Function at 0x40d9cf
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x36c
mov eax, 0x5f06e2
call fcn.005c5e27
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jge 0x40d9f2
xor al, al
jmp 0x40dd68
mov byte [ebp - 0x365], bl
mov dword [ebp - 0x36c], ebx
lea eax, [ebp - 0x36c]
push eax
push 0x626a50
push 1
push ebx
push 0x626de0
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x40dd48
mov dword [ebp - 0x370], ebx
lea edx, [ebp - 0x370]
push edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax]
push 0x626e40
push eax
call dword [ecx]
cmp eax, ebx
jl 0x40dd35
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40dd35
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax]
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x3c]
push 0xf
pop edi
mov dword [ebp - 0x350], edi
mov dword [ebp - 0x354], ebx
mov byte [ebp - 0x364], bl
mov dword [ebp - 0x318], edi
mov dword [ebp - 0x31c], ebx
mov byte [ebp - 0x32c], bl
mov byte [ebp - 4], 3
lea eax, [ebp - 0x110]
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x338], ebx
mov byte [ebp - 0x348], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dace
sub eax, esi
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x348]
call fcn.004022cd
lea eax, [ebp - 0x32c]
push eax
lea edx, [ebp - 0x364]
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 4
call fcn.0047a050
neg al
sbb al, al
pop ecx
xor esi, esi
push ebx
inc al
inc esi
push esi
lea ecx, [ebp - 0x348]
mov byte [ebp - 0x371], al
mov byte [ebp - 4], 3
call fcn.00402696
cmp byte [ebp - 0x371], bl
jne 0x40dd1b
cmp dword [ebp - 0x31c], 2
jbe 0x40db75
cmp dword [ebp - 0x318], 0x10
mov eax, dword [ebp - 0x32c]
jae 0x40db51
lea eax, [ebp - 0x32c]
cmp byte [eax], 0x5f
jne 0x40db75
cmp dword [ebp - 0x318], 0x10
mov eax, dword [ebp - 0x32c]
jae 0x40db6b
lea eax, [ebp - 0x32c]
cmp byte [eax + 1], 0x5f
je 0x40dd1b
push 0x2e
lea eax, [ebp - 0x32c]
call fcn.0041338b
cmp eax, 0xffffffff
je 0x40dbc1
push eax
push ebx
lea eax, [ebp - 0x32c]
push eax
lea esi, [ebp - 0x348]
call fcn.004042ca
mov esi, eax
lea edi, [ebp - 0x32c]
mov byte [ebp - 4], 5
call fcn.00405d94
push ebx
push 1
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 3
call fcn.00402696
push 0xf
pop edi
mov esi, 0x66e400
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dbcb
sub eax, edx
cmp eax, ebx
jbe 0x40dbe4
push esi
lea ecx, [ebp - 0x32c]
call fcn.00402342
lea eax, [ebp - 0x378]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
jge 0x40dc0d
push ebx
push 1
lea ecx, [ebp - 0x32c]
call fcn.00402696
push ebx
push 1
jmp 0x40dd2a
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x378]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x40dbf7
cmp dword [ebp - 0x350], 0x10
mov esi, dword [ebp - 0x364]
jae 0x40dc39
lea esi, [ebp - 0x364]
lea eax, [ebp - 0x310]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x40dc5f
cmp cl, bl
je 0x40dc5b
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x40dc5f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40dc3f
xor eax, eax
jmp 0x40dc64
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40dc71
mov byte [ebp - 0x365], 1
jmp 0x40dbf7
cmp dword [ebp - 0x318], 0x10
mov eax, dword [ebp - 0x32c]
jae 0x40dc86
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x310]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x210]
push pe_nt_image_headers32
push eax
call fcn.005be145
lea eax, [ebp - 0x210]
add esp, 0x14
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x338], ebx
mov byte [ebp - 0x348], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dcc2
sub eax, esi
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x348]
call fcn.004022cd
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x370]
mov esi, dword [eax]
mov edi, eax
push 1
lea eax, [ebp - 0x348]
call fcn.00479b80
push eax
push edi
call dword [esi + 0x18]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x348]
mov edi, eax
call fcn.00402696
cmp edi, ebx
jl 0x40dd1b
mov byte [ebp - 0x365], 1
push ebx
push esi
lea ecx, [ebp - 0x32c]
call fcn.00402696
push ebx
push esi
lea ecx, [ebp - 0x364]
call fcn.00402696
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x370]
cmp eax, ebx
je 0x40dd48
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x36c]
cmp eax, ebx
je 0x40dd5c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, byte [ebp - 0x365]
call fcn.005c5eaa
ret