Function at 0x1800261dc
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4b0
mov rax, qword [0x180083330]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15, qword [rbp + 0x408]
lea rcx, [rbp + 0x190]
mov r14, qword [rbp + 0x400]
mov r12, rdx
mov qword [rsp + 0x48], r8
xor esi, esi
mov r8, rdx
mov r13, r9
mov edx, 0x104
mov qword [r15], rsi
call fcn.18000d500
mov ebx, eax
test eax, eax
jns 0x180026266
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x8ef
call fcn.18000a128
test ebx, ebx
js 0x180026653
mov ecx, 0x104
lea rax, [rbp + 0x190]
mov edi, ecx
cmp word [rax], si
je 0x18002628b
add rax, 2
sub rdi, 1
jne 0x18002627c
mov rax, rdi
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rdi, rdi
je 0x1800262b0
mov rsi, rcx
sub rsi, rdi
test rdi, rdi
je 0x1800262b0
add rsi, rsi
jmp 0x1800262b2
xor esi, esi
test rdi, rdi
jne 0x1800262e0
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, ebx
mov edx, 0x8f3
call fcn.18000a128
mov ecx, 0x104
test rdi, rdi
je 0x180026653
xor eax, eax
mov edx, ecx
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
mov rax, rsi
shr rax, 1
cmp eax, ecx
lea rcx, [rbp + 0x190]
movups xmmword [rsp + 0x50], xmm0
cmovb edx, eax
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_CharUpperBuffW]
nop dword [rax + rax]
or r9, 0xffffffffffffffff
lea r10, [rbp + 0x190]
lea rbx, [0x18006f000]
cmp esi, 4
jbe 0x18002639c
lea r11d, [rsi - 5]
shr r11d, 2
inc r11d
movzx eax, byte [r10]
add esi, 0xfffffffc
movzx ecx, r9b
xor rcx, rax
shr r9, 8
mov rdx, qword [rbx + rcx*8]
movzx ecx, byte [r10 + 1]
xor rdx, r9
movzx eax, dl
xor rcx, rax
shr rdx, 8
mov r8, qword [rbx + rcx*8]
movzx ecx, byte [r10 + 2]
xor r8, rdx
movzx eax, r8b
xor rcx, rax
shr r8, 8
mov rdx, qword [rbx + rcx*8]
movzx ecx, byte [r10 + 3]
xor rdx, r8
movzx eax, dl
add r10, 4
xor rcx, rax
shr rdx, 8
mov r9, qword [rbx + rcx*8]
xor r9, rdx
sub r11, 1
jne 0x180026336
test esi, esi
je 0x1800263c1
movzx ecx, byte [r10]
inc r10
movzx eax, r9b
xor rcx, rax
mov rax, r9
shr rax, 8
mov r9, qword [rbx + rcx*8]
xor r9, rax
add esi, 0xffffffff
jne 0x1800263a0
lea r8, str._0I64x
mov edx, Ordinal_24
lea rcx, [rsp + 0x50]
call fcn.18000f09c
xor esi, esi
mov ebx, eax
test eax, eax
jns 0x1800263fa
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x8fb
call fcn.18000a128
test ebx, ebx
js 0x180026653
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x9000
lea rcx, [0x18006da98]
call qword [sym.imp.Windows.Storage.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x180026443
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x8ff
call fcn.18000a128
test ebx, ebx
js 0x180026653
mov r8, qword [rsp + 0x40]
lea r9, [rsp + 0x50]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18002648b
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x903
call fcn.18000a128
test ebx, ebx
js 0x180026642
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x1800264ec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
test ebx, ebx
jns 0x1800264ec
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, ebx
mov edx, 0x909
call fcn.18000a128
mov ecx, 0x80000000
lea eax, [rbx + rcx]
test ecx, eax
jne 0x180026504
cmp ebx, 0x800700b7
jne 0x180026642
movzx edi, word [r14]
lea rcx, [rbp - 0x80]
mov eax, 0x40
mov edx, 0x104
cmp ax, di
jne 0x18002653b
lea r8, [0x180070940]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1800265a9
mov edx, 0x912
jmp 0x180026593
mov r8, r14
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18002656b
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x916
call fcn.18000a128
test ebx, ebx
js 0x180026642
lea r8, str..lnk
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.18000efc4
mov ebx, eax
test eax, eax
jns 0x1800265a9
mov edx, 0x919
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
call fcn.18000a128
test ebx, ebx
js 0x180026642
mov r9, r15
lea r8, [0x18006e950]
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHCreateItemFromParsingName]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1800265ee
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x91f
call fcn.18000a128
test ebx, ebx
jns 0x180026642
mov r9, qword [rsp + 0x48]
lea rdx, [rbp - 0x80]
mov ecx, 0x40
mov qword [rsp + 0x30], r15
cmp cx, di
mov rax, rsi
mov r8, r12
cmove rax, r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call fcn.180025c74
mov ebx, eax
test eax, eax
jns 0x180026642
mov rcx, qword [rbp + 0x3d8]
lea r8, str.pcshell_shell_appresolverlib_appresolver.cpp
mov r9d, eax
mov edx, 0x924
call fcn.18000a128
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.180062960
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret