Function at 0x1001808
Capabilities:
Check if file exists
Create shortcut via ishelllink
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2b18
call fcn.01002720
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
mov dword [ebp - 0x2b00], eax
lea eax, [ebp - 0x44]
push eax
push 0xc9
push dword [0x1004380]
mov dword [ebp - 0x2b0c], edi
mov dword [ebp - 0x2b08], ebx
call esi
test eax, eax
je 0x1001878
test dword [ebp + 0x18], 0x400
jne 0x1001874
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001878
or dword [ebp + 0x18], 8
push 0xa000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2b18], eax
test eax, eax
je 0x1001f70
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x2b10], eax
test eax, eax
je 0x1001f64
xor eax, eax
push 0x20
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x44]
push eax
push 0xca
push dword [0x1004380]
call esi
test eax, eax
je 0x1001905
test dword [ebp + 0x18], 0x100
jne 0x10018e0
push ebx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001905
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x25c]
push eax
push 0
push 0
push 0x1001404
call sub.SHELL32.dll_SHGetFolderPathEx
test eax, eax
jl 0x100190a
and dword [ebp + 0x18], 0xfffffffe
jmp 0x100190a
mov ebx, 0x104
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xcb
push dword [0x1004380]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100194b
test dword [ebp + 0x18], 0x200
jne 0x1001947
push dword [ebp - 0x2b08]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
jne 0x100194b
and dword [ebp + 0x18], 0xfffffffe
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xcc
push dword [0x1004380]
call esi
test eax, eax
je 0x100197e
push dword [ebp - 0x2b08]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
jne 0x100197e
mov eax, dword [ebp + 0x18]
and eax, 0xfffffffe
or eax, 0x20
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x2b04]
push eax
push 0x10013f4
push 1
xor edi, edi
push edi
push 0x1001434
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1001f58
mov eax, dword [ebp - 0x2b04]
mov ecx, dword [eax]
lea edx, [ebp - 0x2b14]
push edx
push 0x1001424
push eax
call dword [ecx]
test eax, eax
jl 0x1001f4c
push dword [ebp - 0x2b00]
mov esi, dword [ebp - 0x2b10]
push 0x5000
push esi
push dword [ebp - 0x2b0c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, 0x4ffe
je 0x1001ef7
mov dword [ebp - 0x2b00], esi
cmp word [ebp - 0x25c], di
jne 0x1001a7f
push dword [ebp - 0x2b08]
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
jne 0x1001a5b
push dword [ebp - 0x2b08]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x1001a5b
push ebx
lea eax, [ebp - 0x25c]
push eax
push edi
push edi
push 0x1001414
call sub.SHELL32.dll_SHGetFolderPathEx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 0x2b08]
lea esi, [ebp + eax*2 - 0x25c]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x1001a74
push dword [ebp - 0x2b08]
lea eax, [ebp - 0x25c]
push ebx
push eax
call fcn.0100178d
lea esi, [ebp - 0x258]
push 0x1ec
push esi
call fcn.01002253
cmp dword [ebp + 0x14], edi
je 0x1001aa9
test byte [ebp + 0x18], 0x20
jne 0x1001aa9
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001aa9
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_IsLFNDriveW]
test eax, eax
je 0x1001abe
or dword [ebp + 0x18], 0x10
mov eax, dword [ebp - 0x2b10]
cmp word [eax], di
je 0x1001ef7
mov esi, dword [sym.imp.SHELL32.dll_Ordinal_58]
mov edi, 0x30c
jmp 0x1001adf
mov ebx, 0x104
xor eax, eax
test byte [ebp + 0x18], 0x10
mov word [ebp - 0x464], ax
jne 0x1001b0a
push ebx
lea eax, [ebp - 0x464]
push eax
push 7
push dword [ebp - 0x2b00]
call esi
cmp word [ebp - 0x464], 0
jne 0x1001b1c
push ebx
lea eax, [ebp - 0x464]
push eax
push 1
push dword [ebp - 0x2b00]
call esi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebp + eax*2 - 0x25c]
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
add ebx, 2
push ebx
call fcn.01002253
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_PathQualify]
push edi
lea eax, [ebp - 0x16ac]
push eax
push 2
push dword [ebp - 0x2b00]
call esi
test eax, eax
je 0x1001e61
cmp word [ebp - 0x16ac], 0
je 0x1001e61
lea eax, [ebp - 0x16ac]
push eax
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.0100178d
lea eax, [ebp - 0x16ac]
push eax
push edi
lea eax, [ebp - 0xa7c]
push eax
call fcn.0100178d
cmp word [ebp - 0xa7c], 0x22
jne 0x1001c38
cmp word [ebp - 0xa7a], 0x3a
jne 0x1001c7b
cmp word [ebp - 0xa78], 0x3a
jne 0x1001c7b
lea eax, [ebp - 0xa7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
push eax
lea eax, [ebp - 0xa7a]
push eax
lea eax, [ebp - 0xa7c]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
call fcn.0100173b
mov ebx, eax
cmp word [ebx], 0
je 0x1001c70
push 0x1001288
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.0100178d
push ebx
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.010017c7
xor eax, eax
mov word [ebx], ax
jmp 0x1001c84
cmp word [ebp - 0xa7c], 0x3a
jne 0x1001c7b
cmp word [ebp - 0xa7a], 0x3a
jne 0x1001c7b
lea eax, [ebp - 0xa7c]
push eax
call fcn.0100173b
mov ebx, eax
cmp word [ebx], 0
je 0x1001c70
push ebx
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.0100178d
jmp 0x1001c31
xor eax, eax
mov word [ebp - 0x1094], ax
jmp 0x1001c84
xor eax, eax
mov word [ebp - 0xa7c], ax
cmp word [ebp - 0x1094], 0
je 0x1001d1c
xor eax, eax
mov word [ebp - 0x20d4], ax
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
cmp word [eax], 0
mov ebx, 0x208
je 0x1001cc7
push eax
xor ecx, ecx
mov word [eax - 2], cx
push ebx
lea eax, [ebp - 0x20d4]
push eax
call fcn.0100178d
mov eax, dword [ebp - 0x2b04]
mov ecx, dword [eax]
lea edx, [ebp - 0x20d4]
push edx
push eax
call dword [ecx + 0x2c]
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push 0
push 0
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.SHELL32.dll_PathResolve]
cmp word [ebp - 0x1094], 0
je 0x1001d21
test byte [ebp + 0x18], 0x20
je 0x1001d2f
lea eax, [ebp - 0x1094]
push eax
push 3
call dword [sym.imp.SHELL32.dll_SHAddToRecentDocs]
jmp 0x1001ed4
mov ebx, 0x208
cmp word [ebp - 0xa7c], 0
je 0x1001ed4
lea eax, [ebp - 0xa7c]
push eax
push edi
lea eax, [ebp - 0x16ac]
push eax
call fcn.0100178d
lea eax, [ebp - 0x1094]
push eax
push edi
lea eax, [ebp - 0x16ac]
push eax
call fcn.010017c7
mov eax, dword [ebp - 0x2b04]
mov ecx, dword [eax]
lea edx, [ebp - 0x16ac]
push edx
push eax
call dword [ecx + 0x50]
push ebx
lea eax, [ebp - 0x24e4]
push eax
push 3
push dword [ebp - 0x2b00]
call esi
push 8
lea eax, [ebp - 0x54]
push eax
push 4
push dword [ebp - 0x2b00]
call esi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, dword [ebp - 0x2b04]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0x24e4]
push eax
push ecx
call dword [edx + 0x44]
push 0x100127c
push 0x104
lea eax, [ebp - 0x25c]
push eax
call fcn.010017c7
test eax, eax
jl 0x1001ed4
push 0x1001250
push ebx
lea eax, [ebp - 0x1cc4]
push eax
call fcn.0100178d
push ebx
lea eax, [ebp - 0x1cc4]
push eax
push 6
push dword [ebp - 0x2b00]
call esi
mov eax, dword [ebp - 0x2b04]
mov ecx, dword [eax]
lea edx, [ebp - 0x1cc4]
push edx
push eax
call dword [ecx + 0x24]
push edi
lea eax, [ebp - 0x2afc]
push eax
push 8
push dword [ebp - 0x2b00]
call esi
mov eax, dword [ebp - 0x2b04]
mov ecx, dword [eax]
lea edx, [ebp - 0x2afc]
push edx
push eax
call dword [ecx + 0x1c]
cmp dword [ebp + 0x14], 0
je 0x1001e5b
lea eax, [ebp - 0x25c]
push eax
push 0x104
lea eax, [ebp - 0x18b4]
push eax
call fcn.0100178d
test eax, eax
jl 0x1001e5b
mov eax, dword [ebp - 0x2b14]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x18b4]
push edx
push eax
call dword [ecx + 0x18]
and dword [ebp + 0x18], 0xfffffffe
jmp 0x1001ec7
cmp dword [ebp + 0x14], 0
je 0x1001ed4
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x104
push 0x100127c
sub ebx, eax
lea ecx, [ebp + eax*2 - 0x25c]
push ebx
push ecx
mov dword [ebp - 0x2b0c], ecx
call fcn.0100178d
test eax, eax
jl 0x1001ea5
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_Win32DeleteFile]
push 0x1001244
push ebx
push dword [ebp - 0x2b0c]
call fcn.0100178d
test eax, eax
jl 0x1001ec7
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_Win32DeleteFile]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ebx, dword [ebp - 0x2b00]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2 + 2]
cmp word [eax], 0
mov dword [ebp - 0x2b00], eax
jne 0x1001ada
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x1001f40
test byte [ebp + 0x18], 1
je 0x1001f40
cmp word [ebp - 0x25c], di
je 0x1001f40
lea eax, [ebp - 0x25c]
push eax
call fcn.010016d6
test eax, eax
je 0x1001f40
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x1001f33
lea eax, [ebp - 0x25c]
push eax
call fcn.010016d6
test eax, eax
je 0x1001f40
lea eax, [ebp - 0x25c]
push eax
call esi
test eax, eax
jne 0x1001f23
mov eax, dword [ebp - 0x2b14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2b04]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x2b10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x2b18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002703
leave
ret 0x14