Function at 0x403e00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x425a3e
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x4321e0]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4321e0]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x288], 0
mov eax, dword [esp + 0x290]
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0xc]
mov esi, eax
jl 0x403e6f
push ecx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x403e92
mov ecx, dword [0x433174]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [esp + 0x1c], ecx
call edi
push esi
mov ebx, eax
lea esi, [esp + 0x1c]
call fcn.004021f0
mov esi, dword [esp + 0x18]
mov byte [esp + 0x288], 1
mov eax, dword [esi - 8]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
je 0x403eb4
push str..
push str..
jmp 0x403ebe
push 0x42c808
push 0x42c808
call edi
mov esi, eax
lea edi, [esp + 0x1c]
call fcn.004067e0
push 0x250
lea edx, [esp + 0x30]
push 0
push edx
call fcn.0041a210
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x24], eax
mov ecx, 0x42c154
lea eax, [esp + 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403f36
test dx, dx
je 0x403f32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403f36
add eax, 4
add ecx, 4
test dx, dx
jne 0x403f10
xor eax, eax
jmp 0x403f3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404326
mov ecx, 0x42c158
lea eax, [esp + 0x58]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403f76
test dx, dx
je 0x403f72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403f76
add eax, 4
add ecx, 4
test dx, dx
jne 0x403f50
xor eax, eax
jmp 0x403f7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404326
mov eax, dword [esp + 0x290]
mov ebp, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
and ebp, 0x10
cmp dword [ecx], 0
mov esi, eax
jl 0x403fa8
push ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x403fc9
mov ecx, dword [0x433174]
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov ebx, eax
lea esi, [esp + 0x18]
call fcn.004021f0
mov esi, dword [esp + 0x14]
mov byte [esp + 0x288], 2
mov eax, dword [esi - 8]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
je 0x403ffa
push 0x42bcd4
push 0x42bcd4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edi, [esp + 0x18]
call fcn.004067e0
lea edx, [esp + 0x58]
push edx
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edi, [esp + 0x18]
call fcn.004067e0
test ebp, ebp
je 0x404067
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], 0
push ecx
lea eax, [edi - 0xc]
mov dword [esp + 0x2c], esp
mov esi, esp
jl 0x404042
push eax
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x24]
call fcn.00403e00
jmp 0x4042fd
mov ecx, dword [0x433174]
push edi
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
mov ebx, eax
call fcn.004021f0
mov ecx, dword [esp + 0x24]
call fcn.00403e00
jmp 0x4042fd
lea edi, [esp + 0x14]
call fcn.00402270
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.USER32.dll_CharLowerW]
cmp dword [edi - 8], 0
jl 0x40409c
push 0x42c160
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x40409c
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4040aa
lea edx, [edi - 0xc]
cmp edx, 0x433164
jmp 0x404305
cmp dword [edi - 8], 0
jl 0x4042fd
push str.desktop_
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x4040d3
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4041c9
cmp dword [edi - 8], 0
jl 0x4042fd
push 0x42c180
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x4040fc
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4041c9
cmp dword [edi - 8], 0
jl 0x4042fd
push str.quick_launch_
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x4042fd
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
je 0x4042fd
cmp dword [edi - 8], 0
jl 0x404163
push str.user_pinned_taskbar_
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x404163
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
je 0x404163
push 1
push 0
push 0
push edi
push str.TaskbarUnpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4042fd
mov ecx, str.user_pinned_startmenu_
lea esi, [esp + 0x14]
call fcn.00406450
cmp eax, 0xffffffff
je 0x40418f
push 1
push 0
push 0
push edi
push str.StartUnpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4042fd
mov ecx, str._f:yLhb
lea esi, [esp + 0x14]
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042fd
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4043bf
push edi
push str.success_to_delete_shortcut_s_r_n
jmp 0x4042f5
push edi
push str.find_lnk_file_at_desktop___s_r_n
call fcn.00402740
add esp, 8
cmp dword [edi - 8], 0
jl 0x40426f
push 0x42c1d0
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x404200
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4042ef
cmp dword [edi - 8], 0
jl 0x40426f
push 0x42c1d8
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x404225
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4042ef
cmp dword [edi - 8], 0
jl 0x40426f
push 0x42c1e0
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x40424a
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4042ef
cmp dword [edi - 8], 0
jl 0x40426f
push 0x42c1e8
push edi
call fcn.00418298
add esp, 8
test eax, eax
je 0x40426f
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, 0x42c1f0
lea esi, [esp + 0x14]
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, 0x42c1f8
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, 0x42c200
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, str.qq.lnk
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, 0x42c21c
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, str.excel
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, str.word
call fcn.00406450
cmp eax, 0xffffffff
jne 0x4042ef
mov ecx, str.internet_explorer.lnk
call fcn.00406450
cmp eax, 0xffffffff
je 0x4041a6
push edi
push str.file_s_is_valid_lnk_r_n
call fcn.00402740
add esp, 8
lea eax, [edi - 0xc]
cmp eax, 0x433164
mov byte [esp + 0x288], 1
je 0x404326
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x404326
push edi
call fcn.00417bee
add esp, 4
cmp dword [esp + 0x24], 0
jne 0x403ef3
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x18]
lea edx, [esi - 0xc]
cmp edx, 0x433164
je 0x404362
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x404362
push esi
call fcn.00417bee
add esp, 4
mov eax, dword [esp + 0x290]
lea ecx, [eax - 0xc]
cmp ecx, 0x433164
je 0x404395
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x404395
mov edx, dword [esp + 0x290]
add edx, 0xfffffff4
push edx
call fcn.00417bee
add esp, 4
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.004178c7
add esp, 0x278
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.fail_to_delete_shortcut_s_err_code_d_r_n
call fcn.00402740
add esp, 0xc
jmp 0x4042fd