Function at 0x4440f8
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov eax, 0x48eb84
call fcn.0045a668
sub esp, 0x2fc
push ebx
push esi
push edi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x10], esp
push 0x104
push eax
call fcn.00443fab
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x204]
lea ecx, [ebp - 0x18]
push eax
call fcn.00444710
lea eax, [ebp - 0x14]
xor ebx, ebx
push 4
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00444a7e
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0044463b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharLowerA]
push str..dll
push dword [ebp - 0x14]
call fcn.00458301
pop ecx
test eax, eax
pop ecx
je 0x444576
push dword [0x4c0ae8]
mov dword [0x4c0afc], ebx
call fcn.00444b26
test eax, eax
pop ecx
jne 0x444199
call fcn.0044616e
mov dword [0x4c0afc], 1
mov esi, 0x400
push esi
push ebx
push 0x4c3564
call fcn.0045a610
push esi
push ebx
push 0x4c2d64
call fcn.0045a610
push esi
push ebx
push 0x4c3164
call fcn.0045a610
push esi
push ebx
push 0x4c2964
call fcn.0045a610
mov edi, dword [ebp + 0xc]
add esp, 0x30
cmp edi, ebx
mov byte [ebp - 4], 2
je 0x4441ef
cmp edi, 1
je 0x4441ef
cmp edi, 2
je 0x4441ef
cmp edi, 3
jne 0x444576
mov dword [0x4c0b48], edi
call fcn.00448ac9
cmp eax, ebx
je 0x4442b9
lea eax, [ebp - 0x100]
push eax
push edi
push ebx
call fcn.004471a0
test eax, eax
je 0x444227
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call fcn.0045a520
pop ecx
pop ecx
jmp 0x44429a
call fcn.00446d04
cmp eax, ebx
je 0x444576
push 0x4c1b6c
lea ecx, [ebp + 0xc]
call fcn.00444710
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0044554d
lea ecx, [ebp + 0xc]
call fcn.00445501
push 0x4bfab8
push dword [ebp + 0xc]
call fcn.00458301
pop ecx
test eax, eax
pop ecx
jne 0x444274
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444571
push dword [ebp + 0xc]
call fcn.00446574
cmp eax, ebx
pop ecx
jne 0x444268
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045a520
pop ecx
mov byte [ebp - 4], 2
pop ecx
lea ecx, [ebp + 0xc]
call fcn.004446e4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004446e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004446e4
push 1
pop eax
jmp 0x4445d9
lea eax, [ebp - 0x90]
push eax
push edi
push ebx
call fcn.004471a0
test eax, eax
je 0x4442d6
lea eax, [ebp - 0x90]
jmp 0x44421a
mov esi, 0x4c0ae4
mov ecx, esi
call fcn.004445ea
lea eax, [ebp - 0x308]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.temp0921.vxd
lea eax, [ebp - 0x308]
push 0x4b0f9c
push eax
push str._s_s_s
push esi
call fcn.004451c2
add esp, 0x14
push ebx
push 0x90
push 2
push ebx
push 3
push 0xc0000000
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x444576
lea eax, [ebp - 0x20]
push ebx
push eax
push 0x1270
push 0x492a54
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], ebx
je 0x444576
push dword [0x4c0ae4]
push 0x4ae4cc
push str._s_s
push 0x4c0af8
call fcn.004451c2
add esp, 0x10
call fcn.00446cff
cmp eax, ebx
je 0x444576
cmp edi, ebx
jne 0x444411
mov esi, 0x4c3564
lea ecx, [ebp + 0xc]
push esi
call fcn.00444710
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.0044554d
lea ecx, [ebp + 0xc]
call fcn.00445501
push 0x4bfab8
push dword [ebp + 0xc]
call fcn.00458301
pop ecx
test eax, eax
pop ecx
jne 0x4443e1
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444571
push dword [ebp + 0xc]
call fcn.00446574
cmp eax, ebx
pop ecx
jne 0x4443c9
push esi
push dword [ebp + 8]
call fcn.0045a520
pop ecx
pop ecx
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444295
push 1
pop esi
cmp edi, esi
jne 0x444495
mov edi, 0x4c2d64
lea ecx, [ebp + 0xc]
push edi
call fcn.00444710
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.0044554d
lea ecx, [ebp + 0xc]
call fcn.00445501
push 0x4bfab8
push dword [ebp + 0xc]
call fcn.00458301
pop ecx
test eax, eax
pop ecx
jne 0x444465
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444571
push dword [ebp + 0xc]
call fcn.00446574
cmp eax, ebx
pop ecx
jne 0x44444d
push edi
push dword [ebp + 8]
call fcn.0045a520
pop ecx
pop ecx
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444599
cmp edi, 2
jne 0x444517
mov edi, 0x4c3164
lea ecx, [ebp + 0xc]
push edi
call fcn.00444710
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.0044554d
lea ecx, [ebp + 0xc]
call fcn.00445501
push 0x4bfab8
push dword [ebp + 0xc]
call fcn.00458301
pop ecx
test eax, eax
pop ecx
jne 0x4444e7
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444571
push dword [ebp + 0xc]
call fcn.00446574
cmp eax, ebx
pop ecx
jne 0x4444cf
push edi
push dword [ebp + 8]
call fcn.0045a520
pop ecx
pop ecx
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
jmp 0x444599
cmp edi, 3
jne 0x444576
mov edi, 0x4c2964
lea ecx, [ebp - 0x1c]
push edi
call fcn.00444710
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0044554d
lea ecx, [ebp - 0x1c]
call fcn.00445501
push 0x4bfab8
push dword [ebp - 0x1c]
call fcn.00458301
pop ecx
test eax, eax
pop ecx
je 0x44455e
push dword [ebp - 0x1c]
call fcn.00446574
cmp eax, ebx
pop ecx
je 0x44457b
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004446e4
mov byte [ebp - 4], bl
jmp 0x4445c3
push edi
push dword [ebp + 8]
call fcn.0045a520
pop ecx
pop ecx
push dword [0x4c0ae4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004446e4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004446e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004446e4
mov eax, esi
jmp 0x4445d9
lea ecx, [ebp - 0x14]
call fcn.004446e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004446e4
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8