Function at 0x42bf4e
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push 0xcc
mov eax, 0x445cb4
call fcn.004363af
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [ecx + 0x14], ebx
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], edx
je 0x42c2f7
cmp dword [edx + 0x14], ebx
je 0x42c2f7
push 7
pop edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], ebx
mov word [ebp - 0x60], bx
cmp eax, ebx
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x64]
je 0x42bfb9
call fcn.0040124c
jmp 0x42bfcb
mov edi, ecx
call fcn.0040b9e0
test al, al
je 0x42c2ec
push 7
pop edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], bx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], ebx
mov word [ebp - 0x7c], bx
mov edi, dword [ebp - 0xc8]
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.0040b940
test al, al
je 0x42c2d6
cmp dword [ebp - 0x6c], ebx
je 0x42c2d6
lea esi, [ebp - 0x2c]
call fcn.0040b9e0
test al, al
je 0x42c2d6
push 0x20
mov ecx, esi
call fcn.0040cee0
pop ecx
mov eax, esi
push eax
call fcn.0040d4f0
test al, al
pop ecx
jne 0x42c032
mov eax, esi
push eax
call fcn.0040dce0
pop ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.0040d4f0
test al, al
pop ecx
je 0x42c2d6
lea eax, [ebp - 0x2c]
push eax
call fcn.0040d6a0
test al, al
pop ecx
je 0x42c2d6
push 0x5c
lea esi, [ebp - 0x2c]
call fcn.00407d49
mov eax, esi
lea esi, [ebp - 0x48]
call fcn.00403d4c
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.004041e2
lea eax, [ebp - 0xbc]
push eax
push 0x44735c
xor edi, edi
inc edi
push edi
push ebx
push 0x44736c
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc0], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42c2b4
mov eax, dword [ebp - 0xbc]
cmp eax, ebx
je 0x42c2b4
mov ecx, dword [eax]
lea edx, [ebp - 0xc0]
push edx
push 0x44734c
push eax
call dword [ecx]
cmp eax, ebx
jl 0x42c2a8
cmp dword [ebp - 0xc0], ebx
je 0x42c2a8
mov eax, dword [ebp - 0xcc]
push 8
pop esi
cmp dword [eax + 0x18], esi
jb 0x42c0ef
mov eax, dword [eax + 4]
jmp 0x42c0f2
add eax, 4
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
cmp dword [ebp - 0x4c], esi
mov ecx, dword [ebp - 0x60]
jae 0x42c10a
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0xbc]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x24]
mov eax, dword [ebp - 0xd4]
cmp dword [eax + 0x14], ebx
je 0x42c13d
cmp dword [eax + 0x18], esi
jb 0x42c12c
mov eax, dword [eax + 4]
jmp 0x42c12f
add eax, 4
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx]
push ebx
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp - 0xd0]
cmp dword [eax + 0x18], esi
jb 0x42c14d
mov eax, dword [eax + 4]
jmp 0x42c150
add eax, 4
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x18], esi
jb 0x42c16d
mov eax, dword [eax + 4]
jmp 0x42c170
add eax, 4
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov eax, 0x44b3c8
lea ecx, [ebp - 0x9c]
call fcn.00401222
mov byte [ebp - 4], 4
lea edi, [ebp - 0xc4]
lea ebx, [ebp - 0x48]
mov dword [ebp - 0xc4], 0x2e
call fcn.0040d2a0
or edi, 0xffffffff
cmp eax, edi
push edi
jne 0x42c1c5
push 0
lea eax, [ebp - 0x9c]
mov esi, ebx
call fcn.004041e2
xor edi, edi
inc edi
jmp 0x42c20f
lea ecx, [ebp - 0x48]
push ecx
mov ebx, eax
lea esi, [ebp - 0xb8]
call fcn.00407e43
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 5
call fcn.0040bf70
test eax, eax
je 0x42c1fa
push edi
push 0
lea eax, [ebp - 0x9c]
lea esi, [ebp - 0x48]
call fcn.004041e2
xor edi, edi
push 0
inc edi
push edi
lea esi, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.004012ba
lea eax, [ebp - 0x48]
push eax
call fcn.0040d4f0
test al, al
pop ecx
je 0x42c230
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x42c229
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x42c23c
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
push edi
push ecx
push eax
call dword [edx + 0x18]
mov ebx, eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
neg ebx
sbb bl, bl
push eax
inc bl
call dword [ecx + 8]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0
push edi
lea esi, [ebp - 0x9c]
call fcn.004012ba
push 0
push edi
lea esi, [ebp - 0x48]
call fcn.004012ba
push 0
push edi
lea esi, [ebp - 0x80]
call fcn.004012ba
push 0
push edi
lea esi, [ebp - 0x2c]
call fcn.004012ba
push 0
push edi
lea esi, [ebp - 0x64]
call fcn.004012ba
mov al, bl
jmp 0x42c2f9
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.004012ba
push ebx
push edi
lea esi, [ebp - 0x80]
call fcn.004012ba
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.004012ba
push ebx
push edi
jmp 0x42c2ef
push ebx
push 1
lea esi, [ebp - 0x80]
call fcn.004012ba
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.004012ba
push ebx
push 1
lea esi, [ebp - 0x64]
call fcn.004012ba
xor al, al
call fcn.00436432
ret 0x10