Function at 0x1400efbc0
Capabilities:
Empty the recycle bin

Disassembly:
mov word [rsp + 8], cx
sub rsp, 0x158
mov eax, 0xe5
mov word [rsp + 0x30], ax
mov dword [rsp + 0x34], 0x84a4acc9
movzx eax, word [rsp + 0x30]
add eax, 0x246
mov word [rsp + 0x30], ax
cmp dword [rsp + 0x34], 0xfe9197ec
je 0x1400efc5f
lea rax, [rsp + 0x34]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x48], 0x3bc340e3
movzx eax, word [rsp + 0x30]
cmp eax, 0x388
jne 0x1400efc5f
mov eax, dword [rsp + 0x34]
sub eax, 0x5c866d3e
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov dword [rsp + 0x20], SHGetNewLinkInfoW
lea r9, [rsp + 0x9c]
mov r8d, 0x86
mov edx, 0xd9
mov rcx, qword [rsp + 0xe0]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x9c], eax
movzx ecx, word [rsp + 0x30]
call fcn.1400f05b0
nop
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0xa1dcafe7
je 0x1400efc84
cmp dword [rsp + 0x60], 0xd6f56361
je 0x1400efd0d
jmp 0x1400efd8f
mov eax, 0x3ac
mov word [rsp + 0x160], ax
movsx eax, word [rsp + 0x160]
cmp eax, 0x2f1a
jge 0x1400efd08
mov eax, dword [rsp + 0x34]
and eax, 0xa3e13336
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x352c2381
je 0x1400efcce
cmp dword [rsp + 0x64], 0x9894e612
je 0x1400efce0
jmp 0x1400efd08
mov edx, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov ecx, reloc.SHELL32.dll_SHTestTokenMembership
call fcn.1400f0370
nop
jmp 0x1400efd08
mov r9d, 0x4f
mov r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x88], eax
jmp 0x1400efd8f
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0xb36626a3
je 0x1400efd74
cmp dword [rsp + 0x68], 0xfcab1088
je 0x1400efd2e
jmp 0x1400efd8f
mov eax, dword [rsp + 0x34]
or eax, 0x91bb9583
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
movzx eax, word [rsp + 0x30]
shl eax, 5
mov word [rsp + 0x30], ax
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0xc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
jmp 0x1400efd8f
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0xe8], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x3bc340e3
je 0x1400efda6
jmp 0x1400f01cb
movzx eax, word [rsp + 0x30]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x32b
je 0x1400efdcc
cmp dword [rsp + 0x6c], 0xa61
je 0x1400f00d6
jmp 0x1400f015c
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x24fadba2
je 0x1400efdea
cmp dword [rsp + 0x70], 0x5bb73558
je 0x1400efe05
jmp 0x1400efe67
mov eax, dword [rsp + 0x34]
shl eax, 5
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x30]
call fcn.1400f05b0
nop
jmp 0x1400efe67
movzx eax, word [rsp + 0x30]
xor eax, 0xf68
mov word [rsp + 0x30], ax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x73eae31
je 0x1400efe2e
jmp 0x1400efe44
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
jmp 0x1400efe67
lea rcx, [rsp + 0x34]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0xf0], rax
mov edx, PathMakeUniqueName
mov ecx, 0xc1
call fcn.1400f0370
nop
movsx eax, word [rsp + 0x160]
cmp eax, 0x49f9
jle 0x1400eff27
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
movsx eax, word [rsp + 0x160]
sub eax, 0x6999
cmp eax, 0x3bcc
jle 0x1400eff15
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0x4787ca4
je 0x1400efebc
jmp 0x1400eff03
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0xbb
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
sub eax, 0xaf47e278
mov dword [rsp + 0x34], eax
jmp 0x1400eff13
mov edx, SHDoDragDrop
mov ecx, 0xdd
call fcn.1400f0370
nop
jmp 0x1400eff27
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
add eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov byte [rsp + 0x44], 0x72
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
movsx eax, word [rsp + 0x160]
cmp eax, 0x1e21
jg 0x1400f0050
movsx eax, word [rsp + 0x160]
and eax, 0x7463
cmp eax, 0x47af
jl 0x1400effa5
movzx eax, word [rsp + 0x30]
add eax, 0x561
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x4c], al
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0x84a4acc9
je 0x1400effc8
jmp 0x1400f0018
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x20565cc6
je 0x1400f0002
cmp dword [rsp + 0x74], 0x37145f24
je 0x1400effe6
jmp 0x1400f0016
movzx eax, word [rsp + 0x30]
add eax, 0x15b
mov word [rsp + 0x40], ax
movzx ecx, word [rsp + 0x40]
call fcn.1400f05b0
nop
jmp 0x1400f0016
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
jmp 0x1400f0050
mov r9d, SHDoDragDrop
mov r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x88], eax
mov eax, 0x664e
mov word [rsp + 0x160], ax
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0xee7
je 0x1400f006d
jmp 0x1400f00a6
call fcn.1400f0810
mov eax, 0x6340
mov word [rsp + 0x160], ax
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0xd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x34]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0xbc], eax
jmp 0x1400f015c
movzx eax, word [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x55243f87
je 0x1400f014a
cmp dword [rsp + 0x78], 0xaf7998ac
je 0x1400f00f9
jmp 0x1400f015c
mov eax, dword [rsp + 0x34]
sub eax, 0x6d6388c3
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov dword [rsp + 0xc0], eax
mov eax, 0x767
mov word [rsp + 0x160], ax
mov eax, dword [rsp + 0x34]
shr eax, 1
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov edx, 0x25
mov ecx, 0x35
call fcn.1400f0370
nop
jmp 0x1400f015c
lea rcx, [rsp + 0x118]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
add eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov eax, 0x2176
mov word [rsp + 0x160], ax
movzx ecx, word [rsp + 0x160]
call fcn.1400efbc0
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
add eax, 0x7ef13515
mov dword [rsp + 0x34], eax
jmp 0x1400f01fb
mov eax, dword [rsp + 0x48]
and eax, 0x382fc50a
mov dword [rsp + 0x48], eax
mov r8d, 0x62
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0x98], eax
call fcn.1400f0810
mov eax, dword [rsp + 0x34]
xor eax, 0xd069e797
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x48]
add eax, 0x16a5e1f8
mov dword [rsp + 0x48], eax
call fcn.1400f0da0
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov eax, 0x21
add rsp, 0x158
ret