Function at 0x404020
Capabilities:
Create directory
Create shortcut via ishelllink
Get common file path

Disassembly:
sub esp, 0x3b4
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x128]
mov dword [esp + 0x1c], esi
push eax
mov dword [esp + 0x12c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x138], 2
jne 0x40406a
mov dword [esp + 0x1c], 1
mov al, byte [esp + 0x3c8]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test al, al
je 0x4041cd
lea ecx, [esp + 0x10]
push ecx
push 0x40a190
push 1
push esi
push 0x40a180
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4041cd
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push 0x40a1a0
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x4041cd
mov edi, dword [esp + 0x3cc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SeeLog.exe
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
call ebp
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x404154
lea edx, [esp + 0x14]
push edx
push 0x19
push 0
call ebx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [esp + 0x24]
push 0x40c3cc
push edx
call ebp
lea eax, [esp + 0x24]
push str.SeeLog.lnk
push eax
call ebp
lea ecx, [esp + 0x1bc]
push 0x104
push ecx
lea edx, [esp + 0x2c]
push 0xffffffffffffffff
push edx
jmp 0x40419b
lea eax, [esp + 0x14]
push eax
push 0
push 0
call ebx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [esp + 0x24]
push 0x40c3cc
push eax
call ebp
lea ecx, [esp + 0x24]
push str.SeeLog.lnk
push ecx
call ebp
lea edx, [esp + 0x1bc]
push 0x104
push edx
lea eax, [esp + 0x2c]
push 0xffffffffffffffff
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1bc]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esp + 0x10]
push eax
push 0x40a190
push 1
push 0
push 0x40a180
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40430a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x40a1a0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x40430a
mov edi, dword [esp + 0x3cc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SeeLog.exe
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
call ebp
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x404284
lea edx, [esp + 0x14]
push edx
push 0x17
push 0
call ebx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [esp + 0x24]
push str.Precision
push edx
call ebp
lea eax, [esp + 0x24]
push 0
push eax
jmp 0x4042b2
lea ecx, [esp + 0x14]
push ecx
push 2
push 0
call ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x24]
push str.Precision
push ecx
call ebp
lea edx, [esp + 0x24]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x24]
push 0x40c27c
push eax
call ebp
lea ecx, [esp + 0x1bc]
push 0x104
push ecx
lea edx, [esp + 0x2c]
push 0xffffffffffffffff
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1bc]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esp + 0x20]
push eax
push 1
push 0
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x404350
push 0x40
push str.Windows_HTML_Help_not_found.
push str.To_use_help:_Obtain_and_Run_hhupd.exe_to_upgrade_Windows_nHelp_is_not_required_to_view_print_logs.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x40cf40
push 0x104
push str..dll
push str.wmvcore
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
xor eax, eax
add esp, 0x3b4
ret