Function at 0x402e00
Capabilities:
Create process on windows
Create shortcut via ishelllink
Get common file path

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x42f140]
xor eax, esp
mov dword [esp + 0x2b0], eax
push ebx
mov ebx, dword [esp + 0x2bc]
lea eax, [esp + 4]
push esi
push edi
push eax
push 0
push 0
push 0x426220
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x402e79
mov edx, dword [esp + 0xc]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402e40
sub ecx, esi
sar ecx, 1
lea edi, [ecx + 0x31]
lea eax, [edi + edi]
push eax
push edx
call dword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
jne 0x402e9e
push dword [esp + 0xc]
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [esp + 0xc]
call esi
push str.Couldnt_find_osu_.exe
call fcn.00401170
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00407506
add esp, 0x2b4
ret
push str.MicrosoftWindowsStart_MenuProgramsosu_.lnk
push edi
push eax
mov dword [esp + 0x18], eax
call fcn.0040a700
add esp, 0xc
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x10]
push eax
push 0x426200
push 1
push 0
push 0x426210
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402e6d
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x4261f0
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x402e6d
mov eax, dword [esp + 0x14]
push 0
push dword [esp + 0x10]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
js 0x402e6d
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x6c]
push 6
push edx
push 0x208
mov ecx, dword [eax]
push ebx
push eax
mov eax, dword [ecx + 0xc]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xorps xmm0, xmm0
push 0xfffffffffffffff4
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x50], 0
mov dword [esp + 0x1c], 0x44
call esi
push 0xfffffffffffffff5
mov dword [esp + 0x5c], eax
call esi
push 0xfffffffffffffff6
mov dword [esp + 0x58], eax
call esi
or dword [esp + 0x44], 0x100
xorps xmm0, xmm0
mov dword [esp + 0x50], eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
push 0
movups xmmword [esp + 0x84], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40302c
push str.Launched_osu_._Injecting_in_8_seconds.
call fcn.004010a0
add esp, 4
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.._freedom_injector.exe
call fcn.00402590
mov esi, edx
mov edi, eax
push esi
push edi
push 0x425788
call fcn.00402440
push eax
push str.CMD:__s
call fcn.004010a0
push 0
push 0
push esi
push edi
call fcn.00402310
push eax
call fcn.004035c0
mov ecx, dword [esp + 0x2ec]
add esp, 0x30
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407506
add esp, 0x2b4
ret
push str.Couldnt_launch_osu_
jmp 0x402e7e