Function at 0x401c10
Capabilities:
Create shortcut via ishelllink
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x314
push ebx
mov ebx, dword [esp + 0x31c]
push esi
push edi
test ebx, ebx
je 0x401df1
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
push 1
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0
call esi
cmp eax, 1
je 0x401c62
push 1
lea ecx, [esp + 0x18]
push 0x19
push ecx
push 0
call esi
cmp eax, 1
jne 0x401df1
or ecx, 0xffffffff
mov edi, 0x4171ac
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x18]
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41ae80
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..lnk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x10]
push edx
push 0x413c28
push 7
push 0
push 0x413c38
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
pop ebp
jl 0x401deb
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x413c48
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
mov eax, dword [esp + 0xc]
jge 0x401d61
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
add esp, 0x314
ret 4
mov edx, dword [eax]
push ebx
push eax
call dword [edx + 0x50]
test eax, eax
jl 0x401dd7
mov eax, dword [esp + 0xc]
push 0x41ae80
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jge 0x401da5
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
add esp, 0x314
ret 4
lea edx, [esp + 0x118]
push 0x104
push edx
lea eax, [esp + 0x1c]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x118]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
add esp, 0x314
ret 4