Function at 0x140003ff8
Capabilities:
Create shortcut via ishelllink
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
mov rax, qword [0x140071010]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r15, rcx
xor r13d, r13d
lea rcx, [rbp + 0x10]
call fcn.14000385c
nop
mov rsi, qword [rbp + 0x10]
cmp rsi, qword [rbp + 0x18]
je 0x140004418
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0xfa0
mov dword [rbp - 0x60], 0xf4e79c11
mov dword [rbp - 0x5c], 0x14a2c122
mov dword [rbp - 0x58], 0xf4f39c6b
add r14, rdi
mov r12d, dword [rbp - 0x58]
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.14000c96c
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140004179
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x140015640]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140015660]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140004173
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [0x140015650]
call qword [rax]
test eax, eax
js 0x140004169
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rdx, qword [rbp + 0x28]
xor r8d, r8d
call qword [rax + 0x28]
test eax, eax
js 0x14000415f
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x50]
call qword [rax + 0x18]
test eax, eax
js 0x14000415f
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
lea rax, [rbp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x14000414f
lea rdx, [rbp + 0x50]
jmp 0x14000418f
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
xor r8d, r8d
lea rdx, [0x1400159bc]
lea rcx, [rbp - 0x50]
call fcn.14000e37c
mov rbx, r14
mov ecx, 0x1018
mov eax, dword [rcx + rdi]
test al, 1
jne 0x1400041cd
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 0xc], 0x145
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbx], xmm0
mov dword [rbx + 8], r12d
lea rcx, [0x14001417c]
call fcn.140011540
nop
cmp byte [rbx + 0xd], r13b
je 0x1400041fb
mov rdx, r13
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0x79c3b345918bf945
shr rax, cl
xor byte [rdx + rbx], al
inc rdx
cmp rdx, 0xd
jb 0x1400041d6
mov byte [rbx + 0xd], r13b
or r9, 0xffffffffffffffff
inc r9
cmp byte [rbx + r9], r13b
jne 0x1400041ff
add r9, rbx
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.14000d2f4
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000c800
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c8d4
cmp rbx, 0xffffffffffffffff
je 0x1400043f7
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.14000e37c
nop
lea rcx, [rbp - 0x30]
call fcn.140001e70
mov dword [rbp - 0x68], 0x8c059f6d
mov word [rbp - 0x64], 0x9073
mov edx, 0x49c
mov eax, dword [rdx + rdi]
mov ecx, 0x3c8
test al, 1
jne 0x1400042b8
or eax, 1
mov dword [rdx + rdi], eax
lea rbx, [rdi + rcx]
mov word [rbx + 6], 0x1af
mov eax, dword [rbp - 0x68]
mov dword [rbx], eax
movzx eax, word [rbp - 0x64]
mov word [rbx + 4], ax
lea rcx, [0x14001415c]
call fcn.140011540
nop
jmp 0x1400042bc
lea rbx, [rcx + rdi]
cmp byte [rbx + 7], r13b
je 0x1400042ea
mov rdx, r13
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0x85aff107ed61eb31
shr rax, cl
xor byte [rdx + rbx], al
inc rdx
cmp rdx, 7
jb 0x1400042c5
mov byte [rbx + 7], r13b
or r9, 0xffffffffffffffff
inc r9
cmp byte [rbx + r9], r13b
jne 0x1400042ee
add r9, rbx
mov r8, rbx
lea rdx, [rsp + 0x50]
call fcn.14000d2f4
nop
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.14000c96c
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14000f1d0
nop
lea rcx, [rsp + 0x30]
call fcn.14000c8d4
nop
lea rcx, [rsp + 0x50]
call fcn.14000c8d4
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 1
lea rdx, [0x1400159c8]
lea rcx, [rsp + 0x30]
call fcn.14000e37c
nop
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 2
lea rdx, [0x1400159cc]
lea rcx, [rsp + 0x50]
call fcn.14000e37c
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.1400036f0
nop
lea rcx, [rsp + 0x50]
call fcn.14000c8d4
nop
lea rcx, [rsp + 0x30]
call fcn.14000c8d4
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x1400043e3
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.14000df00
nop
lea rcx, [rbp - 0x10]
call fcn.14000c8d4
nop
lea rcx, [rbp - 0x30]
call fcn.14000c8d4
nop
lea rcx, [rbp - 0x50]
call fcn.14000c8d4
nop
lea rcx, [rbp + 0x28]
call fcn.14000c8d4
add rsi, 0x20
cmp rsi, qword [rbp + 0x18]
jne 0x14000407b
lea rcx, [rbp + 0x10]
call fcn.14000c330
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400110e0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret