Function at 0x14001a2b8
Capabilities:
Create directory
Create process on windows
Create shortcut via ishelllink
Delete directory
Delete file
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xec0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0xec0], rbx
mov rax, qword [0x140048f50]
xor rax, rbp
mov qword [rbp + 0xe60], rax
mov rsi, rcx
mov r13, rdx
lea rcx, [rbp + 0x661]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7ff
mov byte [rbp + 0x660], bl
call fcn.14001e2f0
lea rcx, str.___RunAsDesktopUser:_begin.
call fcn.140019df4
call fcn.140019f64
test eax, eax
jne 0x14001a3bd
lea rcx, str.___RunAsDesktopUser:_running_XP_or_earlier__use_old_method.
call fcn.140019df4
lea r12d, [rbx + 1]
lea r8d, [rbx + 0x18]
lea rcx, [rbp + 0x10]
xor edx, edx
mov dword [rbp], r12d
call fcn.14001e2f0
lea r8d, [rbx + 0x68]
lea rcx, [rbp + 0xa0]
xor edx, edx
call fcn.14001e2f0
lea r11, [rbp + 0x10]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.140014394
test eax, eax
je 0x14001a3b5
mov rcx, qword [rbp + 0x10]
call fcn.140001338
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp]
jmp 0x14001a7b4
test rsi, rsi
jne 0x14001a3ca
lea eax, [rsi + 0x57]
jmp 0x14001a7b4
mov edi, 0x103
lea rcx, [rbp + 0x441]
xor edx, edx
mov r8d, edi
mov byte [rbp + 0x440], bl
call fcn.14001e2f0
lea r12d, [rdi + 1]
lea rcx, [rbp + 0x440]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or r15, 0xffffffffffffffff
lea r8, str.explorer.exe
lea rcx, [rbp + 0x440]
mov r9, r15
mov edx, r12d
call fcn.140021828
lea rcx, [rbp + 0x551]
mov r8d, edi
xor edx, edx
mov byte [rbp + 0x550], bl
call fcn.14001e2f0
lea rcx, [rbp + 0x331]
mov r8d, edi
xor edx, edx
mov byte [rbp + 0x330], bl
call fcn.14001e2f0
lea rcx, [rbp + 0x111]
mov r8d, edi
xor edx, edx
mov byte [rbp + 0x110], bl
call fcn.14001e2f0
lea r11, [rbp + 0x550]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14001a4e7
lea rax, [rbp + 0x550]
lea r9, str._sOracle
lea rcx, [rbp + 0x330]
mov r8, r15
mov edx, r12d
mov qword [rsp + 0x20], rax
call fcn.14001f9bc
lea rcx, [rbp + 0x330]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r11, [rbp + 0x330]
lea r9, str._s_tmpinstall
lea rcx, [rbp + 0x110]
mov r8, r15
mov edx, r12d
mov qword [rsp + 0x20], r11
call fcn.14001f9bc
lea rcx, [rbp + 0x110]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rax, [rbp + 0x110]
lea r9, str._sjavatmp.lnk
lea rcx, [rbp + 0x220]
mov r8, r15
mov rdx, r12
mov r14d, ebx
mov qword [rsp + 0x20], rax
call fcn.14001f9bc
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov r12d, 1
lea rax, [rbp + 8]
lea r9, [0x14003b100]
lea rcx, [0x14003b140]
lea r8d, [r12 + 0x16]
xor edx, edx
mov edi, r12d
mov qword [rbp + 8], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14001a69f
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + RegisterTypeLib]
test eax, eax
je 0x14001a59a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._pJavaShortCutItem__SetPath__s__call_failed___Error_Code:__d_n
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rcx, [rbp + 0x660]
mov r8, r15
mov edx, 0x800
call fcn.14001f9bc
lea rcx, [rbp + 0x660]
jmp 0x14001a68c
mov rcx, qword [rbp + 8]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
je 0x14001a5c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._pJavaShortCutItem__SetArguments__s__call_failed___Error_Code:__d_n
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
jmp 0x14001a57a
mov rcx, qword [rbp + 8]
lea r8, [rbp]
lea rdx, [0x14003b130]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14001a685
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [r12 + rax]
cmp r9d, 0x3fffffff
jg 0x14001a657
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001a612
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14001eda0
sub rsp, rcx
lea rsi, [rsp + 0x50]
test rsi, rsi
je 0x14001a657
mov dword [rsp + 0x28], r9d
xor edx, edx
lea r8, [rbp + 0x220]
lea ecx, [rdx + 3]
mov r9d, r15d
mov word [rsi], bx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rdx, rdx
and rdx, rsi
jmp 0x14001a65a
mov rdx, rbx
mov rcx, qword [rbp]
mov r8d, r12d
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
je 0x14001a679
lea rcx, str.CreateShortCutItem_____pJavaShortCutItemFile__Save_call_failed
call fcn.140019df4
mov edi, ebx
mov rcx, qword [rbp]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x14001a693
lea rcx, str.CreateShortCutItem_____pJavaShortCutItem__QueryInterface_call_failed
call fcn.140019df4
mov edi, ebx
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x14001a6ad
lea rcx, str.CreateShortCutItem_____pJavaShortCutItem.CoCreateInstance_call_failed
call fcn.140019df4
mov edi, ebx
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jne 0x14001a6ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._Failed_to_create_temporary_shortcut___Error_Code:__d_n
lea rcx, [rbp + 0x660]
mov r8, r15
mov edx, 0x800
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.14001f9bc
lea rcx, [rbp + 0x660]
call fcn.140019df4
jmp 0x14001a7b2
mov edi, 0x70
lea rcx, [rbp + 0x30]
xor edx, edx
mov r8d, edi
call fcn.14001e2f0
lea rax, str.open
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x440]
mov dword [rbp + 0x30], edi
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x220]
mov dword [rbp + 0x34], 0x40
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x60], r12d
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edi, eax
test eax, eax
jne 0x14001a775
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.RunAsDesktopUser___ShellExecuteEx_failed___Error_Code:__d_n
lea rcx, [rbp + 0x660]
mov r8, r15
mov edx, 0x800
mov r14d, eax
mov dword [rsp + 0x20], eax
call fcn.14001f9bc
lea rcx, [rbp + 0x660]
call fcn.140019df4
mov rcx, qword [rbp + 0x98]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test edi, edi
cmove ebx, r14d
mov eax, ebx
mov rcx, qword [rbp + 0xe60]
xor rcx, rbp
call fcn.14001eba0
mov rbx, qword [rbp + 0xec0]
lea rsp, [rbp + 0xe70]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret