Function at 0x446373
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x4df2f6
call fcn.004d1d50
sub esp, 0x634
mov eax, dword [0x52e400]
push ebx
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x10], eax
jne 0x44639f
xor al, al
jmp 0x446595
mov eax, dword [ebp + 0xc]
sub eax, ebx
push esi
je 0x4463e9
dec eax
je 0x4463bf
dec eax
je 0x4463b4
xor al, al
jmp 0x446594
lea eax, [ebp - 0x63c]
push eax
push 0x19
jmp 0x4463f1
lea eax, [ebp - 0x63c]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x63c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.MicrosoftInternet_ExplorerQuick_Launch_
jmp 0x446410
lea eax, [ebp - 0x63c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x63c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x4ec814
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x410]
push eax
call esi
push edi
lea eax, [ebp - 0x410]
push eax
call esi
push 0x4f692c
lea eax, [ebp - 0x410]
push eax
call esi
lea eax, [ebp - 0x638]
push eax
push 0x5066c0
push 1
push ebx
push 0x5066f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4463ad
mov eax, dword [ebp - 0x638]
mov ecx, dword [eax]
lea edx, [ebp - 0x640]
push edx
push 0x506750
push eax
call dword [ecx]
cmp eax, ebx
jge 0x44648d
mov eax, dword [ebp - 0x638]
cmp eax, ebx
je 0x4463ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4463ad
lea eax, [ebp - 0x634]
push eax
call fcn.00452b05
pop ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x410]
push edx
push eax
mov dword [ebp - 4], ebx
call dword [ecx + 0x14]
cmp eax, ebx
jl 0x446562
mov eax, dword [ebp - 0x638]
mov ecx, dword [eax]
push 2
push ebx
mov esi, 0x104
push esi
lea edx, [ebp - 0x618]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x446562
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x634]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.MSVCR71.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x446562
mov eax, dword [ebp - 0x638]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x618]
push edx
push eax
call dword [ecx + 0x28]
cmp eax, ebx
jl 0x446562
lea eax, [ebp - 0x618]
push str.quicklaunch
push eax
call dword [sym.imp.MSVCR71.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x446562
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x446562
mov eax, dword [ebp - 0x640]
cmp eax, ebx
je 0x44654e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x638]
cmp eax, ebx
je 0x44655e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov bl, 1
jmp 0x446582
mov eax, dword [ebp - 0x640]
cmp eax, ebx
je 0x446572
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x638]
cmp eax, ebx
je 0x446582
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x634]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d1da7
leave
ret 8