Function at 0x14010c5e0
Capabilities:
Create process on windows
Get file system object information

Disassembly:
mov qword [rsp + 0x18], r8
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0x298
mov byte [rsp + 0x30], 0x35
mov dword [rsp + 0x3c], 0x7fd25c0
movsx eax, byte [rsp + 0x30]
sub eax, 0x6f
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x94], al
cmp byte [rsp + 0x94], 0x44
je 0x14010c627
jmp 0x14010c683
mov ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0x4c428162
je 0x14010c64d
jmp 0x14010c65b
movsx eax, byte [rsp + 0x30]
add eax, 0x22
mov byte [rsp + 0x30], al
jmp 0x14010c681
mov word [rsp + 0x20], 0x39
mov r9d, 0xa6
movzx r8d, word [rsp + 0x2a0]
movzx edx, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x30]
call fcn.14010b490
nop
jmp 0x14010c6f0
cmp dword [rsp + 0x3c], 0x1c648b38
je 0x14010c6d3
mov eax, 0x225
mov word [rsp + 0x34], ax
mov byte [rsp + 0x31], 0x1b
movzx eax, word [rsp + 0x2a0]
mov word [rsp + 0x38], ax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x32], al
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x31]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x31]
mov qword [rsp + 0x50], rax
jmp 0x14010c6f0
mov r8d, SHGetNewLinkInfoA
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x31]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0xd8], rax
movabs rax, 0xb36d35d06d5945c9
cmp qword [rsp + 0xd8], rax
je 0x14010c716
jmp 0x14010c734
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0xa0]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x50]
mov byte [rcx], al
jmp 0x14010c85b
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0x225
je 0x14010c752
jmp 0x14010c849
mov dword [rsp + 0x40], 0xe6156cee
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x14010c792
movabs rax, 0x7a019a52e2cc5ef
cmp qword [rsp + 0xa8], rax
je 0x14010c816
jmp 0x14010c847
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 0x1b
je 0x14010c7b8
cmp byte [rsp + 0x60], 0x21
je 0x14010c801
jmp 0x14010c814
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x2646
je 0x14010c7d7
cmp dword [rsp + 0x64], 0x7b8e
je 0x14010c7f3
jmp 0x14010c7ff
mov r9d, dword [rsp + 0x40]
movzx r8d, byte [rsp + 0x30]
mov edx, dword [rsp + 0x40]
movzx ecx, word [rsp + 0x38]
call fcn.14010b860
nop
jmp 0x14010c7ff
movsx eax, byte [rsp + 0x32]
shl eax, 7
mov byte [rsp + 0x30], al
jmp 0x14010c814
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x44]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
jmp 0x14010c847
mov r9d, ILFindLastID
movzx r8d, word [rsp + 0x34]
movzx edx, word [rsp + 0x34]
mov ecx, dword [rsp + 0x40]
call fcn.14010c2d0
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0xd4], eax
jmp 0x14010c85b
movabs rax, 0xcf948270236ff6f7
mov qword [rsp + 0x2b0], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x31]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x44]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
cmp eax, dword [rcx]
je 0x14010c934
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x531898f3
je 0x14010c8c7
cmp dword [rsp + 0x68], 0xc533fe4c
je 0x14010c8b3
jmp 0x14010c927
movabs rax, 0xe185b41ba12199f5
mov qword [rsp + 0x2b0], rax
jmp 0x14010c927
mov dword [rsp + 0x28], 0x62
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov qword [rsp + 0xf8], rax
mov r9d, dword [rsp + 0x40]
movzx r8d, byte [rsp + 0x32]
mov edx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movzx ecx, word [rax]
call fcn.14010b860
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc0], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0xd0], eax
movzx eax, word [rsp + 0x38]
movzx ecx, word [rsp + 0x2a0]
sub eax, ecx
movzx ecx, word [rsp + 0x2a8]
mov rdx, qword [rsp + 0x48]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x14010cb59
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x9235c63b
je 0x14010c993
cmp dword [rsp + 0x6c], 0xe6156cee
je 0x14010ca33
jmp 0x14010caa2
movsx eax, byte [rsp + 0x32]
sub eax, 0x75
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x58]
movzx ecx, word [rax]
call fcn.14010b2e0
mov dword [rsp + 0x28], 0x20
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x98]
mov byte [rcx], al
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov word [rsp + 0x2a0], ax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x3c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
jmp 0x14010caa2
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x4f98fd12
je 0x14010ca4d
jmp 0x14010caa2
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x98]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x50]
mov byte [rcx], al
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x98]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x31], al
movzx eax, word [rsp + 0x38]
movzx ecx, word [rsp + 0x2a0]
shl eax, cl
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
movsx eax, byte [rsp + 0x30]
and eax, 0x15
mov byte [rsp + 0x32], al
movabs rax, 0xd05c080773844f2e
cmp qword [rsp + 0x2b0], rax
jbe 0x14010cb59
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0xd24
je 0x14010cad8
jmp 0x14010cb29
mov rax, qword [rsp + 0x58]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x34]
add eax, ecx
mov rcx, qword [rsp + 0x58]
mov word [rcx], ax
lea rcx, [rsp + 0x34]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0xcc], eax
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax]
sub eax, 0x268f0454
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
jmp 0x14010cb59
mov dword [rsp + 0x20], 0x7f
mov r9d, 0x59
lea r8, [rsp + 0x120]
mov edx, PathYetAnotherMakeUniqueName
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [rsp + 0xc8], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
call fcn.14010bb20
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38]
and eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x1819
je 0x14010cbd5
cmp dword [rsp + 0x70], 0x6ea8
je 0x14010cb9f
jmp 0x14010cbec
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x31], al
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0x110], rax
jmp 0x14010cbec
mov rax, qword [rsp + 0x58]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x34]
add eax, ecx
mov rcx, qword [rsp + 0x58]
mov word [rcx], ax
mov eax, reloc.SHELL32.dll_ILCloneFirst
add rsp, 0x298
ret