Function at 0x407220
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete directory
Delete file
Delete registry key
Get common file path
Get file attributes
Persist via lnk shortcut
Resolve function by parsing pe exports
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x860
push ebx
push ebp
push esi
push edi
call fcn.00404f60
push 0x40d99c
lea ecx, [esp + 0x24]
call fcn.00401730
lea ecx, [esp + 0x20]
call fcn.00402090
cmp al, 0x5c
je 0x407255
mov dl, 0x5c
lea ecx, [esp + 0x20]
call fcn.00401ee0
xor ebx, ebx
lea ecx, [esp + 0x38]
mov dword [0x40db58], ebx
call fcn.00401710
push ecx
mov ecx, esp
push str.User
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
lea eax, [esp + 0x18]
push eax
call fcn.00405260
add esp, 0xc
mov edx, eax
lea ecx, [esp + 0x38]
call fcn.00401f10
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea ecx, [esp + 0x30]
call fcn.00401710
push ecx
mov ecx, esp
push str.Menu
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
lea ecx, [esp + 0x18]
push ecx
call fcn.00405260
add esp, 0xc
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.00401f10
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea ecx, [esp + 0x2c]
call fcn.00401710
push ecx
mov ecx, esp
push str.Desktop
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
lea edx, [esp + 0x18]
push edx
call fcn.00405260
add esp, 0xc
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00401f10
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea ecx, [esp + 0x2c]
call fcn.00402090
cmp al, 0x5c
je 0x407341
mov dl, 0x5c
lea ecx, [esp + 0x2c]
call fcn.00401ee0
push str.Peter_Lite.lnk
push str.Petr_Lite.lnk
call fcn.00402be0
add esp, 8
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00401e90
push ecx
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.Path
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push str.Path
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.004053e0
add esp, 4
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.User
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push str.User
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.004053e0
add esp, 4
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.Menu
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push str.Menu
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.004053e0
add esp, 4
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.Desktop
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push str.Desktop
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.004053e0
add esp, 8
lea ecx, [esp + 0x34]
call fcn.00401710
xor esi, esi
push esi
lea ecx, [esp + 0x38]
call fcn.00402250
push ecx
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
push eax
mov edx, str.Group
call fcn.00403d10
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.00405360
add esp, 8
lea edx, [esp + 0x38]
mov ecx, esp
push edx
push str.Group
call fcn.004018e0
push ecx
mov ecx, esp
push 0x40d9e8
call fcn.00401730
call fcn.004053e0
add esp, 8
inc esi
cmp esi, 3
jl 0x4074a6
mov eax, dword [0x40d9e8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add eax, 8
push eax
push 0x80000002
call esi
push ecx
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.LastPath
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9d0
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push str.LastPath
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d9d0
call fcn.00401730
call fcn.004053e0
mov edx, dword [0x40d990]
add esp, 8
lea ecx, [esp + 0x58]
add edx, 8
push ecx
push 1
push ebx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407656
mov eax, dword [esp + 0x58]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.DisplayName
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d98c
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d98c
call fcn.00401730
call fcn.00405360
add esp, 8
mov ecx, esp
push str.DisplayName
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d98c
call fcn.00401730
call fcn.004053e0
add esp, 4
mov ecx, esp
push str.UninstallString
call fcn.00401780
push ecx
mov ecx, esp
push 0x40d98c
call fcn.00401730
call fcn.004053e0
mov ecx, dword [0x40d98c]
add esp, 8
add ecx, 8
push ecx
push 0x80000002
call esi
lea ecx, [esp + 0x14]
call fcn.00401710
mov edx, dword [esp + 0x30]
cmp dword [edx + 4], ebx
je 0x407743
lea edx, [esp + 0x30]
lea ecx, [esp + 0x14]
call fcn.00401f10
lea ecx, [esp + 0x14]
call fcn.00402090
cmp al, 0x5c
je 0x407691
mov dl, 0x5c
lea ecx, [esp + 0x14]
call fcn.00401ee0
push str.Peter.lnk
push str.Petr.lnk
call fcn.00402be0
add esp, 8
lea ecx, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00401970
mov ecx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ecx, 8
push ecx
call edi
lea ecx, [esp + 0x1c]
call fcn.00401ad0
push str.Peter_with_modification_of_example_library.lnk
push 0x40ccf0
call fcn.00402be0
add esp, 8
lea edx, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push edx
call fcn.00401970
mov eax, dword [esp + 0x1c]
add eax, 8
push eax
call edi
lea ecx, [esp + 0x1c]
call fcn.00401ad0
push str.Uninstall.lnk
push 0x40ccb0
call fcn.00402be0
add esp, 8
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00401970
mov edx, dword [esp + 0x1c]
add edx, 8
push edx
call edi
lea ecx, [esp + 0x1c]
call fcn.00401ad0
mov eax, dword [esp + 0x30]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x407749
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x4078ac
lea ecx, [esp + 0x18]
xor esi, esi
push ecx
push 0x40b200
push 1
push ebx
push 0x40b1f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4078ac
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push 0x40b210
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x407898
lea edx, [esp + 0x470]
lea ecx, [esp + 0x2c]
push edx
call fcn.00401b40
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x470]
push 0x8000040
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x40788e
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x64]
push ebx
push edx
mov ecx, dword [eax]
lea edx, [esp + 0x278]
push 0x200
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x407884
lea edx, [esp + 0x270]
lea ecx, [esp + 0x14]
call fcn.00401f30
lea ecx, [esp + 0x14]
call fcn.00401bf0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x270]
push 0x200
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x407884
lea eax, [esp + 0x270]
lea ecx, [esp + 0x28]
push eax
call fcn.00401780
lea ecx, [esp + 0x20]
push str.PETER.EXE
push ecx
lea ecx, [esp + 0x24]
call fcn.00401970
lea ecx, [esp + 0x1c]
call fcn.00401bf0
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.00402340
test eax, eax
je 0x407872
lea edx, [esp + 0x38]
lea ecx, [esp + 0x28]
call fcn.00402340
test eax, eax
je 0x407872
mov esi, 1
lea ecx, [esp + 0x1c]
call fcn.00401ad0
lea ecx, [esp + 0x28]
call fcn.00401ad0
mov eax, dword [esp + 0x24]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp esi, ebx
je 0x4078ac
mov edx, dword [esp + 0x2c]
add edx, 8
push edx
call edi
mov dword [0x40c128], 1
xor ecx, ecx
mov dword [0x40db54], ebx
mov eax, 0x40da00
mov ebp, dword [eax]
add eax, 0x10
add ecx, ebp
cmp eax, 0x40da30
jl 0x4078c3
mov dword [0x40db50], ecx
mov ecx, 0x40da00
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
mov eax, dword [0x40c124]
mov edx, dword [esp + 0x1c]
mov ebp, dword [edx + eax + 8]
mov eax, dword [ecx]
test eax, eax
jle 0x407a8a
mov dword [esp + 0x28], eax
mov eax, dword [ebp]
xor ecx, ecx
mov cl, byte [ebp + 8]
lea edx, [ebp + 9]
push ecx
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], eax
call fcn.004017e0
xor eax, eax
lea ecx, [esp + 0x18]
mov al, byte [ebp + 8]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x2c]
lea ebp, [eax + ebp + 9]
call fcn.00401850
lea edx, [esp + 0x24]
lea ecx, [esp + 0x18]
call fcn.00401f10
lea ecx, [esp + 0x24]
call fcn.00401ad0
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x64]
add ecx, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407a26
lea edx, [esp + 0x50]
lea eax, [esp + 0x78]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov edx, eax
mov esi, ecx
add edx, 0x61c46800
mov edi, 0x40d9f8
adc esi, 8
sub eax, 0x61c46800
sbb ecx, 8
mov dword [esp + 0x60], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov ecx, 2
lea esi, [esp + 0x50]
xor eax, eax
mov dword [esp + 0x5c], edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4079e2
mov ecx, 2
mov edi, 0x40d9f8
lea esi, [esp + 0x5c]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4079e2
mov ecx, 2
mov edi, 0x40d9f8
lea esi, [esp + 0x40]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x407a19
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x84]
cmp eax, ecx
jne 0x407a19
test byte [esp + 0x64], 1
je 0x407a0b
mov edx, dword [esp + 0x18]
push 0x80
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x18]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x40db54]
mov eax, dword [0x40db00]
inc ecx
test eax, eax
mov dword [0x40db54], ecx
je 0x407a69
mov ecx, dword [0x40db50]
mov edx, dword [0x40db54]
push 0
push ecx
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
mov eax, dword [0x40db00]
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00403eb0
lea ecx, [esp + 0x18]
call fcn.00401ad0
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x28], eax
jne 0x4078ff
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
add ecx, 0x10
add esi, 0xc
cmp ecx, 0x40da30
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ecx
jl 0x4078e4
lea ecx, [esp + 0x20]
push str.Peter.ini
push ecx
lea ecx, [esp + 0x18]
call fcn.00401970
mov edx, dword [esp + 0x10]
add edx, 8
push edx
call edi
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea eax, [esp + 0x20]
push str.Peter.gid
push eax
lea ecx, [esp + 0x18]
call fcn.00401970
mov ecx, dword [esp + 0x10]
push 0x80
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea edx, [esp + 0x20]
push str.Peter.gid
push edx
lea ecx, [esp + 0x18]
call fcn.00401970
mov eax, dword [esp + 0x10]
add eax, 8
push eax
call edi
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea ecx, [esp + 0x20]
push str.Uninstal.exe
push ecx
lea ecx, [esp + 0x18]
call fcn.00401970
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.00401f10
lea ecx, [esp + 0x10]
call fcn.00401ad0
mov edx, dword [esp + 0x14]
add edx, 8
push edx
call edi
mov ecx, dword [0x40db2c]
test ecx, ecx
je 0x407d1a
test eax, eax
jne 0x407d1a
lea ecx, [esp + 0x40]
call fcn.00402550
push 0x40d11c
push 0x246
lea ecx, [esp + 0x48]
call fcn.00402630
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
test ecx, ecx
jle 0x407bb4
mov edx, 0x454c4946
cmp dword [eax], edx
jne 0x407ba2
cmp dword [eax + 4], edx
je 0x407baa
inc eax
dec ecx
test ecx, ecx
jg 0x407b99
jmp 0x407bb4
push eax
lea ecx, [esp + 0x18]
call fcn.00401b10
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
test ecx, ecx
jle 0x407be1
mov edx, 0x48544150
cmp dword [eax], edx
jne 0x407bce
cmp dword [eax + 4], edx
je 0x407bd6
inc eax
dec ecx
test ecx, ecx
jg 0x407bc5
jmp 0x407be1
push eax
mov ecx, 0x40d99c
call fcn.00401b10
lea eax, [esp + 0x1a4]
mov byte [esp + 0x1a4], 0
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x1a4]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401780
lea ecx, [esp + 0x18]
call fcn.00402090
cmp al, 0x5c
je 0x407c25
mov dl, 0x5c
lea ecx, [esp + 0x18]
call fcn.00401ee0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor esi, esi
push esi
lea ecx, [esp + 0x18]
call fcn.00402250
lea edx, [esp + 0x18]
push str.TEMP
push edx
lea ecx, [esp + 0x30]
call fcn.00401970
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401850
lea edx, [esp + 0x24]
push str..EXE
push edx
lea ecx, [esp + 0x18]
call fcn.00401970
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.00401f10
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea ecx, [esp + 0x24]
call fcn.00401ad0
lea ecx, [esp + 0x28]
call fcn.00401ad0
mov eax, dword [esp + 0x14]
add eax, 8
push eax
call edi
cmp eax, 0xffffffff
je 0x407cb4
inc esi
cmp esi, 0x3e8
jl 0x407c2d
mov ecx, dword [esp + 0x14]
push 0
push 0x100
push 2
push 0
push 0
add ecx, 8
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407d08
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x3c]
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
mov ecx, 0x40da34
call fcn.00401f10
lea ecx, [esp + 0x18]
call fcn.00401ad0
lea ecx, [esp + 0x40]
call fcn.00402570
push ecx
mov ecx, esp
push 0x40d99c
call fcn.00401730
call fcn.004070f0
call fcn.00404f80
push 7
call fcn.004095a0
add esp, 8
lea ecx, [esp + 0x14]
call fcn.00401ad0
lea ecx, [esp + 0x34]
call fcn.00401ad0
lea ecx, [esp + 0x2c]
call fcn.00401ad0
lea ecx, [esp + 0x30]
call fcn.00401ad0
lea ecx, [esp + 0x38]
call fcn.00401ad0
lea ecx, [esp + 0x20]
call fcn.00401ad0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x860
ret