp - 0x260]
mov edx, dword [ecx + 0x68]
mov ecx, dword [ebp - 0x260]
mov dword [ecx + edx*4 + 0x30], eax
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret 8