Function at 0x1001a9f0
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1006db91
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x1007d1f8]
xor eax, esp
mov dword [esp + 0xdc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0xf4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x104]
mov eax, dword [esp + 0x108]
mov edx, dword [esp + 0x114]
mov ebp, dword [esp + 0x110]
xor edi, edi
cmp dword [ebx + 0x14], edi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x11c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
je 0x1001aedd
cmp dword [ebp + 0x14], edi
je 0x1001aedd
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], edi
mov byte [esp + 0x68], 0
cmp ecx, edi
mov dword [esp + 0xfc], edi
je 0x1001aaae
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x1001aa96
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x6c]
call fcn.10003ca0
jmp 0x1001aac3
lea edi, [esp + 0x64]
mov esi, ebx
call fcn.100092e0
test al, al
je 0x1001aed4
xor edi, edi
mov eax, 0xf
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edi
mov byte [esp + 0x4c], 0
lea edi, [esp + 0x48]
mov edx, ebp
mov byte [esp + 0xfc], 2
call fcn.10009240
test al, al
jne 0x1001ab61
mov ebp, 0x10
cmp dword [esp + 0x60], ebp
jb 0x1001ab11
mov eax, dword [esp + 0x4c]
push eax
call fcn.10040f62
add esp, 4
xor edi, edi
cmp dword [esp + 0x44], ebp
mov esi, 0xf
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], edi
mov byte [esp + 0x4c], 0
jb 0x1001ab38
mov ecx, dword [esp + 0x30]
push ecx
call fcn.10040f62
add esp, 4
cmp dword [esp + 0x7c], ebp
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
jb 0x1001aedd
mov edx, dword [esp + 0x68]
push edx
call fcn.10040f62
add esp, 4
jmp 0x1001aedd
cmp dword [esp + 0x5c], 0
je 0x1001aec2
lea edi, [esp + 0x2c]
mov esi, ebp
call fcn.100092e0
test al, al
je 0x1001aec2
mov eax, edi
push 0x20
push eax
call fcn.1000c030
mov ecx, edi
push ecx
call fcn.1000e000
add esp, 0xc
test al, al
jne 0x1001ab9d
call fcn.1000ede0
lea edx, [esp + 0x2c]
push edx
call fcn.1000e000
add esp, 4
test al, al
je 0x1001aec2
lea eax, [esp + 0x2c]
push eax
call fcn.1000e2a0
add esp, 4
test al, al
je 0x1001aec2
push 0x5c
push 1
lea ecx, [esp + 0x34]
call fcn.10009db0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x84]
call fcn.100037c0
push 0xffffffffffffffff
xor edi, edi
push edi
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x8c]
mov byte [esp + 0x108], 3
call fcn.10006df0
lea eax, [esp + 0x14]
push eax
push 0x10070208
push 1
push edi
push 0x10070438
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1001aeb6
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x1001aeb6
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0x10070b08
push eax
mov eax, dword [ecx]
call eax
cmp eax, edi
jl 0x1001aeaa
cmp dword [esp + 0x1c], edi
je 0x1001aeaa
mov ebp, 0x10
cmp dword [ebx + 0x18], ebp
lea esi, [ebx + 4]
jb 0x1001ac6b
mov eax, dword [esi]
jmp 0x1001ac6d
mov eax, esi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x50]
push ecx
call eax
cmp dword [esp + 0x7c], ebp
mov ecx, dword [esp + 0x68]
jae 0x1001ac88
lea ecx, [esp + 0x68]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x24]
call eax
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x14], edi
je 0x1001acbf
cmp dword [eax + 0x18], ebp
jb 0x1001acb1
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push eax
push ecx
jmp 0x1001acda
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
add eax, 4
push eax
push ecx
jmp 0x1001acda
mov ecx, dword [esp + 0x118]
cmp ecx, edi
jl 0x1001acdf
cmp dword [ebx + 0x18], ebp
jb 0x1001acd1
mov esi, dword [esi]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push ecx
push esi
push eax
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 0x18], ebp
jb 0x1001aced
mov ecx, dword [ecx + 4]
jmp 0x1001acf0
add ecx, 4
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [esp + 0x28]
cmp dword [ecx + 0x18], ebp
jb 0x1001ad0b
mov ecx, dword [ecx + 4]
jmp 0x1001ad0e
add ecx, 4
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x1c]
call eax
push str..lnk
lea ecx, [esp + 0xa0]
call fcn.10003780
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
mov bl, 4
push ecx
mov byte [esp + 0x108], bl
lea ecx, [esp + 0x8c]
mov byte [esp + 0x24], 0x2e
call fcn.1000cf20
cmp eax, 0xffffffff
push 0xffffffffffffffff
lea ecx, [esp + 0x84]
jne 0x1001ad6d
push edi
lea edx, [esp + 0xa4]
push edx
call fcn.10006df0
jmp 0x1001adc9
push eax
lea eax, [esp + 0xdc]
push eax
call fcn.10006c70
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0xd8]
push edx
mov byte [esp + 0x104], 5
call fcn.1000a4a0
add esp, 8
test eax, eax
je 0x1001adb6
push 0xffffffffffffffff
push edi
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x8c]
call fcn.10006df0
lea ecx, [esp + 0xd4]
mov byte [esp + 0xfc], bl
call fcn.100037f0
cmp byte [esp + 0x120], 0
je 0x1001ae05
lea ecx, [esp + 0x80]
push ecx
call fcn.1000e000
add esp, 4
test al, al
je 0x1001ae05
cmp dword [esp + 0x98], ebp
mov eax, dword [esp + 0x84]
jae 0x1001adfe
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x80]
lea esi, [esp + 0xb8]
xor bl, bl
call fcn.10007df0
mov byte [esp + 0xfc], 6
cmp dword [esp + 0xd0], 8
mov ecx, dword [esp + 0xbc]
jae 0x1001ae3a
lea ecx, [esp + 0xbc]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
push 1
push ecx
push eax
mov eax, dword [edx + 0x18]
call eax
test eax, eax
jl 0x1001ae4f
mov bl, 1
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea esi, [esp + 0xb8]
call fcn.10006d80
lea ecx, [esp + 0x9c]
call fcn.100037f0
lea ecx, [esp + 0x80]
call fcn.100037f0
lea ecx, [esp + 0x48]
call fcn.100037f0
lea ecx, [esp + 0x2c]
call fcn.100037f0
lea ecx, [esp + 0x64]
call fcn.100037f0
mov al, bl
jmp 0x1001aedf
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x80]
call fcn.100037f0
lea ecx, [esp + 0x48]
call fcn.100037f0
lea ecx, [esp + 0x2c]
call fcn.100037f0
lea ecx, [esp + 0x64]
call fcn.100037f0
xor al, al
mov ecx, dword [esp + 0xf4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.10040be4
add esp, 0xec
ret 0x20