diff --git a/dlls/hlink/hlink_main.c b/dlls/hlink/hlink_main.c
index b0b407aa13b..a786b6233e0 100644
--- a/dlls/hlink/hlink_main.c
+++ b/dlls/hlink/hlink_main.c
@@ -278,8 +278,57 @@ HRESULT WINAPI HlinkIsShortcut(LPCWSTR pwzFileName)
 
 HRESULT WINAPI HlinkGetSpecialReference(ULONG uReference, LPWSTR *ppwzReference)
 {
-    FIXME("(%u %p) stub\n", uReference, ppwzReference);
-    return E_NOTIMPL;
+    DWORD res, type, size = 100;
+    LPCWSTR value_name;
+    WCHAR *buf;
+    HKEY hkey;
+
+    static const WCHAR start_pageW[] = {'S','t','a','r','t',' ','P','a','g','e',0};
+    static const WCHAR search_pageW[] = {'S','e','a','r','c','h',' ','P','a','g','e',0};
+
+    static const WCHAR ie_main_keyW[] =
+        {'S','o','f','t','w','a','r','e',
+         '\\','M','i','c','r','o','s','o','f','t','\\',
+         'I','n','t','e','r','n','e','t',' ','E','x','p','l','o','r','e','r',
+         '\\','M','a','i','n',0};
+
+    TRACE("(%u %p)\n", uReference, ppwzReference);
+
+    *ppwzReference = NULL;
+
+    switch(uReference) {
+    case HLSR_HOME:
+        value_name = start_pageW;
+        break;
+    case HLSR_SEARCHPAGE:
+        value_name = search_pageW;
+        break;
+    case HLSR_HISTORYFOLDER:
+        return E_NOTIMPL;
+    default:
+        return E_INVALIDARG;
+    }
+
+    res = RegOpenKeyW(HKEY_CURRENT_USER, ie_main_keyW, &hkey);
+    if(res != ERROR_SUCCESS) {
+        WARN("Could not open key: %u\n", res);
+        return HRESULT_FROM_WIN32(res);
+    }
+
+    buf = CoTaskMemAlloc(size);
+    res = RegQueryValueExW(hkey, value_name, NULL, &type, (PBYTE)buf, &size);
+    buf = CoTaskMemRealloc(buf, size);
+    if(res == ERROR_MORE_DATA)
+        res = RegQueryValueExW(hkey, value_name, NULL, &type, (PBYTE)buf, &size);
+    RegCloseKey(hkey);
+    if(res != ERROR_SUCCESS) {
+        WARN("Could not query value %s: %u\n", debugstr_w(value_name), res);
+        CoTaskMemFree(buf);
+        return HRESULT_FROM_WIN32(res);
+    }
+
+    *ppwzReference = buf;
+    return S_OK;
 }
 
 HRESULT WINAPI HlinkTranslateURL(LPCWSTR pwzURL, DWORD grfFlags, LPWSTR *ppwzTranslatedURL)
diff --git a/dlls/hlink/tests/hlink.c b/dlls/hlink/tests/hlink.c
index 172d7b708fb..4d3a3e2e4da 100644
--- a/dlls/hlink/tests/hlink.c
+++ b/dlls/hlink/tests/hlink.c
@@ -316,6 +316,36 @@ static void test_persist(void)
     IHlink_Release(lnk);
 }
 
+static void test_special_reference(void)
+{
+    LPWSTR ref;
+    HRESULT hres;
+
+    hres = HlinkGetSpecialReference(HLSR_HOME, &ref);
+    todo_wine
+    ok(hres == S_OK, "HlinkGetSpecialReference(HLSR_HOME) failed: %08x\n", hres);
+    todo_wine
+    ok(ref != NULL, "ref == NULL\n");
+    CoTaskMemFree(ref);
+
+    hres = HlinkGetSpecialReference(HLSR_SEARCHPAGE, &ref);
+    todo_wine
+    ok(hres == S_OK, "HlinkGetSpecialReference(HLSR_SEARCHPAGE) failed: %08x\n", hres);
+    todo_wine
+    ok(ref != NULL, "ref == NULL\n");
+    CoTaskMemFree(ref);
+
+    ref = (void*)0xdeadbeef;
+    hres = HlinkGetSpecialReference(HLSR_HISTORYFOLDER, &ref);
+    ok(hres == E_NOTIMPL, "HlinkGetSpecialReference(HLSR_HISTORYFOLDER) failed: %08x\n", hres);
+    ok(ref == NULL, "ref=%p\n", ref);
+
+    ref = (void*)0xdeadbeef;
+    hres = HlinkGetSpecialReference(4, &ref);
+    ok(hres == E_INVALIDARG, "HlinkGetSpecialReference(HLSR_HISTORYFOLDER) failed: %08x\n", hres);
+    ok(ref == NULL, "ref=%p\n", ref);
+}
+
 START_TEST(hlink)
 {
     CoInitialize(NULL);
@@ -323,6 +353,7 @@ START_TEST(hlink)
     test_HlinkIsShortcut();
     test_reference();
     test_persist();
+    test_special_reference();
 
     CoUninitialize();
 }