Function at 0x1400fb900
Capabilities:
Empty the recycle bin

Disassembly:
mov word [rsp + 0x18], r8w
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov dword [rsp + 0x38], 0x2707
movsx eax, word [rsp + 0xe0]
cmp eax, 0x761
jge 0x1400fbcc3
movsx eax, word [rsp + 0xe0]
and eax, 0x689
cmp eax, 0x6ff
jle 0x1400fb9cc
movsx eax, word [rsp + 0xe0]
or eax, 0x551
cmp eax, 0x2df
jg 0x1400fb9a8
mov eax, dword [rsp + 0x38]
xor eax, 0x385b
mov dword [rsp + 0x38], eax
movsx eax, word [rsp + 0xe0]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0x2c0
je 0x1400fb99e
cmp dword [rsp + 0x4c], 0x488
je 0x1400fb98c
jmp 0x1400fb9a8
mov edx, PathYetAnotherMakeUniqueName
mov ecx, 0xc4
call fcn.1400fa910
nop
jmp 0x1400fb9a8
mov eax, dword [rsp + 0x38]
sar eax, 1
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], ILFindChild
mov r9b, 0xfe
movzx r8d, byte [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
mov cl, 0x42
call fcn.1400fbea0
nop
mov eax, 0xea9
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
movsx eax, word [rsp + 0xe0]
shl eax, 0x56
cmp eax, 0x39d
jl 0x1400fba9d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x48], eax
movzx eax, word [rsp + 0x30]
sub eax, 0x64a
mov word [rsp + 0x30], ax
movzx r8d, word [rsp + 0xe0]
movzx edx, byte [rsp + 0xd8]
mov rcx, qword [rsp + 0xd0]
call fcn.1400fb900
mov eax, 0x249
mov word [rsp + 0xe0], ax
mov r8d, 0xe8
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0x88], eax
mov byte [rsp + 0x20], 0x85
movzx r9d, byte [rsp + 0xd8]
movzx r8d, word [rsp + 0xe0]
movzx edx, byte [rsp + 0xd8]
mov ecx, 0x1f
call fcn.1400fc1b0
mov eax, dword [rsp + 0x38]
add eax, 0x1357
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0xd8]
mov byte [rsp + 0x3c], al
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x50], al
cmp byte [rsp + 0x50], 0
je 0x1400fbae4
cmp byte [rsp + 0x50], 0x44
je 0x1400fbc14
jmp 0x1400fbc95
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xd0]
jg 0x1400fbb8e
movsx eax, word [rsp + 0xe0]
cmp eax, 0x1da
jne 0x1400fbb7d
mov eax, 0x5ab
mov word [rsp + 0xe0], ax
movzx r8d, word [rsp + 0x30]
mov rdx, qword [rsp + 0xd0]
mov ecx, SHGetNewLinkInfoW
call fcn.1400fb0f0
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
mov edx, 0xc2
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x98], rax
mov eax, 0x31a
mov word [rsp + 0xe0], ax
mov edx, 0xe2
mov ecx, 0x64
call fcn.1400fa910
nop
jmp 0x1400fbb8c
movabs rax, 0x7b859c10fd5b2e
mov qword [rsp + 0x78], rax
jmp 0x1400fbbf5
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xd0]
jl 0x1400fbbf5
movzx eax, word [rsp + 0x30]
shl eax, 2
mov word [rsp + 0x30], ax
mov r9d, 0x7f
mov r8d, SHDoDragDrop
mov edx, 0xe6
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHUpdateImageW]
movzx eax, byte [rsp + 0x3c]
movzx ecx, byte [rsp + 0xd8]
or eax, ecx
mov byte [rsp + 0x34], al
mov rax, qword [rsp + 0x78]
shr rax, 0x20
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0xb0], rax
jmp 0x1400fbc95
mov eax, dword [rsp + 0x38]
and eax, 0x60d
mov dword [rsp + 0x44], eax
movzx eax, word [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xfd
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
mov edx, 0x5b
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x8c], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x48], eax
jmp 0x1400fbce6
movsx eax, word [rsp + 0xe0]
sub eax, 0x378
cmp eax, 0x223
jl 0x1400fbce6
mov ecx, 0x5e
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x38], 0x4251
je 0x1400fbd59
mov byte [rsp + 0xd8], SHTestTokenMembership
mov byte [rsp + 0x20], reloc.SHELL32.dll_ILCloneFirst
movzx r9d, byte [rsp + 0xd8]
movzx r8d, word [rsp + 0xe0]
movzx edx, byte [rsp + 0xd8]
mov ecx, 0x5f
call fcn.1400fc1b0
nop
movsx eax, word [rsp + 0xe0]
cmp eax, 0x268
jge 0x1400fbd59
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ILFree]
mov eax, dword [rsp + 0x38]
add eax, 0x1ee7
mov dword [rsp + 0x38], eax
mov edx, 0x4d
mov ecx, ILCloneFirst
call fcn.1400fa910
nop
mov eax, 0x4a1
mov word [rsp + 0xe0], ax
mov dword [rsp + 0x20], ILCloneFirst
lea r9, [rsp + 0x40]
mov r8d, 0x4e
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetDataFromIDListW]
mov dword [rsp + 0x40], eax
mov eax, 8
add rsp, 0xc8
ret