Function at 0x414dc0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bae4c
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x4f07b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.CreateShortcutNew_begin
push 0x18d
push str.CreateShortcutNew
mov dword [ebp - 4], 3
call fcn.00424250
add esp, 0xc
mov dword [ebp - 0x43c], 0
xor eax, eax
mov dword [ebp - 0x440], 0
mov word [ebp - 0x420], ax
mov dword [ebp - 0x448], 0
push 0x206
push eax
lea eax, [ebp - 0x41e]
mov dword [ebp - 0x444], 0
push eax
call fcn.0048f480
add esp, 0xc
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push eax
lea eax, [ebp - 0x216]
push eax
call fcn.0048f480
add esp, 0xc
lea eax, [ebp - 0x43c]
push eax
push 0x4c1738
push 1
push 0
push 0x4c1748
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x414eb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateShortcutNew_1_create_ShellLink_failed:_d.
push 0x19a
push str.CreateShortcutNew
call fcn.00424250
add esp, 0x10
jmp 0x415522
mov eax, dword [ebp - 0x43c]
lea edx, [ebp - 0x440]
push edx
push 0x4c1768
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x414eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateShortcutNew_2_create_PersistFile_failed:_d.
push 0x19f
push str.CreateShortcutNew
call fcn.00424250
add esp, 0x10
jmp 0x415522
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp + 8]
call fcn.0041aac0
mov edx, eax
mov byte [ebp - 4], 4
cmp dword [edx + 0x14], 8
jb 0x414f0b
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x424], 8
jb 0x414f33
push dword [ebp - 0x438]
call fcn.004847d0
add esp, 4
lea eax, [ebp - 0x448]
push eax
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jns 0x414f68
call esi
push eax
push str.CreateShortcutNew_3_open_COMMON_DESKTOPDIRECTORY_failed:_d.
push 0x1a8
push str.CreateShortcutNew
call fcn.00424250
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x414f9e
call esi
push eax
push str.CreateShortcutNew_4_get_desktopDir_failed:_d.
push 0x1ac
push str.CreateShortcutNew
call fcn.00424250
add esp, 0x10
jmp 0x41512d
push str.ldremote.exe
lea edx, [ebp + 8]
lea ecx, [ebp - 0x438]
call fcn.00414c80
add esp, 4
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.0041a9d0
mov edx, eax
mov byte [ebp - 4], 6
cmp dword [edx + 0x14], 8
jb 0x414fd4
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp - 0x464], 8
jb 0x414ff8
push dword [ebp - 0x478]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x464], 7
cmp dword [ebp - 0x424], 8
mov dword [ebp - 0x468], 0
mov word [ebp - 0x478], ax
jb 0x41502c
push dword [ebp - 0x438]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x464], 7
mov dword [ebp - 0x468], 0
mov word [ebp - 0x478], ax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x478]
call fcn.0041b300
lea eax, [ebp + 0x38]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x478]
lea ecx, [ebp - 0x460]
call fcn.00414d10
add esp, 4
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 9
push ecx
mov ecx, eax
call fcn.0041a9d0
mov edx, eax
mov byte [ebp - 4], 0xa
cmp dword [edx + 0x14], 8
jb 0x41509b
mov edx, dword [edx]
mov eax, dword [ebp - 0x440]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp dword [ebp - 0x47c], 8
jb 0x4150c1
push dword [ebp - 0x490]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x47c], 7
cmp dword [ebp - 0x44c], 8
mov dword [ebp - 0x480], 0
mov word [ebp - 0x490], ax
jb 0x4150f5
push dword [ebp - 0x460]
call fcn.004847d0
add esp, 4
xor eax, eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x464], 8
mov dword [ebp - 0x44c], 7
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
jb 0x41512d
push dword [ebp - 0x478]
call fcn.004847d0
add esp, 4
lea eax, [ebp - 0x444]
push eax
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x415161
call esi
push eax
push str.CreateShortcutNew_5_open_COMMON_PROGRAMS_failed:_d.
push 0x1b7
push str.CreateShortcutNew
call fcn.00424250
add esp, 0x10
jmp 0x415522
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x444]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x415197
call esi
push eax
push str.CreateShortcutNew_6_get_programDir_failed:_d.
push 0x1bc
push str.CreateShortcutNew
call fcn.00424250
add esp, 0x10
jmp 0x415522
push str.ldremote.exe
lea edx, [ebp + 8]
lea ecx, [ebp - 0x490]
call fcn.00414c80
add esp, 4
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0xb
push ecx
mov ecx, eax
call fcn.0041a9d0
mov edx, eax
mov byte [ebp - 4], 0xc
cmp dword [edx + 0x14], 8
jb 0x4151cd
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp - 0x44c], 8
jb 0x4151f1
push dword [ebp - 0x460]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x44c], 7
cmp dword [ebp - 0x47c], 8
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
jb 0x415225
push dword [ebp - 0x490]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x464], 7
mov dword [ebp - 0x468], 0
mov word [ebp - 0x478], ax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x478]
call fcn.0041b300
lea eax, [ebp + 0x38]
mov byte [ebp - 4], 0xe
push eax
lea edx, [ebp - 0x478]
lea ecx, [ebp - 0x490]
call fcn.00414d10
add esp, 4
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0xf
push ecx
mov ecx, eax
call fcn.0041a9d0
mov edx, eax
mov byte [ebp - 4], 0x10
cmp dword [edx + 0x14], 8
jb 0x415294
mov edx, dword [edx]
mov eax, dword [ebp - 0x440]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp dword [ebp - 0x44c], 8
jb 0x4152ba
push dword [ebp - 0x460]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x44c], 7
cmp dword [ebp - 0x47c], 8
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
jb 0x4152ee
push dword [ebp - 0x490]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x47c], 7
cmp dword [ebp - 0x464], 8
mov dword [ebp - 0x480], 0
mov word [ebp - 0x490], ax
jb 0x415322
push dword [ebp - 0x478]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x464], 7
mov dword [ebp - 0x468], 0
mov word [ebp - 0x478], ax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x478]
call fcn.0041b300
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 0x12
push eax
lea edx, [ebp - 0x478]
lea ecx, [ebp - 0x438]
call fcn.00414d10
add esp, 4
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x464], 8
jb 0x41538c
push dword [ebp - 0x478]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x464], 7
mov word [ebp - 0x478], ax
lea ecx, [ebp - 0x438]
lea eax, [ebp - 0x460]
mov dword [ebp - 0x468], 0
push eax
call fcn.0041aac0
cmp dword [eax + 0x14], 8
jb 0x4153c3
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [ebp - 0x44c], 8
jb 0x4153e3
push dword [ebp - 0x460]
call fcn.004847d0
add esp, 4
push str.ldremoteuninst.exe
lea edx, [ebp + 8]
lea ecx, [ebp - 0x490]
call fcn.00414c80
add esp, 4
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x15
push ecx
mov ecx, eax
call fcn.0041a9d0
mov edx, eax
mov byte [ebp - 4], 0x16
cmp dword [edx + 0x14], 8
jb 0x415419
mov edx, dword [edx]
mov eax, dword [ebp - 0x43c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp - 0x44c], 8
jb 0x41543d
push dword [ebp - 0x460]
call fcn.004847d0
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x47c], 8
mov dword [ebp - 0x44c], 7
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
jb 0x415475
push dword [ebp - 0x490]
call fcn.004847d0
add esp, 4
lea eax, [ebp + 0x50]
push eax
lea edx, [ebp - 0x438]
lea ecx, [ebp - 0x490]
call fcn.00414d10
add esp, 4
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x17
push ecx
mov ecx, eax
call fcn.0041a9d0
mov edx, eax
mov byte [ebp - 4], 0x18
cmp dword [edx + 0x14], 8
jb 0x4154ad
mov edx, dword [edx]
mov eax, dword [ebp - 0x440]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp dword [ebp - 0x44c], 8
jb 0x4154d3
push dword [ebp - 0x460]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x44c], 7
cmp dword [ebp - 0x47c], 8
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
jb 0x415507
push dword [ebp - 0x490]
call fcn.004847d0
add esp, 4
mov byte [ebp - 4], 3
cmp dword [ebp - 0x424], 8
jb 0x415522
push dword [ebp - 0x438]
call fcn.004847d0
add esp, 4
mov ecx, dword [ebp - 0x440]
test ecx, ecx
je 0x415532
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x43c]
test ecx, ecx
je 0x415542
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x448]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
je 0x415555
push eax
call esi
mov eax, dword [ebp - 0x444]
test eax, eax
je 0x415562
push eax
call esi
push str.CreateShortcutNew_end
push 0x1d5
push str.CreateShortcutNew
call fcn.00424250
add esp, 0xc
cmp dword [ebp + 0x1c], 8
jb 0x41558a
push dword [ebp + 8]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x4155af
push dword [ebp + 0x20]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp + 0x34], 7
cmp dword [ebp + 0x4c], 8
mov dword [ebp + 0x30], 0
mov word [ebp + 0x20], ax
jb 0x4155d4
push dword [ebp + 0x38]
call fcn.004847d0
add esp, 4
xor eax, eax
mov dword [ebp + 0x4c], 7
cmp dword [ebp + 0x64], 8
mov dword [ebp + 0x48], 0
mov word [ebp + 0x38], ax
jb 0x4155f9
push dword [ebp + 0x50]
call fcn.004847d0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004845db
mov esp, ebp
pop ebp
ret