Function at 0x40ccd0
Capabilities:
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546371
mov eax, dword fs:[0]
push eax
sub esp, 0x83c
mov eax, dword [0x5b2390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x848], ecx
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x42c]
push ecx
call fcn.00401d20
add esp, 8
xor edx, edx
mov word [eax + 2], dx
mov dword [ebp - 0x220], 0
xor eax, eax
mov word [ebp - 0x634], ax
push 0x206
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.004b7bc0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004b7bc0
add esp, 0xc
push 0x554d28
lea ecx, [ebp - 0x63c]
call fcn.004048c0
mov dword [ebp - 4], 0
push 0x554d2c
lea ecx, [ebp - 0x638]
call fcn.004048c0
mov byte [ebp - 4], 1
push 0x554d30
lea ecx, [ebp - 0x224]
call fcn.004048c0
mov byte [ebp - 4], 2
push 0
push 0x17
lea ecx, [ebp - 0x634]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40d175
push 0x554d34
lea edx, [ebp - 0x634]
push edx
push 0x554d3c
lea eax, [ebp - 0x21c]
push eax
call fcn.004b7a6c
add esp, 0x10
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0040fa40
add esp, 4
lea edx, [ebp - 0x21c]
push edx
push 0x554d4c
lea eax, [ebp - 0x63c]
push eax
call fcn.0040d300
add esp, 0xc
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x21c]
push ecx
push 0x554d64
lea edx, [ebp - 0x63c]
push edx
call fcn.0040d300
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push 0x554d7c
lea ecx, [ebp - 0x638]
push ecx
call fcn.0040d300
add esp, 0xc
xor edx, edx
mov word [ebp - 0x844], dx
push 0x206
push 0
lea eax, [ebp - 0x842]
push eax
call fcn.004b7bc0
add esp, 0xc
push 0
push 0x26
lea ecx, [ebp - 0x844]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea edx, [ebp - 0x844]
push edx
call fcn.004b7b6c
add esp, 8
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
push 0x554dd8
push 0x554ddc
push 0x554de4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
lea eax, [ebp - 0x844]
push eax
push 0x554e08
push 0x554e1c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
push 0x554e40
push 0x554e44
push 0x554e54
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
push 0x554e78
push 0x554e7c
push 0x554e8c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
push 0x554eb0
push 0x554eb4
push 0x554ec8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
push 0x554eec
push 0x554ef0
push 0x554ef8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
lea ecx, [ebp - 0x844]
push ecx
push str.IconFile
push 0x554f30
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
push 0x554f54
push 0x554f58
push 0x554f68
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
push 0x554f8c
push 0x554f90
push 0x554fa0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
push 0x554fc4
push 0x554fc8
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x555000
lea edx, [ebp - 0x21c]
push edx
push str._s_s.lnk
lea eax, [ebp - 0x63c]
push eax
call fcn.0040d300
add esp, 0x10
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x55501c
lea ecx, [ebp - 0x42c]
push ecx
push 0x55502c
lea edx, [ebp - 0x638]
push edx
call fcn.0040d300
add esp, 0x10
push 0x555038
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
mov ecx, dword [ebp - 0x848]
call fcn.0040d1c0
lea eax, [ebp - 0x21c]
push eax
push 0x55503c
lea ecx, [ebp - 0x63c]
push ecx
call fcn.0040d300
add esp, 0xc
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x555054
lea edx, [ebp - 0x42c]
push edx
push 0x55506c
lea eax, [ebp - 0x638]
push eax
call fcn.0040d300
add esp, 0x10
push 0x555078
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
mov ecx, dword [ebp - 0x848]
call fcn.0040d1c0
push 0x55507c
lea ecx, [ebp - 0x21c]
push ecx
push 0x555084
lea edx, [ebp - 0x63c]
push edx
call fcn.0040d300
add esp, 0x10
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.Uninst.exe
lea eax, [ebp - 0x42c]
push eax
push 0x5550b4
lea ecx, [ebp - 0x638]
push ecx
call fcn.0040d300
add esp, 0x10
push 0x5550c0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x638]
call fcn.004049e0
push eax
lea ecx, [ebp - 0x63c]
call fcn.004049e0
push eax
mov ecx, dword [ebp - 0x848]
call fcn.0040d1c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00404940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x638]
call fcn.00404940
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x63c]
call fcn.00404940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7b5d
mov esp, ebp
pop ebp
ret