Function at 0x401000
Capabilities:
Create shortcut via ishelllink
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push edi
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x204], 0
mov word [ebp - 0x200], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x1fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
push 0x40d918
push 1
push 0
push 0x40db48
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x4012cc
lea ecx, [ebp - 0x204]
push ecx
push 0x40db78
mov edx, dword [ebp - 0x208]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x208]
push ecx
call dword [eax]
test eax, eax
jl 0x4012c2
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x728], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x727]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x624], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x623]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x210], 0x104
push 0
push 0
mov edx, dword [ebp - 0x210]
push edx
lea eax, [ebp - 0x314]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x210], 0x104
push 0
push 0
mov edx, dword [ebp - 0x210]
push edx
lea eax, [ebp - 0x728]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x210], 0x104
push 0
push 0
mov edx, dword [ebp - 0x210]
push edx
lea eax, [ebp - 0x624]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x18]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x314]
push edx
mov eax, dword [ebp - 0x208]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x208]
push edx
call dword [ecx + 0x50]
test eax, eax
jl 0x4012bb
lea eax, [ebp - 0x728]
push eax
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x208]
push eax
call dword [edx + 0x1c]
test eax, eax
jl 0x4012bb
lea ecx, [ebp - 0x624]
push ecx
mov edx, dword [ebp - 0x208]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x208]
push ecx
call dword [eax + 0x2c]
test eax, eax
jl 0x4012bb
lea edx, [ebp - 0x520]
push edx
push 0x18
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4011fa
lea ecx, [ebp - 0x520]
push ecx
push 7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4011fa
jmp 0x4013ca
push 0x208
push 0
lea eax, [ebp - 0x51c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x51c]
push ecx
mov edx, dword [ebp - 0x520]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40125d
push 0x40f010
lea eax, [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x51c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40f014
lea eax, [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
lea ecx, [ebp - 0x51c]
push ecx
mov edx, dword [ebp - 0x204]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x204]
push ecx
call dword [eax + 0x18]
test eax, eax
jge 0x401281
jmp 0x4013c5
mov edx, dword [ebp - 0x208]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x208]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x208], 0
mov edx, dword [ebp - 0x204]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x204]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x204], 0
jmp 0x4012c0
jmp 0x4013c0
jmp 0x4012c7
jmp 0x4013bb
jmp 0x4013b4
push 0
push 0
push str.CocreateInstance_Failed
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0x208], 0
je 0x4012fa
mov eax, dword [ebp - 0x208]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x208]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0x204], 0
je 0x401315
mov eax, dword [ebp - 0x204]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x204]
push edx
call dword [ecx + 8]
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0x80070057
jg 0x401353
cmp dword [ebp - 0x72c], 0x80070057
je 0x40139d
cmp dword [ebp - 0x72c], 0x80040110
je 0x401373
cmp dword [ebp - 0x72c], 0x80040154
je 0x40135e
jmp 0x4013b0
cmp dword [ebp - 0x72c], 0
je 0x401388
jmp 0x4013b0
push 0
push 0
push str.REGDB_E_CLASSNOTREG
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4013b0
push 0
push 0
push str.CLASS_E_NOAGGREGATION
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4013b0
push 0
push 0
push str.S_OK
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4013b0
push 0
push 0
push str.E_INVALIDARG
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x4013cf
mov eax, 1
jmp 0x4013cf
jmp 0x4012df
jmp 0x4012df
jmp 0x4012df
jmp 0x4012df
pop edi
mov esp, ebp
pop ebp
ret