Function at 0x14002f800
Capabilities:
Accept command line arguments
Check if file exists
Encode data using xor
Generate random numbers using a mersenne twister
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa40
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14012c038]
xor rax, rsp
mov qword [rsp + 0xa38], rax
lea rdx, str.heartbeat
lea r14, [rsp + 0x70]
mov rcx, r14
call fcn.1400c59a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rax
call fcn.1400c59a0
mov rcx, rdi
mov rdx, r14
call fcn.1400317d0
test al, al
jne 0x14002f918
xor ebp, ebp
cmp byte [rsp + 0x67], 0
jns 0x14002f879
mov rcx, qword [rsp + 0x50]
call fcn.1400918a8
cmp byte [rsp + 0x87], 0
jns 0x14002f88d
mov rcx, qword [rsp + 0x70]
call fcn.1400918a8
test bpl, bpl
je 0x14002f8be
movzx eax, byte [rbx + 0x17]
test al, al
js 0x14002f8a1
mov ecx, eax
and ecx, 0x7f
jmp 0x14002f8a5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002f8be
test al, al
jns 0x14002f8b1
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14002f8e4
xor ebx, ebx
mov rcx, qword [rsp + 0xa38]
xor rcx, rsp
call fcn.140092d80
mov eax, ebx
add rsp, 0xa40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
xor ebx, ebx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14002f97a
cmp byte [rsp + 0x67], 0
jns 0x14002f8c0
mov rcx, qword [rsp + 0x50]
call fcn.1400918a8
jmp 0x14002f8c0
lea rdx, str.create_profile
lea r14, [rsp + 0x38]
mov rcx, r14
call fcn.1400c59a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rax
call fcn.1400c59a0
mov rcx, r15
mov rdx, r14
call fcn.1400317d0
mov ebp, eax
cmp byte [r15 + 0x17], 0
jns 0x14002f960
mov rcx, qword [rsp + 0x20]
call fcn.1400918a8
cmp byte [rsp + 0x4f], 0
jns 0x14002f971
mov rcx, qword [rsp + 0x38]
call fcn.1400918a8
xor bpl, 1
jmp 0x14002f868
mov r14d, eax
inc r14d
xor ebx, ebx
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.140065be0
cmp byte [rsp + 0x67], 0
jns 0x14002f99c
mov rdi, qword [rsp + 0x50]
mov ecx, r14d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14002f905
mov edx, eax
movzx eax, byte [rsp + 0x67]
test al, al
jns 0x14002f9c0
mov rax, qword [rsp + 0x58]
cmp rax, rdx
ja 0x14002f9ff
xor ebx, ebx
jmp 0x14002f905
movups xmm0, xmmword [rsi]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x60]
mov qword [rsi + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
call fcn.1400c5300
mov bl, 1
jmp 0x14002f905
lea rdi, [rsp + 0x50]
mov rcx, rdi
xor r8d, r8d
call fcn.140065be0
mov rcx, rdi
mov dx, 0x5c
call fcn.1400659d0
lea rdx, str.Heartbeat
mov r8d, 9
mov rcx, rdi
call fcn.140026410
lea rbx, [rsp + 0x20]
mov byte [rbx], 0xaa
lea rdx, str._dev_urandom
lea r14, [rsp + 0x70]
mov rcx, r14
call fcn.1400c5890
mov rcx, rbx
mov rdx, r14
call fcn.140025330
cmp byte [r14 + 0x17], 0
jns 0x14002fa68
mov rcx, qword [rsp + 0x70]
call fcn.1400918a8
lea rbx, [rsp + 0x70]
mov r8d, 0x9c0
mov rcx, rbx
mov dl, 0xaa
call fcn.140094eb0
lea rcx, [rsp + 0x20]
call fcn.1400dbb10
mov dword [rbx], eax
mov ecx, 1
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [rsp + rcx*4 + 0x70], eax
inc rcx
cmp rcx, 0x270
jne 0x14002fa8e
lea rbx, [rsp + 0x70]
mov qword [rbx + 0x9c0], 0
mov ebp, 0x31
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r14, [rsp + 0x38]
mov r12, qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x14002fb22
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140026410
cmp byte [rsp + 0x4f], 0
jns 0x14002fafa
mov rcx, qword [rsp + 0x38]
call fcn.1400918a8
cmp byte [rsp + 0x67], 0
mov rcx, rdi
jns 0x14002fb09
mov rcx, qword [rsp + 0x50]
call r12
sub ebp, 1
setb cl
test eax, eax
je 0x14002f9cc
test cl, cl
jne 0x14002f9cc
call r15
mov rcx, r14
mov edx, eax
call fcn.1400dbf50
movzx r8d, byte [rsp + 0x4f]
test r8b, r8b
js 0x14002fb43
and r8d, 0x7f
mov rdx, r14
jmp 0x14002fb4d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140026410
cmp byte [rsp + 0x4f], 0
jns 0x14002fb66
mov rcx, qword [rsp + 0x38]
call fcn.1400918a8
mov rcx, rdi
mov dx, 0x5f
call fcn.1400659d0
mov rcx, rbx
call fcn.1400dea90
and eax, 0x7fffffff
mov rcx, r14
mov edx, eax
call fcn.1400dbe70
movzx r8d, byte [rsp + 0x4f]
test r8b, r8b
js 0x14002fad7
and r8d, 0x7f
mov rdx, r14
jmp 0x14002fae1