Function at 0x40e730
Capabilities:
Create process on windows
Delete file
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421dcc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov eax, dword [0x42c17c]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x21c], ebp
mov eax, dword [ebp - 0x21c]
push 1
push eax
push str.void___cdecl_DelLink_void_
call fcn.0040ca30
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x40e788
mov esi, 0x426dc8
push edi
push edi
push edi
push edi
push 0x426dc8
push 0x426db4
push esi
lea ecx, [ebp - 0x23c]
call fcn.0040b540
cmp esi, edi
mov dword [ebp - 4], edi
jne 0x40e7ab
push ebp
pop ebp
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x40ec45
lea edx, [ebp - 0x220]
push edx
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jl 0x40e9ea
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00401e30
push 0x423688
push 0x423688
mov byte [ebp - 4], 1
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push str.MicrosoftInternet_ExplorerQuick_Launch
push str.MicrosoftInternet_ExplorerQuick_Launch
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push 0x423688
push 0x423688
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push 0x426d48
push 0x426d48
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push str..lnk
push str..lnk
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
mov ebx, dword [ebp - 0x21c]
push edi
push edi
push edi
push ebx
push str.taskbarunpin
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x20
jae 0x40e8f3
push 0x426d10
call fcn.00406b70
add esp, 4
test eax, eax
jne 0x40e8f3
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_coede
push 0
push 0x426d10
call fcn.0040a9c0
add esp, 8
mov ecx, eax
call fcn.0040d020
mov ecx, eax
call fcn.0040dbd0
mov ecx, eax
call fcn.0040b500
push 0x426d10
call fcn.00406b70
add esp, 4
test eax, eax
jne 0x40e92f
push 1
push edi
push str.del_task_bar_ret
push eax
push 0x426d10
call fcn.0040a9c0
add esp, 8
mov ecx, eax
call fcn.0040d020
mov ecx, eax
call fcn.0040dc60
mov ecx, eax
call fcn.0040b500
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x426d10
mov edi, eax
call fcn.00406b70
add esp, 4
test eax, eax
jne 0x40e973
push 1
push edi
push str.errorCode
push eax
push 0x426d10
call fcn.0040a9c0
add esp, 8
mov ecx, eax
call fcn.0040d020
mov ecx, eax
call fcn.0040dbd0
mov ecx, eax
call fcn.0040b500
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40e9c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x426d10
mov edi, eax
call fcn.00406b70
add esp, 4
test eax, eax
jne 0x40e9c2
push 1
push edi
push str.del_lnk_fals_erro
push eax
push 0x426d10
call fcn.0040a9c0
add esp, 8
mov ecx, eax
call fcn.0040d020
mov ecx, eax
call fcn.0040dbd0
mov ecx, eax
call fcn.0040b500
mov ecx, dword [0x42c058]
lea eax, [ebx - 0xc]
cmp eax, ecx
mov byte [ebp - 4], 0
je 0x40e9ea
add ebx, 0xfffffff4
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40e9ea
push ebx
call fcn.00415965
add esp, 4
lea ecx, [ebp - 0x220]
push ecx
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40eb04
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x218]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401e30
push 0x423688
push 0x423688
mov byte [ebp - 4], 2
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push 0x426d48
push 0x426d48
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push str..lnk
push str..lnk
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
mov edi, dword [ebp - 0x21c]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40eadd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x426d10
mov ebx, eax
call fcn.00406b70
add esp, 4
test eax, eax
jne 0x40eadd
push 1
push ebx
push str.del_lnk_fals_erro
push eax
push 0x426d10
call fcn.0040a9c0
add esp, 8
mov ecx, eax
call fcn.0040d020
mov ecx, eax
call fcn.0040dbd0
mov ecx, eax
call fcn.0040b500
mov eax, dword [0x42c058]
lea ecx, [edi - 0xc]
cmp ecx, eax
mov byte [ebp - 4], 0
je 0x40eb04
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40eb04
push edi
call fcn.00415965
add esp, 4
lea edx, [ebp - 0x220]
push edx
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40ec39
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00401e30
push 0x423688
push 0x423688
mov byte [ebp - 4], 3
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push 0x426cc0
push 0x426cc0
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push 0x423688
push 0x423688
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
push 0x426d48
push 0x426d48
call esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040de80
mov esi, dword [ebp - 0x21c]
push esi
call fcn.0040e3e0
add esp, 4
test eax, eax
jne 0x40ec11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x426d10
mov edi, eax
call fcn.00406b70
add esp, 4
test eax, eax
jne 0x40ec11
push 1
push edi
push str.del_lnk_fals_erro
push eax
push 0x426d10
call fcn.0040a9c0
add esp, 8
mov ecx, eax
call fcn.0040d020
mov ecx, eax
call fcn.0040dbd0
mov ecx, eax
call fcn.0040b500
mov ecx, dword [0x42c058]
lea eax, [esi - 0xc]
cmp eax, ecx
mov byte [ebp - 4], 0
je 0x40ec39
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40ec39
push esi
call fcn.00415965
add esp, 4
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp - 0x21c]
push edx
push 0x42833c
push 1
push 0
push 0x42834c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40ec7e
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push 7
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x21c]
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040d2e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041575b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret