Function at 0x4169a0
Capabilities:
Create shortcut via ishelllink
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a72b3
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.CreateShortcutNew_begin
push 0x18d
push str.CreateShortcutNew
mov dword [ebp - 4], 3
call fcn.00426450
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 0x43c], 0
push 0
push eax
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x448], 0
call fcn.00482730
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00482730
add esp, 0x24
lea eax, [ebp - 0x43c]
push eax
push 0x4ac6c0
push 1
push 0
push 0x4ac6d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x416a7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateShortcutNew_1_create_ShellLink_failed:_d.
push 0x19a
push str.CreateShortcutNew
call fcn.00426450
add esp, 0x10
jmp 0x417041
mov eax, dword [ebp - 0x43c]
lea edx, [ebp - 0x440]
push edx
push 0x4ac6f0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x416ab8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateShortcutNew_2_create_PersistFile_failed:_d.
push 0x19f
push str.CreateShortcutNew
call fcn.00426450
add esp, 0x10
jmp 0x417041
mov eax, dword [ebp - 0x43c]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 7
cmova edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
lea eax, [ebp - 0x444]
push eax
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jns 0x416b05
call esi
push eax
push str.CreateShortcutNew_3_open_COMMON_DESKTOPDIRECTORY_failed:_d.
push 0x1a8
push str.CreateShortcutNew
call fcn.00426450
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x444]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x416b3b
call esi
push eax
push str.CreateShortcutNew_4_get_desktopDir_failed:_d.
push 0x1ac
push str.CreateShortcutNew
call fcn.00426450
add esp, 0x10
jmp 0x416c9c
push str.ldremote.exe
lea edx, [ebp + 8]
lea ecx, [ebp - 0x460]
call fcn.00416820
add esp, 4
mov edx, eax
mov byte [ebp - 4], 4
cmp dword [edx + 0x14], 7
jbe 0x416b5f
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x44c]
cmp ecx, 7
jbe 0x416bb0
mov edx, dword [ebp - 0x460]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416ba6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171d2
push ecx
push edx
call fcn.004804a9
add esp, 8
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x460]
call fcn.00423270
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x438]
call fcn.004168e0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 6
cmp dword [edx + 0x14], 7
jbe 0x416be8
mov edx, dword [edx]
mov eax, dword [ebp - 0x440]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x424]
cmp ecx, 7
jbe 0x416c3b
mov edx, dword [ebp - 0x438]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416c31
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171d7
push ecx
push edx
call fcn.004804a9
add esp, 8
xor eax, eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
cmp ecx, 7
jbe 0x416c9c
mov edx, dword [ebp - 0x460]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416c92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171d7
push ecx
push edx
call fcn.004804a9
add esp, 8
lea eax, [ebp - 0x448]
push eax
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x416cd0
call esi
push eax
push str.CreateShortcutNew_5_open_COMMON_PROGRAMS_failed:_d.
push 0x1b7
push str.CreateShortcutNew
call fcn.00426450
add esp, 0x10
jmp 0x417041
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x416d06
call esi
push eax
push str.CreateShortcutNew_6_get_programDir_failed:_d.
push 0x1bc
push str.CreateShortcutNew
call fcn.00426450
add esp, 0x10
jmp 0x417041
push str.ldremote.exe
lea edx, [ebp + 8]
lea ecx, [ebp - 0x460]
call fcn.00416820
add esp, 4
mov edx, eax
mov byte [ebp - 4], 7
cmp dword [edx + 0x14], 7
jbe 0x416d2a
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x44c]
cmp ecx, 7
jbe 0x416d7b
mov edx, dword [ebp - 0x460]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416d71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171dc
push ecx
push edx
call fcn.004804a9
add esp, 8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x478]
call fcn.00423270
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x460]
call fcn.004168e0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 9
cmp dword [edx + 0x14], 7
jbe 0x416db3
mov edx, dword [edx]
mov eax, dword [ebp - 0x440]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x44c]
cmp ecx, 7
jbe 0x416e06
mov edx, dword [ebp - 0x460]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416dfc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171e1
push ecx
push edx
call fcn.004804a9
add esp, 8
xor eax, eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x464]
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 7
mov word [ebp - 0x460], ax
cmp ecx, 7
jbe 0x416e67
mov edx, dword [ebp - 0x478]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416e5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171e1
push ecx
push edx
call fcn.004804a9
add esp, 8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x460]
call fcn.00423270
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xa
push ecx
mov edx, eax
lea ecx, [ebp - 0x438]
call fcn.004168e0
add esp, 4
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x44c]
cmp ecx, 7
jbe 0x416ed5
mov edx, dword [ebp - 0x460]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416ecb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171e6
push ecx
push edx
call fcn.004804a9
add esp, 8
xor eax, eax
mov dword [ebp - 0x450], 0
cmp dword [ebp - 0x424], 7
mov word [ebp - 0x460], ax
lea eax, [ebp - 0x438]
cmova eax, dword [ebp - 0x438]
push eax
push 0
mov dword [ebp - 0x44c], 7
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.ldremoteuninst.exe
lea edx, [ebp + 8]
lea ecx, [ebp - 0x478]
call fcn.00416820
add esp, 4
mov edx, eax
mov byte [ebp - 4], 0xd
cmp dword [edx + 0x14], 7
jbe 0x416f33
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x464]
cmp ecx, 7
jbe 0x416f84
mov edx, dword [ebp - 0x478]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416f7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171eb
push ecx
push edx
call fcn.004804a9
add esp, 8
lea eax, [ebp + 0x50]
push eax
lea edx, [ebp - 0x438]
lea ecx, [ebp - 0x478]
call fcn.004168e0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 0xe
cmp dword [edx + 0x14], 7
jbe 0x416faa
mov edx, dword [edx]
mov eax, dword [ebp - 0x440]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x464]
cmp ecx, 7
jbe 0x416ffd
mov edx, dword [ebp - 0x478]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416ff3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171f0
push ecx
push edx
call fcn.004804a9
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x424]
cmp ecx, 7
jbe 0x417041
mov edx, dword [ebp - 0x438]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417037
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171f5
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp - 0x440]
test ecx, ecx
je 0x417051
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x43c]
test ecx, ecx
je 0x417061
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x444]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
je 0x417074
push eax
call esi
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x417081
push eax
call esi
push str.CreateShortcutNew_end
push 0x1d5
push str.CreateShortcutNew
call fcn.00426450
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
cmp ecx, 7
jbe 0x4170d2
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4170c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171fa
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 7
jbe 0x417120
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417116
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171fa
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp ecx, 7
jbe 0x41716e
mov edx, dword [ebp + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417164
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171fa
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp + 0x64]
xor eax, eax
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 7
mov word [ebp + 0x38], ax
cmp ecx, 7
jbe 0x4171b8
mov edx, dword [ebp + 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4171ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4171fa
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
int3