Function at 0x4280b0
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Get common file path
Persist via lnk shortcut
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46204a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8b8
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x78], ebx
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x8f0]
mov dword [esp + 0x8d0], 3
test eax, eax
jne 0x428100
mov byte [esp + 0x8d0], 2
jmp 0x428829
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x3b9]
mov byte [esp + 0x3b8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x8dc]
test eax, eax
jne 0x42812b
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x3b8]
push ecx
push eax
call fcn.00405ca0
add esp, 8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x34]
mov byte [esp + 0x34], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2b5]
mov byte [esp + 0x2b4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
mov byte [esp + 0x8d0], 4
push eax
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4281d7
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2b4]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x4281d7
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x8d4], 3
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov byte [esp + 0x8d0], 2
jmp 0x428829
lea edi, [esp + 0x2b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x2b4]
mov cl, byte [esp + ecx + 0x2b3]
cmp cl, 0x5c
je 0x4281fe
mov byte [eax], 0x5c
mov edi, str.Universal_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x2b4]
push ecx
push eax
lea ecx, [esp + 0x38]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
lea ecx, [esp + 0x30]
push str.kplink.exe
lea edx, [esp + 0x5c]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
lea eax, [esp + 0x3c4]
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x78]
push ecx
push edx
mov byte [esp + 0x8e8], 5
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0x18
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x4b9]
mov byte [esp + 0x4b8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0x170]
mov edi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test eax, eax
mov byte [esp + 0x8d0], 6
jne 0x4282bc
mov eax, edi
mov edx, dword [ebx + 0x160]
mov esi, edi
test edx, edx
je 0x4282ca
mov esi, edx
mov edx, dword [ebx + 0x180]
test edx, edx
jne 0x4282d6
mov edx, edi
mov ecx, dword [esp + 0x8ec]
test ecx, ecx
jne 0x4282e3
mov ecx, edi
mov ebp, dword [esp + 0x918]
push eax
push esi
push edx
push ebp
push ecx
lea eax, [esp + 0x4cc]
push str.__KPLINK____s__s__s__s__s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x88]
add esp, 0x1c
test eax, eax
jne 0x428315
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call fcn.00405f70
add esp, 4
test eax, eax
jne 0x428411
lea ecx, [esp + 0x30]
push str.deskIco_
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov eax, dword [esp + 0x24]
mov byte [esp + 0x8d0], 7
test eax, eax
jne 0x428352
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.IMAGEHLP.dll_MakeSureDirectoryPathExists]
mov esi, 9
mov ecx, dword [esp + 0x24]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test ecx, ecx
jne 0x42836e
mov ecx, edx
mov eax, dword [esp + 0x8dc]
test eax, eax
jne 0x42837b
mov eax, edx
push 0
lea edx, [esp + 0x3bc]
push 0
push edx
push ecx
push eax
call fcn.00402f40
add esp, 0x14
cmp eax, 1
je 0x4283a2
cmp eax, 0xfffffff4
je 0x4283a2
mov eax, esi
dec esi
test eax, eax
jne 0x42835e
mov esi, dword [esp + 0x6c]
test esi, esi
jne 0x4283b0
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x3b8]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0xc
test eax, eax
jne 0x4283d6
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
push 1
lea ecx, [esp + 0x48]
sete bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
test bl, bl
mov byte [esp + 0x8d0], 6
push 1
lea ecx, [esp + 0x24]
je 0x42840b
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
jmp 0x42847f
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x42841e
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call fcn.00405f70
add esp, 4
mov ebx, 2
test eax, eax
jne 0x428665
mov esi, 9
mov ecx, dword [esp + 0x34]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test ecx, ecx
jne 0x428449
mov ecx, edx
mov eax, dword [esp + 0x90c]
test eax, eax
jne 0x428456
mov eax, edx
push 0
push 0
push str.kplink.exe
push ecx
push eax
call fcn.00402f40
add esp, 0x14
cmp eax, 1
je 0x4284ac
cmp eax, 0xfffffff4
je 0x42847a
mov ecx, esi
dec esi
test ecx, ecx
jne 0x428439
cmp eax, 1
je 0x4284ac
push 1
lea ecx, [esp + 0x6c]
mov byte [esp + 0x8d4], 5
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x5c]
mov byte [esp + 0x8d4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
jmp 0x4281b6
mov edx, dword [sym.imp.MSVCP60.dll_const_std::basic_ifstream_char__struct_std::char_traits_char__::vbtable]
lea ecx, [esp + 0x108]
mov dword [esp + 0xac], edx
call dword [sym.imp.MSVCP60.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esp + 0x18], 1
push 0
lea eax, [esp + 0xb8]
push 0
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0x8dc], 8
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
push 0
lea ecx, [esp + 0xb8]
mov dword [esp + 0x8d4], 9
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_filebuf_char__struct_std::char_traits_char__::constructor_struct__iobuf__]
mov ecx, dword [esp + 0xac]
mov eax, dword [sym.imp.MSVCP60.dll_const_std::basic_ifstream_char__struct_std::char_traits_char__::vftable]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0xac], eax
mov eax, dword [esp + 0x5c]
mov byte [esp + 0x8d0], 0xa
test eax, eax
jne 0x428534
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 1
push eax
lea ecx, [esp + 0xbc]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_filebuf_char__struct_std::char_traits_char______thiscall_std::basic_filebuf_char__struct_std::char_traits_char__::open_char_const___int_]
test eax, eax
jne 0x428561
mov ecx, dword [esp + 0xac]
push eax
push ebx
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0xb4]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, dword [esp + 0x104]
test eax, eax
je 0x428636
xor eax, eax
lea ecx, [esp + 0x40]
push 4
mov word [esp + 0x45], ax
push ecx
lea ecx, [esp + 0xb4]
mov byte [esp + 0x48], 0
mov byte [esp + 0x4b], al
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___int_]
lea ecx, [esp + 0xb4]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_filebuf_char__struct_std::char_traits_char______thiscall_std::basic_filebuf_char__struct_std::char_traits_char__::close_void_]
test eax, eax
jne 0x4285be
mov edx, dword [esp + 0xac]
push eax
push ebx
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0xb4]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov ecx, 4
lea edi, [esp + 0x40]
lea esi, [esp + 0x18]
xor eax, eax
mov byte [esp + 0x18], 0x4d
mov byte [esp + 0x19], 0x5a
mov byte [esp + 0x1a], 0x90
mov byte [esp + 0x1b], 0
repe cmpsb byte [esi], byte es:[edi]
je 0x4285ea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428636
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x4285fb
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x108]
mov byte [esp + 0x8d0], 6
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [sym.imp.MSVCP60.dll_const_std::basic_ios_char__struct_std::char_traits_char__::vftable]
mov dword [esp + 0x108], ecx
lea ecx, [esp + 0x108]
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
jmp 0x4287e6
lea ecx, [esp + 0x108]
mov byte [esp + 0x8d0], 6
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::destructor_void_]
mov edx, dword [sym.imp.MSVCP60.dll_const_std::basic_ios_char__struct_std::char_traits_char__::vftable]
lea ecx, [esp + 0x108]
mov dword [esp + 0x108], edx
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1b1]
mov byte [esp + 0x1b0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xad]
mov byte [esp + 0xac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4286db
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1b0]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x4286db
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4287e6
lea edi, [esp + 0x1b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x1b0]
mov cl, byte [esp + ecx + 0x1af]
cmp cl, 0x5c
je 0x428702
mov byte [eax], 0x5c
or ecx, 0xffffffff
lea edi, [esp + 0x1b0]
xor eax, eax
lea edx, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1b0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.MicrosoftInternet_ExplorerQuick_Launch_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xac]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x14]
push ecx
push 0x466e80
push 1
push 0
push 0x466e70
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4287e6
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x54]
push ecx
push 0x466e90
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jge 0x428887
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push 1
lea ecx, [esp + 0x6c]
mov byte [esp + 0x8d4], 5
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x5c]
mov byte [esp + 0x8d4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x8d4], 3
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov byte [esp + 0x8d0], bl
push 1
lea ecx, [esp + 0x8dc]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x8ec]
mov byte [esp + 0x8d4], 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x8fc]
mov byte [esp + 0x8d4], 0
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x90c]
mov dword [esp + 0x8d4], 0xffffffff
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
xor al, al
jmp 0x428f74
mov eax, dword [esp + 0x78]
mov edi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov esi, edi
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x42889f
mov esi, ecx
mov eax, dword [esp + 0x78]
mov edx, dword [eax + 0x160]
test edx, edx
jne 0x4288af
mov edx, edi
mov ecx, dword [eax + 0x180]
test ecx, ecx
jne 0x4288bb
mov ecx, edi
mov eax, dword [esp + 0x8ec]
test eax, eax
jne 0x4288c8
mov eax, edi
push esi
push edx
push ecx
push ebp
push eax
lea ecx, [esp + 0x5d0]
push str.__KPLINK____s__s__s__s__s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov dl, byte [esp + 0x2f]
add esp, 0x1c
lea ecx, [esp + 0x7c]
mov byte [esp + 0x7c], dl
push 0
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea edi, [esp + 0x5bc]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x80]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x42894a
mov edi, dword [esp + 0x80]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x5bc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x80]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov cl, byte [esp + 0x58]
xor ebp, ebp
mov byte [esp + 0x8c], cl
push ebp
lea ecx, [esp + 0x90]
mov byte [esp + 0x8d4], 0xb
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [esp + 0x58]
mov eax, dword [edx]
push eax
push ebp
push ecx
lea ecx, [esp + 0x98]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x90]
mov bl, 0xc
cmp ecx, ebp
mov byte [esp + 0x8d0], bl
jne 0x4289a3
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov eax, dword [esp + 0x14]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov ecx, dword [esp + 0x80]
cmp ecx, ebp
jne 0x4289bf
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov eax, dword [esp + 0x14]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x6c]
cmp ecx, ebp
jne 0x4289d8
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov eax, dword [esp + 0x14]
push ebp
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push 0x4714d4
push eax
lea eax, [esp + 0x58]
mov byte [esp + 0x8e4], 0xd
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x428a22
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
push 1
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x8d4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esp + 0x8f8]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push 0x4714d4
lea ecx, [esp + 0x54]
push eax
push ecx
mov byte [esp + 0x8e8], 0xe
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x428a88
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x6c0]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push ebp
push ebp
call edi
push 1
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x8d4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x6c0]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x1b0]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push 0x4714d4
push eax
lea eax, [esp + 0x58]
mov byte [esp + 0x8e4], 0xf
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x428b16
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call esi
push 1
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x8d0], bl
cmp eax, ebp
je 0x428b51
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x428b48
cmp al, 0xff
je 0x428b48
dec al
mov byte [ecx], al
jmp 0x428b51
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x8f8]
lea edx, [esp + 0x1b0]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push 0x4714d4
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x8e8], 0x10
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x428b92
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x6c0]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push ebp
push ebp
call edi
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x428bcb
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x428bc2
cmp al, 0xff
je 0x428bc2
dec al
mov byte [ecx], al
jmp 0x428bcb
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
cmp ecx, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x8d0], bl
je 0x428c01
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x428bf8
cmp al, 0xff
je 0x428bf8
dec al
mov byte [ecx], al
jmp 0x428c01
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x6c0]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x48]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push 0x4714d4
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x8e4], 0x11
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x428c67
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 5
push ebp
push ebp
push eax
push str.TaskbarPin
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x24]
cmp ecx, ebp
je 0x428c9b
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x428c92
cmp al, 0xff
je 0x428c92
dec al
mov byte [ecx], al
jmp 0x428c9b
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
cmp ecx, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x8d0], bl
je 0x428cd1
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x428cc8
cmp al, 0xff
je 0x428cc8
dec al
mov byte [ecx], al
jmp 0x428cd1
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
push str.UninstallinstalledSoftInfo.ini
lea ecx, [esp + 0xa0]
push 0x478c48
push ecx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov eax, dword [eax + 4]
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
cmp eax, ebp
mov byte [esp + 0x8d0], 0x12
je 0x428d02
mov esi, eax
lea edx, [esp + 0x8f8]
push 0x4714d4
lea eax, [esp + 0x48]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0xc
cmp eax, ebp
jne 0x428d28
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
push eax
push str.startMenuName
push str.LinkInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x48]
cmp ecx, ebp
je 0x428d5d
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x428d54
cmp al, 0xff
je 0x428d54
dec al
mov byte [ecx], al
jmp 0x428d5d
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x48], ebp
cmp ecx, ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
je 0x428d8f
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x428d86
cmp al, 0xff
je 0x428d86
dec al
mov byte [ecx], al
jmp 0x428d8f
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x90]
cmp ecx, ebp
je 0x428db6
mov al, byte [ecx - 1]
test al, al
je 0x428dac
cmp al, 0xff
je 0x428dac
dec al
mov byte [ecx - 1], al
jmp 0x428db6
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x90], ebp
cmp ecx, ebp
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebp
je 0x428df2
mov al, byte [ecx - 1]
test al, al
je 0x428de8
cmp al, 0xff
je 0x428de8
dec al
mov byte [ecx - 1], al
jmp 0x428df2
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x80], ebp
cmp ecx, ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x88], ebp
je 0x428e2b
mov al, byte [ecx - 1]
test al, al
je 0x428e21
cmp al, 0xff
je 0x428e21
dec al
mov byte [ecx - 1], al
jmp 0x428e2b
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x6c], ebp
cmp ecx, ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], ebp
je 0x428e5b
mov al, byte [ecx - 1]
test al, al
je 0x428e51
cmp al, 0xff
je 0x428e51
dec al
mov byte [ecx - 1], al
jmp 0x428e5b
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x5c], ebp
cmp ecx, ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
je 0x428e8b
mov al, byte [ecx - 1]
test al, al
je 0x428e81
cmp al, 0xff
je 0x428e81
dec al
mov byte [ecx - 1], al
jmp 0x428e8b
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x8dc]
mov dword [esp + 0x34], ebp
cmp ecx, ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
je 0x428ebe
mov al, byte [ecx - 1]
test al, al
je 0x428eb4
cmp al, 0xff
je 0x428eb4
dec al
mov byte [ecx - 1], al
jmp 0x428ebe
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x8ec]
mov dword [esp + 0x8dc], ebp
cmp ecx, ebp
mov dword [esp + 0x8e0], ebp
mov dword [esp + 0x8e4], ebp
je 0x428efa
mov al, byte [ecx - 1]
test al, al
je 0x428ef0
cmp al, 0xff
je 0x428ef0
dec al
mov byte [ecx - 1], al
jmp 0x428efa
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x8fc]
mov dword [esp + 0x8ec], ebp
cmp ecx, ebp
mov dword [esp + 0x8f0], ebp
mov dword [esp + 0x8f4], ebp
je 0x428f36
mov al, byte [ecx - 1]
test al, al
je 0x428f2c
cmp al, 0xff
je 0x428f2c
dec al
mov byte [ecx - 1], al
jmp 0x428f36
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x90c]
mov dword [esp + 0x8fc], ebp
cmp ecx, ebp
mov dword [esp + 0x900], ebp
mov dword [esp + 0x904], ebp
je 0x428f72
mov al, byte [ecx - 1]
test al, al
je 0x428f68
cmp al, 0xff
je 0x428f68
dec al
mov byte [ecx - 1], al
jmp 0x428f72
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x8c8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c4
ret 0x44