Function at 0x1400865f0
Capabilities:
Create shortcut via ishelllink
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r15, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400a5270
lea rcx, [r14 + 0x10]
lea rdx, [rsp + 0x60]
call fcn.140085a00
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xfffffff
jb 0x140086664
mov eax, 0x80004005
jmp 0x1400868fd
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140126570]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1400fe010]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1400868e5
mov qword [rsp + 0x38], r12
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x140126518]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x1400868cf
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8d, [r12 + 2]
lea rdx, [rsp + 0x60]
call qword [rax + 0x28]
mov ebx, eax
test eax, eax
js 0x1400868cf
mov qword [rsp + 0x30], r12
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
lea rdx, [0x140126508]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x1400868b9
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x1400fe2a0]
call qword [rax + 0x28]
mov ebx, eax
test eax, eax
js 0x1400868b9
mov r8d, 0x104
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x48]
call qword [0x140151858]
mov ebx, eax
mov byte [r15], r12b
lea rsi, [r12 - 1]
lea rdi, [r14 + 0x30]
test eax, eax
js 0x1400867b9
lea rcx, [rbp + 0x170]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140086760
mov rdx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14008677b
mov r8, qword [rdi]
cmp rdx, rax
jne 0x1400867b9
lea rcx, [rbp + 0x170]
test rdx, rdx
je 0x1400868ad
lea rax, [rbp + 0x170]
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400867b9
add rcx, 2
sub rdx, 1
jne 0x1400867a0
jmp 0x1400868ad
cmp dword [r14 + 0xc], 2
jne 0x1400868a8
mov byte [r15], 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.ole32.dll_PropVariantClear]
cmp qword [rdi + 0x18], 8
jb 0x1400867dd
mov rdi, qword [rdi]
mov ebx, 0x80070057
test rdi, rdi
cmovne ebx, r12d
je 0x14008683c
nop dword [rax + rax]
lea rsi, [rsi + 1]
cmp word [rdi + rsi*2], 0
jne 0x1400867f0
lea rsi, [rsi*2 + 2]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rsp + 0x50], rax
mov ebx, 0x8007000e
test rax, rax
cmovne ebx, r12d
je 0x14008683c
test rsi, rsi
je 0x140086832
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.1400a4bc0
mov eax, 0x1f
mov word [rsp + 0x48], ax
test ebx, ebx
jns 0x140086851
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
jmp 0x1400868ad
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x1400fe2a0]
call qword [rax + 0x30]
mov ebx, eax
test eax, eax
js 0x1400868ad
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov ebx, eax
test eax, eax
js 0x1400868ad
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x1400868ad
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x60]
call qword [rax + 0x30]
mov ebx, eax
jmp 0x1400868ad
mov ebx, 0x80004005
lea rcx, [rsp + 0x48]
call qword [sym.imp.ole32.dll_PropVariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400868cf
mov qword [rsp + 0x30], r12
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400868e5
mov qword [rsp + 0x38], r12
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400868fb
mov qword [rsp + 0x40], r12
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
nop
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1400a24f0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret