Function at 0x140013840
Capabilities:
Create shortcut via ishelllink
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x520], rbx
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov r13, rcx
mov rsi, qword [rsp + 0x540]
mov rbx, qword [rsp + 0x548]
xor r12d, r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fa060]
mov r15d, 1
mov r8d, r15d
xor edx, edx
lea rcx, [0x1400fa090]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140013ba9
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x1400fa0b0]
call qword [rax]
test eax, eax
jne 0x140013b9e
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + 0xa0]
test eax, eax
jne 0x140013b93
test rdi, rdi
je 0x140013910
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x58]
test rsi, rsi
je 0x140013923
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x38]
call fcn.14009d5e8
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140013943
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
or rbp, 0xffffffffffffffff
test rbx, rbx
je 0x14001399c
test rbx, 0xffffffffffff0000
jne 0x140013988
movzx edi, bx
mov ecx, edi
call fcn.1400a1868
test rax, rax
je 0x1400139b0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000a990
jmp 0x1400139b0
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14001399f
mov ecx, r12d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003940
nop
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
je 0x140013b46
mov edx, 0x7fffffff
mov rcx, rdx
lea rax, str.progman.exe
nop
cmp word [rax], 0
je 0x1400139e2
add rax, 2
sub rcx, 1
jne 0x1400139d0
jmp 0x1400139f1
test rcx, rcx
je 0x1400139f1
sub rdx, rcx
mov qword [rsp + 0x50], rdx
jmp 0x1400139f9
mov rdx, r12
mov qword [rsp + 0x50], rdx
mov r8d, edx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140015910
lea rdx, str.progman.exe
mov rcx, qword [rax]
call fcn.1400cdd20
test eax, eax
sete dil
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013a40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140013a8c
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x140013a6a
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x2c0]
mov cx, 0x25
call fcn.140014180
mov r9d, 0x104
lea r8, str.progman.exe
lea rdx, [rsp + 0x2c0]
mov rcx, r13
call fcn.140012f30
jmp 0x140013b26
mov edi, r12d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140013b26
nop
nop
test byte [rsp + 0x70], 0x10
cmove edi, r15d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140013acf
test edi, edi
je 0x140013ab0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x140013b26
mov edx, 0x104
lea rcx, [rsp + 0x2c0]
lea rax, [rsp + 0x2c0]
sub rbx, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140013b18
movzx eax, word [rbx + rcx]
test ax, ax
je 0x140013b18
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140013af4
jmp 0x140013b1d
test rdx, rdx
jne 0x140013b21
sub rcx, 2
mov word [rcx], 0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, dword [rsp + 0x550]
lea rdx, [rsp + 0x2c0]
call qword [rax + 0x88]
jmp 0x140013b59
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
test r14, r14
je 0x140013b75
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov r8d, r15d
mov rdx, r14
call qword [rax + 0x30]
test eax, eax
sete r12b
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140013b93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, r12d
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1400cd6e0
mov rbx, qword [rsp + 0x520]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret