Function at 0x1400049e0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1400960c0]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x140085a70]
xor edx, edx
mov r8d, 1
lea rcx, [0x140085a90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140004fdf
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0xa0]
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.140008cf0
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x50]
call rbx
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140004ac3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004abe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004abe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x48]
mov rbx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140004adb
mov rbx, qword [rdi]
mov rax, qword [rdi + 0x10]
lea rdx, [rbx + rax*2]
mov rcx, rbx
call fcn.1400022b0
cmp rax, rdx
je 0x140004b5c
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140004aff
cmp cx, 0x2f
jne 0x140004b08
add rax, 2
cmp rax, rdx
jne 0x140004af0
cmp rax, rdx
je 0x140004b5c
nop dword [rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140004b2e
cmp cx, 0x2f
je 0x140004b2e
mov rdx, r8
cmp rax, r8
jne 0x140004b10
jmp 0x140004b5c
cmp rax, rdx
je 0x140004b5c
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x140004b54
cmp cx, 0x2f
jne 0x140004b5c
mov rdx, r8
cmp rax, r8
jne 0x140004b40
sub rdx, rbx
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov r8, rdx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000b070
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140008cf0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x50]
call rsi
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140004bf2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
movdqa xmm0, xmmword [0x14008a1c0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140004c4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea r8, [rbp - 0x48]
lea rdx, [0x140085a80]
call qword [rax]
test eax, eax
js 0x140004fd5
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140004fd5
mov rsi, qword [r15 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 4
jb 0x140005010
cmp qword [r15 + 0x18], 0xf
jbe 0x140004cb0
mov r15, qword [r15]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [rsi + 4]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140004d52
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140004d0c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140072dc0
test rax, rax
je 0x140004d3e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004d4d
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140004d26
mov rdi, r12
jmp 0x140004d4d
cmp rcx, 0x1000
jb 0x140004d45
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005016
jmp 0x140004cf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072dc0
mov rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x6b6e6c2e
mov byte [rdi + r14], 0
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
call fcn.1400723d0
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140002150
nop
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x20]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x50]
call fcn.14000b070
nop
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x40]
call fcn.140002690
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140004e50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
movdqa xmm0, xmmword [0x14008a1c0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140004eaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ea2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ea2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
movdqa xmm0, xmmword [0x14008a1c0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r12w
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004ef9
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ef4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ef4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
movdqa xmm0, xmmword [0x14008a1d0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.140008cf0
nop
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
mov r8d, 1
mov rcx, qword [rbp - 0x48]
call rbx
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140004f87
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140004fd5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072ecc
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140072da0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140001220
int3
call fcn.140001180
int3