Function at 0x140038170
Capabilities:
Create shortcut via ishelllink
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1da0
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1dd0], rbx
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x1d90], rax
mov rdi, rdx
mov qword [rsp + 0x50], rdx
mov rbp, rcx
mov qword [rsp + 0x20], rdx
lea r9, str.lpszFindRoot_s
lea r8, str.ShortcutUninstallWorker
lea rdx, [0x1400ff6f8]
mov rcx, qword [rcx + 0x178]
call fcn.140080c70
mov edx, 0x410
lea rcx, [rsp + 0x930]
xor esi, esi
lea rax, [rsp + 0x930]
sub rdi, rax
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038214
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038214
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400381f0
jmp 0x140038219
test rdx, rdx
jne 0x140038222
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
test esi, esi
jne 0x140038362
mov edx, 0x410
lea rcx, [rsp + 0x1360]
lea rdi, [rsp + 0x930]
lea rax, [rsp + 0x1360]
sub rdi, rax
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038274
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038274
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038250
jmp 0x140038279
test rdx, rdx
jne 0x140038282
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
test esi, esi
jne 0x140038362
lea rdx, [0x1400fb380]
lea rcx, [rsp + 0x1360]
call fcn.14002ae40
mov edx, 0x410
lea rcx, [rsp + 0x930]
lea rdi, [rsp + 0x1360]
lea rax, [rsp + 0x930]
sub rdi, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x1400382e7
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1400382e7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400382c3
jmp 0x1400382ec
test rdx, rdx
jne 0x1400382f5
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
xor eax, eax
test esi, esi
sete al
test eax, eax
je 0x140038362
mov edx, 0x104
lea rcx, [rsp + 0x1150]
lea rdi, [rsp + 0x930]
lea rax, [rsp + 0x1150]
sub rdi, rax
nop
nop
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140038354
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038354
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038330
jmp 0x140038359
test rdx, rdx
jne 0x14003835d
sub rcx, 2
mov word [rcx], 0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x140038c45
mov rcx, qword [rbp + 0x180]
mov rax, qword [rcx + 0x70]
test rax, rax
je 0x1400383c1
cmp dword [rcx + 0x20], 0x80000000
je 0x1400383c1
mov rdx, qword [rcx + 0x20]
test rdx, rdx
js 0x1400383bb
cmp rdx, qword [rax + 0x10]
jge 0x1400383bb
mov rax, qword [rax + 8]
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x48], rcx
jmp 0x1400383c8
call fcn.1400a0610
int3
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov ebx, dword [rsp + 0x30]
mov dword [rsp + 0x30], ebx
lea rsi, [0x1400fc3b0]
lea rdi, [rsp + 0x9c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x140038c04
lea rsi, [0x1400fc3b4]
lea rdi, [rsp + 0x9c]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140038c04
test byte [rsp + 0x70], 0x10
jne 0x140038a63
mov edx, 0x410
lea rcx, [rsp + 0x930]
xor esi, esi
lea rax, [rsp + 0x930]
mov rdi, qword [rsp + 0x50]
sub rdi, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038458
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038458
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038434
jmp 0x14003845d
test rdx, rdx
jne 0x140038466
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
test esi, esi
jne 0x1400385a4
mov edx, 0x410
lea rcx, [rsp + 0x1360]
lea rdi, [rsp + 0x930]
lea rax, [rsp + 0x1360]
sub rdi, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x1400384b7
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1400384b7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038493
jmp 0x1400384bc
test rdx, rdx
jne 0x1400384c5
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
test esi, esi
jne 0x1400385a4
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x1360]
call fcn.14002ae40
mov edx, 0x410
lea rcx, [rsp + 0x930]
lea rdi, [rsp + 0x1360]
lea rax, [rsp + 0x930]
sub rdi, rax
nop
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038534
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038534
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038510
jmp 0x140038539
test rdx, rdx
jne 0x140038542
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
xor eax, eax
test esi, esi
sete al
test eax, eax
je 0x1400385a4
mov edx, 0x104
lea rcx, [rsp + 0x510]
lea rdi, [rsp + 0x930]
lea rax, [rsp + 0x510]
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140038596
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038596
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038572
jmp 0x14003859b
test rdx, rdx
jne 0x14003859f
sub rcx, 2
mov word [rcx], 0
xor edi, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140038c04
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fa060]
xor edx, edx
lea r8d, [rdi + 1]
lea rcx, [0x1400fa090]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14003866c
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x1400fa0b0]
call qword [rax]
test eax, eax
jne 0x140038661
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x510]
call qword [rax + 0x28]
test eax, eax
jne 0x140038656
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x2c0]
mov r8d, 0x104
lea rdx, [rsp + 0x720]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
sete dil
mov ebx, dword [rsp + 0x2c0]
shr ebx, 4
and ebx, 1
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
je 0x140038c04
xor esi, esi
test ebx, ebx
je 0x1400388a3
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x720]
mov rcx, qword [rbp + 0x188]
call fcn.140012470
test eax, eax
je 0x140038c04
xor ebx, ebx
xor edi, edi
nop
nop
mov rax, qword [rbp + 0x180]
mov rcx, qword [rax + 0x60]
test rcx, rcx
je 0x1400386c6
mov rcx, qword [rcx + 0x10]
jmp 0x1400386c8
xor ecx, ecx
movsxd rax, ebx
cmp rax, rcx
jge 0x14003876a
test esi, esi
jne 0x140038772
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2b3d
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rbp + 0x180]
mov rax, qword [rdx + 0x60]
test rax, rax
je 0x140038724
test rdi, rdi
js 0x14003871f
cmp rdi, qword [rax + 0x10]
jge 0x14003871f
test rdi, rdi
js 0x140038c24
mov rax, qword [rax + 8]
mov r8, qword [rax + rdi*8]
jmp 0x140038727
xor r8d, r8d
jmp 0x140038727
xor r8d, r8d
mov r9d, 0x104
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rbp + 0x188]
call fcn.140013370
lea rdx, [rsp + 0x1b80]
lea rcx, [rsp + 0x720]
call fcn.1400cdd20
xor esi, esi
test eax, eax
sete sil
add ebx, 1
add rdi, 1
jmp 0x1400386b0
test esi, esi
je 0x140038c04
mov r8d, 1
lea rdx, [rsp + 0x510]
mov rcx, qword [rbp + 0x188]
call fcn.140011b70
cmp eax, 0x80000000
je 0x140038c04
mov rsi, qword [rbp + 0x180]
cmp qword [rsi + 0x60], 0
jne 0x1400387e8
mov ecx, 0x30
call fcn.140091360
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400387e2
mov rcx, rax
call fcn.1400aa430
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rdi], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rdi + 0x28], rax
jmp 0x1400387e4
xor edi, edi
mov qword [rsi + 0x60], rdi
mov rbx, qword [rsi + 0x60]
xor esi, esi
xor edi, edi
mov rax, qword [rbx + 0x10]
test rax, rax
jle 0x140038852
nop
nop
test esi, esi
jne 0x140038c04
test rdi, rdi
js 0x140038825
cmp rdi, rax
jge 0x140038825
test rdi, rdi
js 0x140038c2a
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rdi*8]
jmp 0x140038827
xor ecx, ecx
lea rdx, [rsp + 0x510]
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove esi, eax
add rdi, rax
mov rax, qword [rbx + 0x10]
cmp rdi, rax
jl 0x140038800
test esi, esi
jne 0x140038c04
mov ecx, 0x3fffffff
lea rax, [rsp + 0x510]
nop
cmp word [rax], 0
je 0x140038875
add rax, 2
sub rcx, 1
jne 0x140038860
jmp 0x140038c04
test rcx, rcx
je 0x140038c04
mov r8d, 0x3fffffff
sub r8, rcx
add r8, r8
add r8, 2
lea rdx, [rsp + 0x510]
mov rcx, rbx
call fcn.14005c920
jmp 0x140038c04
mov rax, qword [rbp + 0x180]
mov rbx, qword [rax + 0x60]
test rbx, rbx
je 0x140038913
xor edi, edi
mov rax, qword [rbx + 0x10]
test rax, rax
jle 0x140038913
nop
test esi, esi
jne 0x140038939
test rdi, rdi
js 0x1400388ea
cmp rdi, rax
jge 0x1400388ea
test rdi, rdi
js 0x140038c30
cmp rdi, rax
jge 0x140038c30
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rdi*8]
jmp 0x1400388ec
xor ecx, ecx
lea rdx, [rsp + 0x720]
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove esi, eax
add rdi, rax
mov rax, qword [rbx + 0x10]
cmp rdi, rax
jl 0x1400388c0
test esi, esi
jne 0x140038939
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140038c04
lea rdx, [rsp + 0x720]
mov rcx, rax
call fcn.140048800
test eax, eax
je 0x140038c04
mov r8d, 1
lea rdx, [rsp + 0x510]
mov rcx, qword [rbp + 0x188]
call fcn.140011b70
cmp eax, 0x80000000
je 0x140038c04
mov rsi, qword [rbp + 0x180]
cmp qword [rsi + 0x60], 0
jne 0x1400389af
mov ecx, 0x30
call fcn.140091360
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400389a9
mov rcx, rax
call fcn.1400aa430
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rdi], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rdi + 0x28], rax
jmp 0x1400389ab
xor edi, edi
mov qword [rsi + 0x60], rdi
mov rbx, qword [rsi + 0x60]
xor esi, esi
xor edi, edi
mov rax, qword [rbx + 0x10]
test rax, rax
jle 0x140038a12
test esi, esi
jne 0x140038c04
test rdi, rdi
js 0x1400389e5
cmp rdi, rax
jge 0x1400389e5
test rdi, rdi
js 0x140038c36
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rdi*8]
jmp 0x1400389e7
xor ecx, ecx
lea rdx, [rsp + 0x510]
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove esi, eax
add rdi, rax
mov rax, qword [rbx + 0x10]
cmp rdi, rax
jl 0x1400389c0
test esi, esi
jne 0x140038c04
mov ecx, 0x3fffffff
lea rax, [rsp + 0x510]
nop
cmp word [rax], 0
je 0x140038a35
add rax, 2
sub rcx, 1
jne 0x140038a20
jmp 0x140038c04
test rcx, rcx
je 0x140038c04
mov r8d, 0x3fffffff
sub r8, rcx
add r8, r8
add r8, 2
lea rdx, [rsp + 0x510]
mov rcx, rbx
call fcn.14005c920
jmp 0x140038c04
mov edx, 0x410
lea rcx, [rsp + 0x930]
xor esi, esi
lea rax, [rsp + 0x930]
mov rdi, qword [rsp + 0x50]
sub rdi, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038aa6
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038aa6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038a82
jmp 0x140038aab
test rdx, rdx
jne 0x140038ab4
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
test esi, esi
jne 0x140038bf4
mov edx, 0x410
lea rcx, [rsp + 0x1360]
lea rdi, [rsp + 0x930]
lea rax, [rsp + 0x1360]
sub rdi, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038b05
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038b05
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038ae1
jmp 0x140038b0a
test rdx, rdx
jne 0x140038b13
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
test esi, esi
jne 0x140038bf4
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x1360]
call fcn.14002ae40
mov edx, 0x410
lea rcx, [rsp + 0x930]
lea rdi, [rsp + 0x1360]
lea rax, [rsp + 0x930]
sub rdi, rax
nop
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140038b84
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038b84
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038b60
jmp 0x140038b89
test rdx, rdx
jne 0x140038b92
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], 0
xor eax, eax
test esi, esi
sete al
test eax, eax
je 0x140038bf4
mov edx, 0x104
lea rcx, [rsp + 0x510]
lea rdi, [rsp + 0x930]
lea rax, [rsp + 0x510]
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140038be6
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140038be6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140038bc2
jmp 0x140038beb
test rdx, rdx
jne 0x140038bef
sub rcx, 2
mov word [rcx], 0
lea rdx, [rsp + 0x510]
mov rcx, rbp
call fcn.140038170
lea rdx, [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140038c3c
mov ebx, dword [rsp + 0x30]
jmp 0x1400383d0
call fcn.1400a0610
int3
call fcn.1400a0610
int3
call fcn.1400a0610
int3
call fcn.1400a0610
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x1d90]
xor rcx, rsp
call fcn.1400cd6e0
mov rbx, qword [rsp + 0x1dd0]
add rsp, 0x1da0
pop rdi
pop rsi
pop rbp
ret