Function at 0x1013a9b
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x102a0ec]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0x620], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [ebp - 0x63c], edx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x62c], esi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x624], ecx
mov dword [ebp - 0x628], edx
mov dword [ebp - 0x638], esi
je 0x1013cf8
test ecx, ecx
je 0x1013cf8
test edx, edx
jne 0x1013b13
mov dword [ebp - 0x628], 0x1003c14
push ebx
push edi
push eax
mov edi, 0x207
push edi
lea eax, [ebp - 0x61c]
push eax
call fcn.0100c535
mov ebx, 0x103
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0xd
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x1005ac4
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push dword [ebp - 0x624]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0100d4ff
cmp dword [0x102aec4], 0
mov esi, 0x208
je 0x1013b90
push dword [ebp - 0x624]
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0100d4ff
jmp 0x1013bb7
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0100d4ff
push dword [ebp - 0x624]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0100c535
push 0x1005ab8
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x61c]
push 0x1005aa4
push edi
push eax
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x620]
push eax
push 0x100c454
push 1
xor edi, edi
push edi
push 0x100c464
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x1013ce2
mov eax, dword [ebp - 0x620]
push dword [ebp - 0x634]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov ecx, dword [ebp - 0x63c]
cmp ecx, edi
jne 0x1013c40
lea ecx, [ebp - 0x20c]
mov eax, dword [ebp - 0x620]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x620]
push dword [ebp - 0x628]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp - 0x62c], edi
je 0x1013c7c
push dword [ebp + 0x20]
mov eax, dword [ebp - 0x620]
push dword [ebp - 0x62c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x620]
mov ecx, dword [eax]
lea edx, [ebp - 0x624]
push edx
push 0x100c444
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x1013ce2
mov eax, dword [ebp - 0x624]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x61c]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x624]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x28], edi
je 0x1013cd6
push dword [ebp + 0x28]
lea eax, [ebp - 0x61c]
push dword [ebp - 0x638]
push eax
call fcn.010130b8
lea eax, [ebp - 0x61c]
push eax
call fcn.01012ecc
mov eax, dword [ebp - 0x620]
cmp eax, edi
pop edi
pop ebx
je 0x1013cf4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x1013cfd
mov eax, 0x80004003
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101672d
leave
ret 0x24