Function at 0x412191
Capabilities:
Create directory
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x49f2ca
call fcn.00454d9d
mov eax, dword [ebp + 8]
and dword [ebp - 0x250], 0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x244], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x260], eax
lea ecx, [ebp - 0x260]
push ecx
mov ebx, 0x4b0474
push ebx
push 0x17
push eax
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, 0x4a9aa8
push edi
call esi
mov dword [ebp - 0x240], eax
test eax, eax
jl 0x412217
mov eax, dword [ebp - 0x244]
cmp dword [eax + 0x18], 8
jb 0x412201
mov eax, dword [eax + 4]
jmp 0x412204
add eax, 4
mov ecx, dword [ebp - 0x260]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
mov dword [ebp - 0x240], eax
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x240], 0
mov byte [ebp - 4], 2
jl 0x41224a
lea eax, [ebp - 0x25c]
push eax
push ebx
push 0x17
push 0
push edi
call esi
mov ebx, dword [ebp - 0x248]
mov dword [ebp - 0x240], eax
xor edi, edi
jmp 0x412269
mov ebx, dword [ebp - 0x248]
push 0x4afc30
xor edi, edi
push edi
push dword [ebp - 0x240]
push dword [ebx + 0x10c]
call fcn.00418e71
cmp dword [ebp - 0x240], edi
jl 0x4122b7
mov esi, dword [ebp - 0x25c]
lea edx, [ebp - 0x23c]
mov ecx, ebx
call fcn.00414203
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x412293
mov eax, dword [eax + 4]
jmp 0x412296
add eax, 4
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x50]
push edi
push 1
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 2
call fcn.00407ab4
jmp 0x4122ce
push 0x4afc80
push edi
push dword [ebp - 0x240]
push dword [ebx + 0x10c]
call fcn.00418e71
cmp dword [ebp - 0x240], edi
jl 0x412ca1
mov eax, dword [ebx + 0x1c]
push 0x4ae0f8
push eax
call fcn.0041f44f
push 0x4ae1b8
push eax
call fcn.0041f44f
push 0x4ae1e8
push eax
call fcn.0041f44f
push edi
lea ecx, [ebp - 0x23c]
mov esi, eax
mov dword [ebp - 0x224], 7
call fcn.00407fc5
mov dword [ebp - 0x244], edi
lea eax, [ebp - 0x258]
mov edx, esi
mov byte [ebp - 4], 5
call fcn.0041f7b5
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x2b0]
mov edx, esi
mov dword [ebp - 0x284], ecx
call fcn.0041f78e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], eax
lea edi, [ebp - 0x284]
lea esi, [ebp - 0x258]
call fcn.0041fe88
test al, al
jne 0x412bf6
mov edi, dword [ebp - 0x260]
call fcn.0041fdaf
add eax, 8
push 0x4ae270
push eax
call fcn.0041f44f
push 0x4ae258
push eax
call fcn.0041f44f
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push edi
call dword [ecx + 0x1c]
mov dword [ebp - 0x240], eax
test eax, eax
jl 0x4123e1
mov edi, dword [ebp - 0x25c]
call fcn.0041fdaf
add eax, 8
push 0x4ae288
push eax
call fcn.0041f44f
push 0x4ae258
push eax
call fcn.0041f44f
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push edi
call dword [ecx + 0x1c]
mov dword [ebp - 0x240], eax
jmp 0x4123f9
push 0x4afcd0
push 0
push dword [ebp - 0x240]
push dword [ebx + 0x10c]
call fcn.00418e71
cmp dword [ebp - 0x240], 0
jl 0x412bc8
mov eax, dword [ebx + 0x1c]
push 0x4ae0f8
push eax
call fcn.0041f44f
push 0x4ae14c
push eax
call fcn.0041f44f
mov esi, eax
mov edi, 0x4ae15c
push edi
mov ecx, esi
mov bl, 1
call fcn.0041f647
test al, al
je 0x41244a
push edi
mov ecx, esi
call fcn.0041f590
mov ecx, eax
call fcn.0041eed3
cmp eax, 1
jne 0x41244a
xor bl, bl
mov edi, 0x4ae188
push edi
mov ecx, esi
mov byte [ebp - 0x249], 1
call fcn.0041f647
test al, al
je 0x41247d
push edi
mov ecx, esi
call fcn.0041f590
mov ecx, eax
call fcn.0041eed3
cmp eax, 1
jne 0x41247d
mov byte [ebp - 0x249], 0
test bl, bl
je 0x4124dc
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
mov edi, 0x4ae1fc
push edi
mov ecx, eax
call fcn.0041f647
test al, al
je 0x4124e1
call fcn.0041fdaf
add eax, 8
push edi
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
mov byte [ebp - 4], 6
or dword [ebp - 0x250], 1
push 0x4ae218
mov esi, eax
call fcn.00408357
pop ecx
test al, al
je 0x4124e1
mov bl, 1
jmp 0x4124e3
mov edi, 0x4ae1fc
xor bl, bl
mov dword [ebp - 4], 5
test byte [ebp - 0x250], 1
je 0x412509
and dword [ebp - 0x250], 0xfffffffe
push 0
push 1
lea ecx, [ebp - 0x27c]
call fcn.00407ab4
test bl, bl
je 0x4127c8
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push 0x4ae240
mov ecx, eax
call fcn.0041f647
test al, al
je 0x412be0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x244], eax
je 0x412553
push 0x4b0464
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00417f5b
lea eax, [ebp - 0x220]
push eax
xor esi, esi
push esi
push esi
push 0x8000
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
jge 0x4125b3
push eax
mov eax, dword [ebp - 0x248]
push esi
mov esi, 0x80047e41
push esi
push dword [eax + 0x10c]
call fcn.00418ee2
lea ecx, [ebp - 0x298]
call fcn.0045066b
mov dword [ebp - 0x298], 0x4b1354
mov dword [ebp - 0x28c], esi
push 0x4ba2ec
lea eax, [ebp - 0x298]
push eax
call fcn.004548cc
lea ecx, [ebp - 0x23c]
call fcn.00415949
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004160ec
lea esi, [ebp - 0x258]
call fcn.0041fdaf
push 8
pop ebx
mov edi, 0x4ae240
add eax, ebx
push edi
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 7
call fcn.00415753
push 0
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00407ab4
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, ebx
push 0x4ae270
push eax
call fcn.0041f44f
push 0x4ae24c
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], bl
call fcn.00415753
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 5
call fcn.00407ab4
mov ecx, dword [ebp - 0x238]
cmp dword [ebp - 0x224], ebx
jae 0x41267f
lea ecx, [ebp - 0x238]
mov eax, dword [ebp - 0x244]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x18]
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x244], eax
je 0x4126ae
push 0x4b0464
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00417f5b
cmp dword [ebp - 0x244], esi
jne 0x4126d2
mov eax, dword [ebp - 0x248]
push 0x4afd20
push esi
push 0x80004002
push dword [eax + 0x10c]
call fcn.00418e71
lea ecx, [ebp - 0x23c]
call fcn.00415949
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004160ec
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, ebx
push edi
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 9
call fcn.00415753
push 0
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00407ab4
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, ebx
push 0x4ae288
push eax
call fcn.0041f44f
push 0x4ae24c
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xa
call fcn.00415753
push 0
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00407ab4
mov ecx, dword [ebp - 0x238]
cmp dword [ebp - 0x224], ebx
jae 0x412792
lea ecx, [ebp - 0x238]
mov eax, dword [ebp - 0x244]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x18]
mov dword [ebp - 0x240], eax
test eax, eax
jge 0x412be0
push 0x4afd70
push 0
push eax
mov eax, dword [ebp - 0x248]
push dword [eax + 0x10c]
jmp 0x412bdb
cmp byte [ebp - 0x249], 0
je 0x412827
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push edi
mov ecx, eax
call fcn.0041f647
test al, al
je 0x412827
call fcn.0041fdaf
add eax, 8
push edi
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
mov byte [ebp - 4], 0xb
or dword [ebp - 0x250], 2
push 0x4ae228
mov esi, eax
call fcn.00408357
pop ecx
test al, al
je 0x412827
mov bl, 1
jmp 0x412829
xor bl, bl
mov dword [ebp - 4], 5
test byte [ebp - 0x250], 2
je 0x41284f
and dword [ebp - 0x250], 0xfffffffd
push 0
push 1
lea ecx, [ebp - 0x27c]
call fcn.00407ab4
test bl, bl
je 0x412be0
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push 0x4ae240
mov ecx, eax
call fcn.0041f647
test al, al
je 0x412be0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x244], eax
je 0x412899
push 0x4b0464
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00417f5b
cmp dword [ebp - 0x244], 0
mov edi, 0x80004002
jne 0x4128c0
mov eax, dword [ebp - 0x248]
push 0x4afdc0
push 0
push edi
push dword [eax + 0x10c]
call fcn.00418e71
lea eax, [ebp - 0x220]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x8002
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x41291f
push eax
mov eax, dword [ebp - 0x248]
push ebx
mov esi, 0x80047e43
push esi
push dword [eax + 0x10c]
call fcn.00418ee2
lea ecx, [ebp - 0x2a8]
call fcn.0045066b
mov dword [ebp - 0x2a8], 0x4b1354
mov dword [ebp - 0x29c], esi
push 0x4ba2ec
lea eax, [ebp - 0x2a8]
jmp 0x4125ad
lea ecx, [ebp - 0x23c]
call fcn.00415949
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004160ec
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push 0x4ae240
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xc
call fcn.00415753
push ebx
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00407ab4
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x238]
jae 0x412995
lea eax, [ebp - 0x238]
push eax
call fcn.00421118
cmp eax, ebx
pop ecx
jge 0x4129ff
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x238]
jae 0x4129b5
lea eax, [ebp - 0x238]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
jne 0x4129ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4129d5
and eax, 0xffff
or eax, 0x80070000
push 0x4afe10
push ebx
push eax
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x248]
push dword [eax + 0x10c]
call fcn.00418e71
cmp dword [ebp - 0x240], ebx
jl 0x412be0
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push 0x4ae270
push eax
call fcn.0041f44f
mov ebx, 0x4ae24c
push ebx
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xd
call fcn.00415753
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 5
call fcn.00407ab4
cmp dword [ebp - 0x224], 8
mov ecx, dword [ebp - 0x238]
jae 0x412a6a
lea ecx, [ebp - 0x238]
mov eax, dword [ebp - 0x244]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x18]
cmp eax, esi
mov dword [ebp - 0x240], eax
jge 0x412a8f
push 0x4afe60
push esi
push eax
jmp 0x4127b7
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x244], eax
je 0x412aaf
push 0x4b0464
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00417f5b
cmp dword [ebp - 0x244], esi
jne 0x412ad5
mov eax, dword [ebp - 0x248]
push 0x4afeb0
push esi
push edi
push dword [eax + 0x10c]
mov dword [ebp - 0x240], edi
call fcn.00418e71
cmp dword [ebp - 0x240], esi
jl 0x412be0
lea ecx, [ebp - 0x23c]
call fcn.00415949
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004160ec
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push 0x4ae240
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xe
call fcn.00415753
xor edi, edi
push edi
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00407ab4
lea esi, [ebp - 0x258]
call fcn.0041fdaf
add eax, 8
push 0x4ae288
push eax
call fcn.0041f44f
push ebx
push eax
call fcn.0041f44f
lea esi, [ebp - 0x27c]
mov ecx, eax
call fcn.0041ee43
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xf
call fcn.00415753
push edi
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00407ab4
cmp dword [ebp - 0x224], 8
mov ecx, dword [ebp - 0x238]
jae 0x412ba4
lea ecx, [ebp - 0x238]
mov eax, dword [ebp - 0x244]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x18]
cmp eax, edi
mov dword [ebp - 0x240], eax
jge 0x412be0
push 0x4aff00
push edi
jmp 0x412a89
push 0x4aff50
push 0
push dword [ebp - 0x240]
push dword [ebx + 0x10c]
call fcn.00418e71
lea esi, [ebp - 0x258]
call fcn.0041fdda
mov ebx, dword [ebp - 0x248]
jmp 0x41235c
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x412c0a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0
push 1
lea ecx, [ebp - 0x23c]
call fcn.00407ab4
jmp 0x412cb8
push 0x4affa0
push edi
push dword [ebp - 0x240]
push dword [ebx + 0x10c]
call fcn.00418e71
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x412ccc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x412ce0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x240], 0
jge 0x412d07
push dword [ebp - 0x240]
mov eax, dword [ebp - 0x248]
push 0
push 0x80047e40
push dword [eax + 0x10c]
call fcn.00418ee2
call fcn.00454df9
ret 8