Function at 0x14004a040
Capabilities:
Create shortcut via ishelllink
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x730]
sub rsp, 0x830
mov rax, qword [0x14012d228]
xor rax, rsp
mov qword [rbp + 0x720], rax
xor r13d, r13d
mov dword [rsp + 0x40], r13d
call fcn.14000c6e0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
test eax, eax
jns 0x14004a163
mov edx, dword [0x140132b68]
mov ecx, dword [0x140132b64]
add edx, ecx
je 0x14004a11c
lfence
mov dword [rsp + 0x58], r13d
call fcn.14000c6e0
mov qword [rsp + 0x50], rax
lock inc dword [rsp + 0x58]
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x14004a0df
call fcn.14000c6e0
mov qword [rsp + 0x50], rax
lock inc dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov dword [rbp - 0x50], 4
mov dword [rsp + 0x30], ebx
lea rax, str.CoInitialize_failed_hr_8.8x
mov qword [rsp + 0x28], rax
lea rax, str.migrate::MigrateShortcut32to64
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x50]
movsx edx, r13w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x40]
test al, 1
je 0x14004b1fa
and eax, 0xfffffffe
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x50], r13
mov eax, 0xffffffff
lock xadd dword [rsp + 0x58], eax
cmp eax, 1
js 0x14004a159
call fcn.14000efb0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x58], eax
cmp eax, 1
jns 0x14004a144
lock inc dword [rsp + 0x58]
jmp 0x14004b1fa
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
lfence
mov ecx, 0x60
call fcn.14005af10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
lfence
mov ecx, 0x60
call fcn.14005af10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x78], r13
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400fbea0]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov edi, eax
movabs r15, 0x7ffffffffffffffe
movabs r12, 0x7fffffffffffffff
test eax, eax
js 0x14004aa94
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x14004aa94
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004a202
test rax, rax
jne 0x14004a2df
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14004a293
mov dword [rsp + 0x68], r13d
call fcn.14000c6e0
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov dword [rsp + 0x40], 4
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14004a25a
call fcn.14000c6e0
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov dword [rbp - 0x4c], 4
lea rax, str.pszCommonPrograms_is_empty
mov qword [rsp + 0x28], rax
lea rax, str.migrate::MigrateShortcut32to64
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x4c]
movsx edx, r13w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x40]
test al, 4
je 0x14004ab5a
and eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x60], r13
mov eax, 0xffffffff
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
js 0x14004a2d5
nop dword [rax + rax]
call fcn.14000efb0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
jns 0x14004a2c0
lock inc dword [rsp + 0x68]
jmp 0x14004ab5a
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0xb0]
call fcn.1400bb2f0
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x14004a310
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.140004260
nop
mov rdx, qword [rbp - 0x28]
test rdx, rdx
jne 0x14004a37a
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14004ab5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a370
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b236
call fcn.14005a920
jmp 0x14004ab5a
lea rax, [rbp - 0x38]
mov r9, qword [rbp - 0x38]
mov r8, qword [rbp - 0x20]
cmp r8, 8
cmovae rax, r9
mov r10d, 0x5c
cmp word [rax + rdx*2 - 2], r10w
je 0x14004a3f7
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x14004a3c8
lea rcx, [rdx + 1]
mov qword [rbp - 0x28], rcx
lea rax, [rbp - 0x38]
cmp r8, 8
cmovae rax, r9
mov word [rax + rdx*2], r10w
mov word [rax + rcx*2], r13w
jmp 0x14004a3eb
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1400f33c0]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x38]
call fcn.140006700
mov r9, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
mov rax, r8
sub rax, rdx
mov r10d, 0x2a
cmp rax, 1
jb 0x14004a429
lea rcx, [rdx + 1]
mov qword [rbp - 0x28], rcx
lea rax, [rbp - 0x38]
cmp r8, 8
cmovae rax, r9
mov word [rax + rdx*2], r10w
mov word [rax + rcx*2], r13w
jmp 0x14004a44c
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1400f33c8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x38]
call fcn.140006700
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004a603
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r13w
mov rdx, qword [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14004a4a0
lea rcx, [rbp + 0x68]
call fcn.140004260
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
mov r8b, 1
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x68]
call fcn.14004b270
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x14004a519
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a514
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b248
call fcn.14005a920
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14004a5fa
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r13w
mov rdx, qword [rbp - 0x78]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14004a560
lea rcx, [rbp + 0x88]
call fcn.140004260
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
mov r8b, 1
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x88]
call fcn.14004b270
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x14004a5e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a5dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b248
call fcn.14005a920
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14004a531
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rbp - 0x70]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14004aa38
lea rsi, [rbx + 0x20]
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
mov rdi, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14004a631
mov rsi, qword [rsi]
cmp rdi, 8
jae 0x14004a648
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x20], 7
jmp 0x14004a689
mov r14, rdi
or r14, 7
cmp r14, r15
cmova r14, r15
lea rcx, [r14 + 1]
cmp rcx, r12
ja 0x14004b24e
lfence
add rcx, rcx
call fcn.140004450
mov qword [rbp + 8], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400bac40
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x18], rdi
test rdi, rdi
je 0x14004a961
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0xb0]
call fcn.1400bb2f0
lea r12, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae r12, qword [rbp + 8]
mov r15, qword [rbp - 0x20]
cmp rdi, r15
ja 0x14004a6f1
lea rsi, [rbp - 0x38]
cmp r15, 8
cmovae rsi, qword [rbp - 0x38]
mov qword [rbp - 0x28], rdi
add rdi, rdi
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.1400bac40
mov word [rsi + rdi], r13w
mov rsi, qword [rbp - 0x38]
jmp 0x14004a7d0
movabs rdx, 0x7ffffffffffffffe
cmp rdi, rdx
ja 0x14004b242
mov r14, rdi
or r14, 7
cmp r14, rdx
jbe 0x14004a71f
mov r14, rdx
movabs rcx, 0x7fffffffffffffff
jmp 0x14004a761
mov rcx, r15
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r15, rax
jbe 0x14004a73f
mov r14, rdx
movabs rcx, 0x7fffffffffffffff
jmp 0x14004a761
lea rax, [r15 + rcx]
cmp r14, rax
cmovb r14, rax
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14004b23c
lfence
add rcx, rcx
call fcn.140004450
mov rsi, rax
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], r14
add rdi, rdi
mov r8, rdi
mov rdx, r12
mov rcx, rax
call fcn.1400bac40
mov word [rsi + rdi], r13w
cmp r15, 8
jb 0x14004a7cc
lea rdx, [r15*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a7c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b230
lfence
call fcn.14005a920
mov qword [rbp - 0x38], rsi
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14004a9f8
lea rax, [rbp - 0x38]
mov r8, qword [rbp - 0x20]
cmp r8, 8
cmovae rax, rsi
cmp word [rax + rdx*2 - 2], 0x5c
je 0x14004a856
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x14004a827
lea rcx, [rdx + 1]
mov qword [rbp - 0x28], rcx
lea rax, [rbp - 0x38]
cmp r8, 8
cmovae rax, rsi
mov r8d, 0x5c
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r13w
jmp 0x14004a84a
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1400f33c0]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x38]
call fcn.140006700
mov rsi, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x14004a888
lea rcx, [rdx + 1]
mov qword [rbp - 0x28], rcx
lea rax, [rbp - 0x38]
cmp r8, 8
cmovae rax, rsi
mov r8d, 0x2a
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r13w
jmp 0x14004a8ab
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1400f33c8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x38]
call fcn.140006700
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004a94d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 8]
call fcn.14004b270
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14004a944
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 8]
call fcn.14004b270
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14004a910
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
movabs r12, 0x7fffffffffffffff
movabs r15, 0x7ffffffffffffffe
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x14004a9a1
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a99c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b248
call fcn.14005a920
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14004a9d4
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14004a9c8
cmp rbx, qword [rax + 0x10]
jne 0x14004a9c8
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14004a9b5
mov rbx, rax
cmp rax, qword [rbp - 0x70]
jmp 0x14004a60d
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14004a9ef
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14004a9e0
cmp rbx, qword [rbp - 0x70]
jmp 0x14004a60d
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x14004aa3c
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004aa33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b248
call fcn.14005a920
mov rsi, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14004aa7b
lea rdx, [rdx*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14004aa73
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b236
mov rcx, rsi
call fcn.14005a920
movabs r15, 0x7ffffffffffffffe
movabs r12, 0x7fffffffffffffff
jmp 0x14004ab5a
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14004ab16
mov dword [rsp + 0x78], r13d
call fcn.14000c6e0
mov qword [rsp + 0x70], rax
lock inc dword [rsp + 0x78]
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x14004aad9
call fcn.14000c6e0
mov qword [rsp + 0x70], rax
lock inc dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov dword [rbp - 0x48], 4
mov dword [rsp + 0x30], edi
lea rax, str.SHGetKnownFolderPath_failed_hr_8.8x
mov qword [rsp + 0x28], rax
lea rax, str.migrate::MigrateShortcut32to64
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x48]
movsx edx, r13w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x40]
test al, 2
je 0x14004ab5a
and eax, 0xfffffffd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x70], r13
mov eax, 0xffffffff
lock xadd dword [rsp + 0x78], eax
cmp eax, 1
js 0x14004ab55
nop word [rax + rax]
call fcn.14000efb0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x78], eax
cmp eax, 1
jns 0x14004ab40
lock inc dword [rsp + 0x78]
mov rax, qword [rbp - 0x60]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14004b128
lea rsi, [rbx + 0x20]
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r14, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14004ab88
mov rsi, qword [rsi]
cmp r14, 8
jae 0x14004ab9c
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x28], xmm0
mov edi, 7
jmp 0x14004abd9
mov rdi, r14
or rdi, 7
cmp rdi, r15
cmova rdi, r15
lea rcx, [rdi + 1]
cmp rcx, r12
ja 0x14004b22a
lfence
add rcx, rcx
call fcn.140004450
mov qword [rbp + 0x28], rax
lea r8, [r14*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400bac40
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x38], r14
test r14, r14
je 0x14004b08d
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fbeb0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400fbf50]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14004b076
mov qword [rbp - 0x80], r13
mov rax, qword [rcx]
lea r8, [rbp - 0x80]
lea rdx, [0x1400f8bd0]
mov rax, qword [rax]
call qword [case.0x140029715.0]
mov rcx, qword [rbp - 0x80]
test eax, eax
cmovs rcx, r13
mov qword [rbp - 0x80], rcx
test rcx, rcx
je 0x14004b05e
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rdx, qword [rbp + 0x28]
xor r8d, r8d
mov rax, qword [rax + 0x28]
call qword [case.0x140029715.0]
test eax, eax
js 0x14004b05a
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 0x21]
mov rax, qword [rax + 0x98]
call qword [case.0x140029715.0]
test eax, eax
js 0x14004b05a
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x300]
call fcn.1400bb2f0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x300]
mov rax, qword [rax + 0x18]
call qword [case.0x140029715.0]
test eax, eax
js 0x14004b05a
lea rcx, [rbp + 0x300]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004acf0
test rax, rax
je 0x14004b05a
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.1400bfac0
lea rcx, [rbp + 0x300]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004ad22
cmp rax, 0x13
jbe 0x14004b05a
lea r14, [rax*2 - 0x26]
lea rdi, [rbp + 0x300]
add rdi, r14
lea rdx, str._antispam32obk.exe
mov rcx, rdi
call fcn.1400bff60
test eax, eax
jne 0x14004b05a
mov word [rdi], r13w
mov qword [rbp - 0x18], r13
mov qword [rbp - 8], r13
mov qword [rbp], 7
mov word [rbp - 0x18], r13w
lea rax, [rbp + 0x300]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ad90
lea rdx, [rbp + 0x300]
lea rcx, [rbp - 0x18]
call fcn.140004260
nop
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
lea rax, [rbp + 0x300]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14004add0
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x48]
call fcn.140004260
nop
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x14004ae32
lea rsi, [rcx + 8]
mov qword [rbp - 8], rsi
lea rdi, [rbp - 0x18]
cmp rdx, 8
cmovae rdi, qword [rbp - 0x18]
lea rcx, [rdi + rcx*2]
mov r8d, 0x10
lea rdx, str.OBK.exe
call fcn.1400bac40
mov word [rdi + rsi*2], r13w
jmp 0x14004ae55
lfence
mov qword [rsp + 0x20], 8
lea r9, str.OBK.exe
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x18]
call fcn.140006700
mov rsi, r13
mov qword [rbp - 0x40], r13
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x140029715.0]
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x14004af0b
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x510]
call fcn.1400bb2f0
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x510]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListEx]
test eax, eax
je 0x14004af01
lea rcx, [rbp + 0x510]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14004aec0
cmp rax, 0x13
jbe 0x14004af01
lea rcx, [rbp + 0x510]
add rcx, r14
lea rdx, str._antispam32obk.exe
call fcn.1400bff60
test eax, eax
jne 0x14004af01
lea rcx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rcx, qword [rbp - 0x18]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rsi, rax
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0xa0]
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
call qword [case.0x140029715.0]
test eax, eax
js 0x14004af9e
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae rdx, qword [rbp + 0x48]
mov rax, qword [rax + 0x48]
call qword [case.0x140029715.0]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
mov r8d, 0xffffff9c
mov rax, qword [rax + 0x88]
call qword [case.0x140029715.0]
test rsi, rsi
je 0x14004af9e
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x140029715.0]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rdx, qword [rbp + 0x28]
mov r8d, 1
mov rax, qword [rax + 0x30]
call qword [case.0x140029715.0]
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x14004b004
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004afff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b254
call fcn.14005a920
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14004b055
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b050
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b25a
call fcn.14005a920
mov word [rbp - 0x18], r13w
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14004b071
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140029715.0]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14004b089
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140029715.0]
nop
mov rdi, qword [rbp + 0x40]
cmp rdi, 8
jb 0x14004b0c9
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b0c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b260
call fcn.14005a920
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14004b0ff
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14004b0f3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x14004b0f3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14004b0e0
mov rbx, rax
cmp rax, qword [rbp - 0x60]
jmp 0x14004ab64
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14004b11f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14004b110
cmp rbx, qword [rbp - 0x60]
jmp 0x14004ab64
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14004b137
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.14000efb0
nop
mov rcx, qword [rbp - 0x70]
mov rsi, qword [rcx + 8]
cmp byte [rsi + 0x19], 0
jne 0x14004b191
mov r8, qword [rsi + 0x10]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.140049c80
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rdi + 0x40]
call fcn.1400040a0
lea rcx, [rdi + 0x20]
call fcn.1400040a0
mov edx, 0x60
mov rcx, rdi
call fcn.14005a920
cmp byte [rsi + 0x19], 0
je 0x14004b151
mov rcx, qword [rbp - 0x70]
mov edx, 0x60
call fcn.14005a920
nop
mov rcx, qword [rbp - 0x60]
mov rsi, qword [rcx + 8]
cmp byte [rsi + 0x19], 0
jne 0x14004b1f0
nop word [rax + rax]
mov r8, qword [rsi + 0x10]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.140049c80
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rdi + 0x40]
call fcn.1400040a0
lea rcx, [rdi + 0x20]
call fcn.1400040a0
mov edx, 0x60
mov rcx, rdi
call fcn.14005a920
cmp byte [rsi + 0x19], 0
je 0x14004b1b0
mov rcx, qword [rbp - 0x60]
mov edx, 0x60
call fcn.14005a920
mov rcx, qword [rbp + 0x720]
xor rcx, rsp
call fcn.14005aef0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001ea0
nop
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
nop
call fcn.140001ea0
int3
call fcn.140001f50
nop
call fcn.1400bf5d0
int3
call fcn.140001ea0
nop
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
int3