Function at 0x140025de0
Capabilities:
Check if file exists
Create shortcut via ishelllink
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r13d, r13d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], r13d
cmp r8d, 2
je 0x140025e2e
test byte [rdx + 0xcc], 1
jne 0x140025e2e
xor al, al
jmp 0x140025fed
cmp qword [rcx + 0x18], 8
mov qword [rsp + 0x2e0], r12
jb 0x140025e40
mov rcx, qword [rcx]
mov qword [rsp + 0x298], r14
mov qword [rsp + 0x290], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov rcx, r13
mov qword [rsp + 0x50], r13
setne r12b
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rcx
test esi, esi
je 0x14002600a
dec esi
je 0x140025ebd
dec esi
jne 0x140025f8b
cmp qword [rbx + 0x18], 8
jb 0x140025ea6
mov rcx, qword [rbx]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.140025b80
jmp 0x140026054
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025b80
jmp 0x140026054
cmp qword [rbx + 0x18], 8
jb 0x140025ec9
mov rcx, qword [rbx]
jmp 0x140025ecc
mov rcx, rbx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call fcn.140025b80
cmp qword [rsp + 0x40], r13
je 0x140026054
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140025efb
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r13
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140025f10
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], r13
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x1400c4920]
lea r8d, [rdx + 1]
lea rcx, [0x1400bb7c0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140025f56
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400c48f0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
jns 0x140026054
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140025f6e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140025f8b
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov qword [rsp + 0x38], r13
mov rcx, qword [rsp + 0x30]
xor dil, dil
mov rax, qword [rsp + 0x38]
mov r15, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
mov r12, qword [rsp + 0x2e0]
test rax, rax
je 0x140025fbe
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140025fc9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140025fd9
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140025fe9
mov rdx, qword [rcx]
call qword [rdx + 0x10]
movzx eax, dil
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140091a70
add rsp, 0x2a0
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x1400c4920]
lea r8d, [rdx + 1]
lea rcx, [0x1400bb7c0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140025f56
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400c48f0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140025f56
cmp qword [rsp + 0x38], r13
je 0x140025f86
test byte [rdi + 0xcc], 1
je 0x14002608d
cmp qword [rdi + 0x18], 8
jb 0x140026074
mov rdx, qword [rdi]
jmp 0x140026077
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
js 0x140025f86
test byte [rdi + 0xcc], 2
je 0x1400260b7
cmp qword [rdi + 0x38], 8
lea rdx, [rdi + 0x20]
jb 0x1400260a4
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x140025f86
test byte [rdi + 0xcc], 4
je 0x1400260e2
cmp qword [rdi + 0x58], 8
lea rdx, [rdi + 0x40]
jb 0x1400260ce
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
jns 0x14002612b
jmp 0x140025f86
cmp qword [rsp + 0x40], r13
je 0x14002612b
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], r13w
call fcn.140091cf0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov r8d, 0x104
call qword [rax + 0x50]
test eax, eax
js 0x14002612b
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x58]
test byte [rdi + 0xcc], 8
je 0x140026155
cmp qword [rdi + 0x78], 8
lea rdx, [rdi + 0x60]
jb 0x140026142
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x140025f86
test byte [rdi + 0xcc], 0x10
je 0x14002618c
lea rdx, [rdi + 0x80]
cmp qword [rdx + 0x18], 8
jb 0x14002616f
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rdi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
js 0x140025f86
mov r14d, dword [rdi + 0xcc]
mov r15d, r14d
shr r14d, 6
shr r15d, 5
and r14b, 1
and r15b, 1
jne 0x1400261b1
test r14b, r14b
je 0x14002629f
call fcn.140012cb0
cmp dword [rax], 4
jl 0x14002629f
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [0x1400c4910]
call qword [rax]
test eax, eax
js 0x1400262d5
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140025f86
test r15b, r15b
je 0x14002621b
lea r8, [rdi + 0xa8]
cmp qword [r8 + 0x18], 8
jb 0x140026206
mov r8, qword [r8]
mov rcx, rsi
call fcn.14001f560
test al, al
je 0x1400262d5
mov rsi, qword [rsp + 0x48]
test r14b, r14b
je 0x140026291
movzx eax, byte [rdi + 0xc8]
xor ecx, ecx
lea r8, [rsp + 0x58]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rcx
neg al
sbb ax, ax
mov qword [rsp + 0x68], rcx
mov ecx, ntohl
mov word [rsp + 0x60], ax
mov rax, qword [rsi]
mov word [rsp + 0x58], cx
lea rdx, [0x1400c46e8]
mov rcx, rsi
call qword [rax + 0x30]
test eax, eax
jne 0x140026270
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x38]
test eax, eax
setns dil
cmp word [rsp + 0x58], r13w
je 0x140026287
lea rcx, [rsp + 0x58]
call qword [sym.imp.ole32.dll_PropVariantClear]
test dil, dil
je 0x1400262d5
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x14002629f
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400262b4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x40], r13
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400262c9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x50], r13
cmp qword [rbx + 0x18], 8
jb 0x1400262ee
mov rdx, qword [rbx]
jmp 0x1400262f1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140025f86
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140025f86
mov rdx, rbx
mov rax, qword [rsp + 0x38]
mov r8d, 1
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x30]
mov edi, eax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140026320
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov qword [rsp + 0x38], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140026338
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
mov qword [rsp + 0x30], rcx
test edi, edi
setns dil
test dil, dil
je 0x140025f8e
test r12b, r12b
je 0x140026369
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rcx, qword [rsp + 0x30]
jmp 0x140025f8e
cmp qword [rbx + 0x18], 8
jb 0x140026373
mov rbx, qword [rbx]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 5]
lea ecx, [rdx - 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rcx, qword [rsp + 0x30]
jmp 0x140025f8e