Function at 0x41acf0
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x442d00
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x451254]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x18], eax
xor ebx, ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x9c], 1
call fcn.004143a0
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 4
test al, al
je 0x41ae1c
push 0x10
lea ecx, [esp + 0x20]
call fcn.0042ad7c
add esp, 4
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x5c]
call fcn.004097f0
add esp, 8
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 2
call fcn.004019b0
mov byte [esp + 0x98], 1
cmp dword [esp + 0x6c], 8
jb 0x41adc4
mov eax, dword [esp + 0x58]
push eax
call fcn.0042e0ba
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x447e60
lea esi, [esp + 0x58]
call fcn.00409740
add esp, 4
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 3
call fcn.004019b0
mov esi, 8
cmp dword [esp + 0x6c], esi
jb 0x41ae07
mov edx, dword [esp + 0x58]
push edx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x34], esi
mov eax, dword [esp + 0x20]
jae 0x41ae15
lea eax, [esp + 0x20]
push eax
call ebp
xor ebx, ebx
jmp 0x41ae21
mov esi, 8
cmp dword [esp + 0x34], esi
jb 0x41ae34
mov eax, dword [esp + 0x20]
push eax
call fcn.0042e0ba
add esp, 4
call fcn.00415d60
test al, al
jne 0x41af2f
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
push 0xb
lea ecx, [esp + 0x20]
mov byte [esp + 0x9c], 4
call fcn.004143a0
add esp, 4
test al, al
je 0x41af1c
push 0x10
lea ecx, [esp + 0x20]
call fcn.0042ad7c
add esp, 4
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x5c]
call fcn.004097f0
add esp, 8
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 5
call fcn.004019b0
mov byte [esp + 0x98], 4
cmp dword [esp + 0x6c], esi
jb 0x41aec6
mov eax, dword [esp + 0x58]
push eax
call fcn.0042e0ba
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x447e60
lea esi, [esp + 0x58]
call fcn.00409740
add esp, 4
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 6
call fcn.004019b0
mov esi, 8
cmp dword [esp + 0x6c], esi
jb 0x41af09
mov edx, dword [esp + 0x58]
push edx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x34], esi
mov eax, dword [esp + 0x20]
jae 0x41af17
lea eax, [esp + 0x20]
push eax
call ebp
xor ebx, ebx
cmp dword [esp + 0x34], esi
jb 0x41af2f
mov eax, dword [esp + 0x20]
push eax
call fcn.0042e0ba
add esp, 4
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
push 0x1a
lea ecx, [esp + 0x20]
mov byte [esp + 0x9c], 7
call fcn.004143a0
add esp, 4
test al, al
je 0x41b045
push 0x10
lea ecx, [esp + 0x20]
call fcn.0042ad7c
lea ecx, [esp + 0x20]
add esp, 4
push ecx
mov ebx, str.MicrosoftInternet_ExplorerQuick_Launch_
lea esi, [esp + 0x3c]
call fcn.00409740
add esp, 4
lea edx, [esp + 0xa4]
push edx
push eax
lea edi, [esp + 0x78]
mov byte [esp + 0xa0], 8
call fcn.004097f0
push eax
mov ebx, 0x447e60
lea esi, [esp + 0x60]
mov byte [esp + 0xa4], 9
call fcn.00409740
add esp, 0xc
push 0xffffffffffffffff
xor edi, edi
push edi
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 0xa
call fcn.004019b0
mov esi, 8
cmp dword [esp + 0x6c], esi
jb 0x41afe4
mov eax, dword [esp + 0x58]
push eax
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x88], esi
mov ebx, 7
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], edi
mov word [esp + 0x58], di
jb 0x41b00c
mov ecx, dword [esp + 0x74]
push ecx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x50], esi
mov dword [esp + 0x88], ebx
mov dword [esp + 0x84], edi
mov word [esp + 0x74], di
jb 0x41b032
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x34], esi
mov eax, dword [esp + 0x20]
jae 0x41b040
lea eax, [esp + 0x20]
push eax
call ebp
xor ebx, ebx
mov byte [esp + 0x98], bl
cmp dword [esp + 0x34], esi
jb 0x41b05f
mov eax, dword [esp + 0x20]
push eax
call fcn.0042e0ba
add esp, 4
lea ecx, [esp + 0xa4]
push ecx
mov ebx, 0x447e60
lea esi, [esp + 0x58]
call fcn.00409740
add esp, 4
mov edx, dword [esp + 0x18]
push eax
add edx, 0x70
push edx
lea ecx, [esp + 0x40]
mov byte [esp + 0xa0], 0xb
call fcn.0042ae5f
add esp, 8
mov ebx, 8
mov byte [esp + 0x98], 0xd
cmp dword [esp + 0x6c], ebx
jb 0x41b0b5
mov eax, dword [esp + 0x58]
push eax
call fcn.0042e0ba
add esp, 4
call fcn.00415d60
test al, al
je 0x41b2c4
cmp dword [esp + 0x50], ebx
mov eax, dword [esp + 0x3c]
jae 0x41b0d0
lea eax, [esp + 0x3c]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor esi, esi
push esi
push esi
push esi
push eax
push str.taskbarunpin
push esi
call edi
cmp dword [esp + 0x50], ebx
mov eax, dword [esp + 0x3c]
jae 0x41b0f2
lea eax, [esp + 0x3c]
push esi
push esi
push esi
push eax
push str.startunpin
push esi
call edi
mov ebp, 7
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], esi
mov word [esp + 0x20], si
push 0x1a
lea ecx, [esp + 0x20]
mov byte [esp + 0x9c], 0xe
call fcn.004143a0
add esp, 4
test al, al
jne 0x41b184
cmp dword [esp + 0x50], ebx
mov eax, dword [esp + 0x3c]
jae 0x41b138
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x34], ebx
jb 0x41b152
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x50], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], esi
mov word [esp + 0x20], si
jb 0x41b172
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042e0ba
add esp, 4
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], si
jmp 0x41b2ec
cmp dword [esp + 0x30], esi
je 0x41b12a
push 0x10
lea ecx, [esp + 0x20]
call fcn.0042ad7c
lea ecx, [esp + 0x20]
add esp, 4
push ecx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar2345
lea esi, [esp + 0x58]
call fcn.00409740
add esp, 4
lea edx, [esp + 0x1c]
push edx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu2345
lea esi, [esp + 0x74]
mov byte [esp + 0x9c], 0xf
call fcn.00409740
add esp, 4
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x9c], 0x10
call fcn.0042a0e7
add esp, 4
test al, al
mov ebx, 8
je 0x41b1ff
cmp dword [esp + 0x6c], ebx
mov eax, dword [esp + 0x58]
jae 0x41b1f8
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x70]
push ecx
call fcn.0042a0e7
add esp, 4
test al, al
je 0x41b228
cmp dword [esp + 0x88], ebx
mov eax, dword [esp + 0x74]
jae 0x41b221
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x50], ebx
mov eax, dword [esp + 0x3c]
jae 0x41b236
lea eax, [esp + 0x3c]
xor esi, esi
push esi
push esi
push esi
push eax
push str.taskbarunpin
push esi
call edi
cmp dword [esp + 0x50], ebx
mov eax, dword [esp + 0x3c]
jae 0x41b252
lea eax, [esp + 0x3c]
push esi
push esi
push esi
push eax
push str.startunpin
push esi
call edi
cmp dword [esp + 0x88], ebx
jb 0x41b274
mov edx, dword [esp + 0x74]
push edx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x6c], ebx
mov edi, 7
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], esi
mov word [esp + 0x74], si
jb 0x41b29f
mov eax, dword [esp + 0x58]
push eax
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x34], ebx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], esi
mov word [esp + 0x58], si
jb 0x41b2bf
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0042e0ba
add esp, 4
mov ebx, 8
cmp dword [esp + 0x50], ebx
mov eax, dword [esp + 0x3c]
jae 0x41b2d2
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x50], ebx
jb 0x41b2ec
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0xbc], ebx
jb 0x41b305
mov eax, dword [esp + 0xa8]
push eax
call fcn.0042e0ba
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0042e4b4
add esp, 0x88
ret 0x20