Function at 0x413ac3
Capabilities:
Contain obfuscated stackstrings
Create shortcut via ishelllink
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0x10]
push str..url
push edi
mov dword [ebp - 0xa0], eax
call fcn.004bbdc3
pop ecx
xor esi, esi
pop ecx
test eax, eax
je 0x413c3c
mov dword [ebp - 0x76], 0x4242424e
mov ecx, esi
mov dword [ebp - 0x7a], 0x424d425f
mov dword [ebp - 0x7e], 0x424e4250
mov dword [ebp - 0x82], 0x4253425a
mov dword [ebp - 0x86], 0x426f424e
mov dword [ebp - 0x8a], 0x425d4254
mov dword [ebp - 0x8e], 0x4250425d
mov dword [ebp - 0x92], 0x424e4254
mov word [ebp - 0x94], 0x4279
mov al, byte [ebp + ecx - 0x94]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x94], al
inc ecx
cmp ecx, 0x22
jl 0x413b5a
push edi
push ebx
push 0x4ff950
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, dword [ebp - 0xa0]
push ebx
push dword [ebp - 0xa4]
call fcn.004bbc55
pop ecx
pop ecx
test eax, eax
je 0x413cf8
mov dword [ebp - 0x40], 0x4242424a
mov ecx, esi
mov dword [ebp - 0x44], 0x425d425e
mov dword [ebp - 0x48], 0x42544279
mov dword [ebp - 0x4c], 0x42544253
mov dword [ebp - 0x50], 0x425f4279
mov al, byte [ebp + ecx - 0x50]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 0x14
jl 0x413bc7
push edi
push 0x4ff958
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x1a], 0x4242425d
mov dword [ebp - 0x1e], 0x42564259
mov dword [ebp - 0x22], 0x427c4254
mov dword [ebp - 0x26], 0x4253425f
mov word [ebp - 0x28], 0x4279
mov al, byte [ebp + esi - 0x28]
sub al, 3
xor al, 0x3f
mov byte [ebp + esi - 0x28], al
inc esi
cmp esi, 0x12
jl 0x413c12
push edi
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x413cf8
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], esi
push eax
push 0x4f77f0
push 1
push esi
push 0x4f7800
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x413cfa
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x413cfa
push dword [ebp - 0xa4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x50]
test ebx, ebx
je 0x413c8f
mov eax, dword [ebp - 0x98]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x98]
mov ebx, dword [ebp - 0xa0]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x98]
push esi
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x9c]
push edx
mov dword [ebp - 0x9c], esi
push 0x4f7810
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x413cec
mov eax, dword [ebp - 0x9c]
push 1
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b923d
mov esp, ebp
pop ebp
ret 0x10