Function at 0x40cba0
Capabilities:
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cf01
mov eax, dword fs:[0]
push eax
sub esp, 0x83c
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x848], ecx
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x42c]
push ecx
call fcn.00404220
add esp, 8
xor edx, edx
mov word [eax + 2], dx
mov dword [ebp - 0x220], 0
xor eax, eax
mov word [ebp - 0x634], ax
push 0x206
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.004af7d0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004af7d0
add esp, 0xc
push 0x54ad08
lea ecx, [ebp - 0x63c]
call fcn.00404760
mov dword [ebp - 4], 0
push 0x54ad0c
lea ecx, [ebp - 0x638]
call fcn.00404760
mov byte [ebp - 4], 1
push 0x54ad10
lea ecx, [ebp - 0x224]
call fcn.00404760
mov byte [ebp - 4], 2
push 0
push 0x17
lea ecx, [ebp - 0x634]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40d045
push 0x54ad14
lea edx, [ebp - 0x634]
push edx
push 0x54ad20
lea eax, [ebp - 0x21c]
push eax
call fcn.004af679
add esp, 0x10
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0040f7e0
add esp, 4
lea edx, [ebp - 0x21c]
push edx
push 0x54ad30
lea eax, [ebp - 0x63c]
push eax
call fcn.0040d1d0
add esp, 0xc
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x21c]
push ecx
push 0x54ad48
lea edx, [ebp - 0x63c]
push edx
call fcn.0040d1d0
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push 0x54ad60
lea ecx, [ebp - 0x638]
push ecx
call fcn.0040d1d0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x844], dx
push 0x206
push 0
lea eax, [ebp - 0x842]
push eax
call fcn.004af7d0
add esp, 0xc
push 0
push 0x26
lea ecx, [ebp - 0x844]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea edx, [ebp - 0x844]
push edx
call fcn.004af779
add esp, 8
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
push 0x54adb8
push 0x54adbc
push 0x54adc4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
lea eax, [ebp - 0x844]
push eax
push 0x54ade8
push 0x54adfc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
push 0x54ae20
push 0x54ae24
push 0x54ae34
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
push 0x54ae58
push 0x54ae5c
push 0x54ae6c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
push 0x54ae90
push 0x54ae94
push 0x54aea8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
push 0x54aecc
push 0x54aed0
push 0x54aed8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
lea ecx, [ebp - 0x844]
push ecx
push str.IconFile
push 0x54af10
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
push 0x54af34
push 0x54af38
push 0x54af48
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
push 0x54af6c
push 0x54af70
push 0x54af80
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
push 0x54afa4
push 0x54afa8
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x54afe0
lea edx, [ebp - 0x21c]
push edx
push str._s_s.lnk
lea eax, [ebp - 0x63c]
push eax
call fcn.0040d1d0
add esp, 0x10
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54b000
lea ecx, [ebp - 0x42c]
push ecx
push 0x54b014
lea edx, [ebp - 0x638]
push edx
call fcn.0040d1d0
add esp, 0x10
push 0x54b020
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
mov ecx, dword [ebp - 0x848]
call fcn.0040d090
lea eax, [ebp - 0x21c]
push eax
push 0x54b024
lea ecx, [ebp - 0x63c]
push ecx
call fcn.0040d1d0
add esp, 0xc
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54b03c
lea edx, [ebp - 0x42c]
push edx
push 0x54b054
lea eax, [ebp - 0x638]
push eax
call fcn.0040d1d0
add esp, 0x10
push 0x54b060
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
mov ecx, dword [ebp - 0x848]
call fcn.0040d090
push 0x54b064
lea ecx, [ebp - 0x21c]
push ecx
push 0x54b070
lea edx, [ebp - 0x63c]
push edx
call fcn.0040d1d0
add esp, 0x10
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.Uninst.exe
lea eax, [ebp - 0x42c]
push eax
push 0x54b0a0
lea ecx, [ebp - 0x638]
push ecx
call fcn.0040d1d0
add esp, 0x10
push 0x54b0ac
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x638]
call fcn.00404880
push eax
lea ecx, [ebp - 0x63c]
call fcn.00404880
push eax
mov ecx, dword [ebp - 0x848]
call fcn.0040d090
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.004047e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x638]
call fcn.004047e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x63c]
call fcn.004047e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret