Function at 0x406e80
Capabilities:
Copy file
Create directory
Create shortcut via ishelllink
Get common file path

Disassembly:
sub esp, 0x428
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [esp + 0x43c]
mov ecx, dword [esp + 0x440]
push ebx
push ebp
mov ebp, dword [esp + 0x43c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x434]
push esi
xor ebx, ebx
add eax, 0xffffffff
cmp eax, 3
push edi
mov edi, dword [esp + 0x440]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebx
ja case.default.0x406ed5
jmp dword [eax*4 + 0x4071dc]
mov esi, 0xb
jmp 0x406ef3
mov esi, 2
jmp 0x406ef3
xor esi, esi
jmp 0x406ef3
mov esi, 0x17
call fcn.004065c0
cmp edi, ebx
je 0x406f00
cmp ebp, ebx
jne 0x406f53
call fcn.00401610
call fcn.00401580
push str.linkName___0__fileTarget___0
push 0xac
push str.CreateLink
push 0x41ffe8
push 0x41d410
call fcn.004014d0
push 0x41d3fc
call fcn.004014d0
call fcn.00401630
push 0xac
push str.CreateLink
push 0x41ffe8
push str.linkName___0__fileTarget___0
call fcn.004019f0
add esp, 0x28
cmp byte [edi], bl
je 0x406f5c
cmp byte [ebp], bl
jne 0x406faf
call fcn.00401610
call fcn.00401580
push str.linkName_0____0__fileTarget_0____0
push 0xad
push str.CreateLink
push 0x41ffe8
push 0x41d410
call fcn.004014d0
push 0x41d3fc
call fcn.004014d0
call fcn.00401630
push 0xad
push str.CreateLink
push 0x41ffe8
push str.linkName_0____0__fileTarget_0____0
call fcn.004019f0
add esp, 0x28
lea edx, [esp + 0x14]
push edx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x103
lea eax, [esp + 0x29]
push ebx
push eax
mov byte [esp + 0x30], bl
call fcn.0040a110
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4071c0
push 0x103
lea eax, [esp + 0x12d]
push ebx
push eax
mov byte [esp + 0x134], bl
call fcn.0040a110
add esp, 0xc
cmp esi, 2
je 0x407012
cmp esi, 0x17
jne 0x407035
push 0x420134
lea ecx, [esp + 0x28]
push 0x104
push ecx
call fcn.004066a0
add esp, 0xc
push ebx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
lea eax, [esp + 0x28]
push eax
push str._s_s
lea ecx, [esp + 0x134]
push 0x104
push ecx
call fcn.0040a7fb
add esp, 0x14
cmp byte [esp + 0x448], bl
je 0x407073
push ebx
lea edx, [esp + 0x12c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40714e
lea eax, [esp + 0x10]
push eax
push 0x42056c
push 1
push ebx
push 0x42057c
mov dword [esp + 0x24], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40714e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x42058c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x407142
push 0x206
lea ecx, [esp + 0x232]
push ebx
push ecx
mov word [esp + 0x238], bx
call fcn.0040a110
add esp, 0xc
push 0x104
lea edx, [esp + 0x230]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x134]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x230]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
push ebx
push eax
push ebx
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4071c0
call fcn.00401610
call fcn.00401580
push str.0___CreateLink:_invalid_value_for_whichFolder_
push 0xa7
push str.CreateLink
push 0x41ffe8
push 0x41d410
call fcn.004014d0
push 0x41d3fc
call fcn.004014d0
call fcn.00401630
push 0xa7
push str.CreateLink
push 0x41ffe8
push str.0___CreateLink:_invalid_value_for_whichFolder_
call fcn.004019f0
add esp, 0x28
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a52f
add esp, 0x428
ret