Function at 0x404250
Capabilities:
Contain obfuscated stackstrings
Delete file
Get common file path

Disassembly:
push edi
mov eax, 0x1f
mov edx, 3
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2d0
mov word [ebp - 0x278], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x27f], 0x74682e6c
mov word [ebp - 0x268], dx
mov dword [ebp - 0x293], 0x70747468
mov dword [ebp - 0x28f], 0x732f2f3a
mov dword [ebp - 0x28b], 0x2f656d6f
mov dword [ebp - 0x287], 0x75676f62
mov dword [ebp - 0x283], 0x72752f73
mov dword [ebp - 0x27c], 0x6c6d74
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x2a0], 9
mov dword [ebp - 0x29c], 1
mov dword [ebp - 0x298], 8
mov dword [ebp - 0x270], str.file:___C:_arbitrary_icon_path
mov dword [ebp - 0x260], 7
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea edx, [ebp - 0x218]
sub esp, 8
cmp word [ebp - 0x218], 0
je 0x404339
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x404330
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.testshortcut.url]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404340
lea eax, [ebp - 0x2bc]
mov dword [esp + 0xc], 0x42245c
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x17
mov dword [esp + 4], 0
mov dword [esp], 0x42246c
call ebx
sub esp, 0x14
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xc1
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.Could_not_create_CLSID_InternetShortcut_instance:__08lx_n
mov dword [esp], eax
call fcn.00403460
test esi, esi
jne 0x404853
mov eax, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x293]
lea edi, [ebp - 0x218]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xca
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_set_a_URL.__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x2ac]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x425bfc
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xce
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_get_the_IPersistFile_for_writing.__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2ac]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xd1
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_save_via_IPersistFile._hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2ac]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x238]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x42592c
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xd6
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
lea esi, [ebp - 0x2a8]
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_get_an_IPropertySetStorage__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x238]
mov edx, dword [eax]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x12
mov dword [esp + 4], 0x42256c
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x10
mov edi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xd9
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
lea edi, [ebp - 0x2a4]
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_get_an_IPropertyStorage_for_writing__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2a8]
lea ecx, [ebp - 0x278]
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [ebp - 0x2c0], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x14
mov edi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xdc
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_set_properties__hr0x_lx_n
call fcn.00403460
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x258], edx
add eax, 4
cmp eax, 0x20
jb 0x4045dd
mov eax, dword [ebp - 0x2a8]
lea edi, [ebp - 0x258]
mov edx, dword [eax]
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x2c0]
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 8], edi
call dword [edx + 0xc]
sub esp, 0x10
mov edi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xe0
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_read_properties__hr0x_lx_n
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xe1
movzx edx, word [ebp - 0x248]
mov dword [esp + 4], 0x41cc16
cmp dx, 3
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xe2
movsx eax, word [ebp - 0x240]
mov dword [esp + 4], str.Read_wrong_icon_index:__d_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebp - 0x240], 7
sete al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
movzx edx, word [ebp - 0x258]
mov dword [eax + 4], 0xe3
cmp dx, 0x1f
mov dword [esp + 8], edx
sete al
mov dword [esp + 4], 0x41cc16
movzx eax, al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xe4
mov eax, dword [ebp - 0x250]
call fcn.00403150
mov edi, dword [sym.imp.kernel32.dll_lstrcmpW]
mov dword [ebp - 0x2c4], eax
mov dword [esp + 4], str.file:___C:_arbitrary_icon_path
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x2c4]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp + 4], str.Wrong_icon_path_read:__s_n
mov dword [esp], eax
call fcn.00403460
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.ole32.dll_PropVariantClear
lea eax, [ebp - 0x248]
sub esp, 4
mov dword [esp], eax
call sub.ole32.dll_PropVariantClear
mov eax, dword [ebp - 0x2a8]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x24]
sub esp, 8
mov dword [ebp - 0x2c4], eax
call fcn.00417b50
mov edx, dword [ebp - 0x2c4]
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xe9
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_commit_properties__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2a8]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x238]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x42256c
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x10
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xef
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.Unable_to_get_an_IPropertyStorage_for_writing__hr0x_lx_n
mov dword [esp], eax
call fcn.00403460
test esi, esi
je 0x404d5f
mov eax, dword [ebp - 0x2bc]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x238]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
lea eax, [ebp - 0x2b8]
mov dword [esp + 0xc], 0x42245c
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x17
mov dword [esp + 4], 0
mov dword [esp], 0x42246c
call ebx
sub esp, 0x14
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x104
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Could_not_create_CLSID_InternetShortcut_instance:__08lx_n
mov dword [esp], eax
call fcn.00403460
test ebx, ebx
jne 0x404d53
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0x2a8], 0
lea esi, [ebp - 0x218]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x425bfc
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x10f
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_get_the_IPersistFile_for_reading.__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2ac]
mov edx, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x14]
sub esp, 0xc
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x112
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Failed_to_load_via_IPersistFile._hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2ac]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x2a8]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 8
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x117
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_get_url_from_file__hr0x_lx_n
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x118
mov ebx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x293]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_lstrcmpA]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], str.Wrong_url_read_from_file:__s_n
mov dword [esp], eax
call fcn.00403460
mov eax, dword [ebp - 0x2a8]
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x2b4]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x42592c
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x11c
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_get_an_IPropertySetStorage__hr0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2b4]
lea ecx, [ebp - 0x2b0]
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x42256c
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x10
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x11f
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_get_an_IPropertyStorage_for_reading__hr0x_lx_n
call fcn.00403460
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x238], edx
add eax, 4
cmp eax, 0x20
jb 0x404acb
mov eax, dword [ebp - 0x2b0]
lea esi, [ebp - 0x2a4]
lea edi, [ebp - 0x238]
mov edx, dword [eax]
mov dword [esp + 0xc], edi
mov dword [ebp - 0x2c0], esi
mov dword [esp + 8], esi
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [edx + 0xc]
mov esi, dword [0x45a330]
sub esp, 0x10
mov ebx, eax
call fcn.00417b50
xor ecx, ecx
test esi, esi
mov esi, dword [sym.imp.kernel32.dll_lstrcmpW]
mov edi, dword [eax + 0x10]
setne cl
mov dword [eax + 0x14], 1
lea edx, [edi + edi]
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x404c6d
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x125
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_read_properties__hr0x_lx_n
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x126
movzx edx, word [ebp - 0x228]
mov dword [esp + 4], 0x41cc16
cmp dx, 3
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x127
movsx eax, word [ebp - 0x220]
mov dword [esp + 4], str.Read_wrong_icon_index:__d_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebp - 0x220], 7
sete al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x128
movzx edx, word [ebp - 0x238]
mov dword [esp + 4], 0x41cc16
cmp dx, 0x1f
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x129
mov eax, dword [ebp - 0x230]
call fcn.00403150
mov dword [esp + 4], str.file:___C:_arbitrary_icon_path
mov edi, eax
mov eax, dword [ebp - 0x230]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
sete al
mov dword [esp + 8], edi
movzx eax, al
mov dword [esp + 4], str.Wrong_icon_path_read:__s_n
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
shr dword [eax + 0x10], 1
call fcn.00417b50
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x404b40
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.ole32.dll_PropVariantClear
lea eax, [ebp - 0x228]
sub esp, 4
mov dword [esp], eax
call sub.ole32.dll_PropVariantClear
mov eax, dword [ebp - 0x2b0]
lea ecx, [ebp - 0x278]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov edi, dword [ebp - 0x2c0]
mov dword [esp + 4], 2
mov dword [esp + 8], edi
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x14
mov ebx, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0x12f
xor eax, eax
cmp ebx, 0x80030005
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.setting_properties_should_return_STG_E_ACCESSDENIED_instead_of_0x_lx_n
call fcn.00403460
mov eax, dword [ebp - 0x2b0]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x2b4]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x2b8]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
lea eax, [ebp - 0x218]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x258], edx
add eax, 4
cmp eax, 0x20
jb 0x404d63
mov eax, dword [ebp - 0x2a8]
lea esi, [ebp - 0x258]
mov edx, dword [eax]
mov dword [esp + 0xc], esi
mov esi, dword [ebp - 0x2c0]
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 8], esi
call dword [edx + 0xc]
sub esp, 0x10
mov esi, eax
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xf5
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unable_to_read_properties__hr0x_lx_n
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xf6
movzx edx, word [ebp - 0x248]
mov dword [esp + 4], 0x41cc16
cmp dx, 3
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xf7
movsx eax, word [ebp - 0x240]
mov dword [esp + 4], str.Read_wrong_icon_index:__d_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebp - 0x240], 7
sete al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
movzx edx, word [ebp - 0x258]
mov dword [eax + 4], 0xf8
cmp dx, 0x1f
mov dword [esp + 8], edx
sete al
mov dword [esp + 4], 0x41cc16
movzx eax, al
mov dword [esp], eax
call fcn.00403460
call fcn.00417b50
mov dword [eax], 0x41c942
mov dword [eax + 4], 0xf9
mov eax, dword [ebp - 0x250]
call fcn.00403150
mov dword [esp + 4], str.file:___C:_arbitrary_icon_path
mov esi, eax
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
sete al
mov dword [esp + 8], esi
movzx eax, al
mov dword [esp + 4], str.Wrong_icon_path_read:__s_n
mov dword [esp], eax
call fcn.00403460
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.ole32.dll_PropVariantClear
lea eax, [ebp - 0x248]
sub esp, 4
mov dword [esp], eax
call sub.ole32.dll_PropVariantClear
mov eax, dword [ebp - 0x2a8]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
jmp 0x404831