Function at 0x416feb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x417051
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00402178
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
push edi
call fcn.0040afbc
mov al, 1
jmp 0x417053
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe191
leave
ret

Function at 0x41705f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4170c5
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00402178
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu
push edi
call fcn.0040afbc
mov al, 1
jmp 0x4170c7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe191
leave
ret

Function at 0x417145
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x24], esi
call fcn.00452c1a
cmp dword [eax], 4
je 0x417173
xor al, al
jmp 0x41720d
push esi
push esi
push esi
push edi
push str.startpin
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
jg 0x417205
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00451b3f
mov esi, str.installer_tdsetuputil_shell_util.cc
push 0x25
mov eax, esi
call fcn.0044db79
add esp, 0xc
test eax, eax
js 0x4171e8
cmp dword [ebp - 0xc], 8
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], 1
jae 0x4171bc
lea edi, [ebp - 0x20]
push 0x2dd
push esi
xor eax, eax
lea esi, [ebp - 0xd8]
call fcn.0044dd2b
push edi
add eax, 8
push str.StartPinShortcutLink_failed_with_code:
push eax
call fcn.0040c261
pop ecx
pop ecx
mov ecx, eax
call fcn.0044e316
pop ecx
test byte [ebp - 0x24], 1
je 0x4171f9
lea esi, [ebp - 0xd8]
call fcn.0044dd6a
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.004021a4
xor eax, eax
cmp ebx, 0x20
setg al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret

Function at 0x41721c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.00452c1a
cmp dword [eax], 4
je 0x417230
xor al, al
leave
ret
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call fcn.00506540
mov eax, dword [ebp + 8]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x400
mov dword [ebp - 0x30], str.startunpin
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
dec eax
neg eax
sbb al, al
inc al
leave
ret