Function at 0x42d8b5
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file
Get common file path
Get file attributes
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab4ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x654
lea ecx, [ebp - 0x630]
call fcn.00406d30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00406d30
mov byte [ebp - 4], 1
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42d943
mov dword [ebp - 0x634], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042e570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.0042e570
mov eax, dword [ebp - 0x634]
jmp 0x42dc33
lea ecx, [ebp - 0x218]
push ecx
push str._sMicrosoftInternet_ExplorerQuick_Launch_
push 0x104
lea edx, [ebp - 0x62c]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42d9dc
lea ecx, [ebp - 0x218]
push ecx
push str._sMicrosoftInternet_ExplorerQuick_LaunchLaunch_Internet_Explorer_Browser.lnk
push 0x104
lea edx, [ebp - 0x62c]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42d9dc
mov dword [ebp - 0x638], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042e570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.0042e570
mov eax, dword [ebp - 0x638]
jmp 0x42dc33
push 0
push 0x26
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42da26
mov dword [ebp - 0x63c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042e570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.0042e570
mov eax, dword [ebp - 0x63c]
jmp 0x42dc33
lea edx, [ebp - 0x218]
push edx
push str._sInternet_Exploreriexplore.exe
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x630]
call fcn.00417740
push eax
push 0x4b58f0
push 1
push 0
push 0x4b5910
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jge 0x42daa9
mov dword [ebp - 0x640], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042e570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.0042e570
mov eax, dword [ebp - 0x640]
jmp 0x42dc33
lea ecx, [ebp - 0x10]
call fcn.00417740
push eax
push 0x4b5920
lea ecx, [ebp - 0x630]
call fcn.0041f4d0
mov dword [ebp - 0x64c], eax
mov ecx, dword [ebp - 0x64c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x64c]
push eax
call dword [edx]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jge 0x42db1b
mov dword [ebp - 0x644], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042e570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.0042e570
mov eax, dword [ebp - 0x644]
jmp 0x42dc33
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x630]
call fcn.0041f4d0
mov dword [ebp - 0x650], eax
mov edx, dword [ebp - 0x650]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x650]
push ecx
call dword [eax + 0x50]
push str.__HOMEDRIVE____HOMEPATH__
lea ecx, [ebp - 0x630]
call fcn.0041f4d0
mov dword [ebp - 0x654], eax
mov edx, dword [ebp - 0x654]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x654]
push ecx
call dword [eax + 0x24]
push 0x4db53c
lea ecx, [ebp - 0x630]
call fcn.0041f4d0
mov dword [ebp - 0x658], eax
mov edx, dword [ebp - 0x658]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x658]
push ecx
call dword [eax + 0x1c]
push 0
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x630]
call fcn.0041f4d0
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x65c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x65c]
push edx
call dword [ecx + 0x44]
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea ecx, [ebp - 0x62c]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041f4d0
mov dword [ebp - 0x660], eax
mov edx, dword [ebp - 0x660]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x660]
push ecx
call dword [eax + 0x18]
mov dword [ebp - 0x424], eax
xor edx, edx
cmp dword [ebp - 0x424], 0
setge dl
mov dword [ebp - 0x648], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042e570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.0042e570
mov eax, dword [ebp - 0x648]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret