Function at 0x1400e8280
Capabilities:
Check if file exists
Generate random numbers via winapi
Get common file path
Get file attributes

Disassembly:
xor edx, edx
jmp 0x1400e8290
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r13d, r13d
mov r14, rdx
mov qword [rax + 0x10], r13
mov ebp, r13d
lea r12, [r13 - 1]
test rdx, rdx
jne 0x1400e843c
mov qword [rax - 0x48], r13
mov qword [rax - 0x40], r13
mov qword [rax - 0x38], r13
test rcx, rcx
jne 0x1400e8341
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test eax, eax
jne 0x1400e82f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8b80
jmp 0x1400e85ca
lea rcx, [rdi + rdi]
call fcn.1400305b8
mov rbx, rax
test rax, rax
jne 0x1400e8311
call fcn.1400371cc
mov dword [rax], InitCommonControls
jmp 0x1400e85ca
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8, r12
nop
inc r8
cmp word [rbx + r8*2], bp
jne 0x1400e8320
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400ee0c0
mov rcx, rbx
call fcn.1400305a4
jmp 0x1400e8383
mov r8, r12
inc r8
cmp byte [rcx + r8], bpl
jne 0x1400e8344
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400edce0
test eax, eax
js 0x1400e85ca
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp word [rcx + rax*2 - 2], 0x2f
je 0x1400e8383
mov edx, 0x2f
lea rcx, [rsp + 0x40]
call fcn.1400edb60
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400e83f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400e83b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8b80
jmp 0x1400e85ca
mov rcx, qword [rsp + 0x40]
call fcn.1400e9470
mov rbp, rax
test rax, rax
jne 0x1400e83d2
call fcn.1400371cc
mov dword [rax], SafeArrayPutElement
jmp 0x1400e85ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400e83f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8b80
jmp 0x1400e85ca
test al, 0x10
jne 0x1400e8406
call fcn.1400371cc
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayLock
jmp 0x1400e85ca
lea rdx, str.libarchive_
lea rcx, [rsp + 0x40]
call fcn.1400edbd0
lea rdx, str.XXXXXXXXXX
lea rcx, [rsp + 0x40]
call fcn.1400edbd0
mov rax, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
lea rbx, [r14 + rax*2]
lea rsi, [rbx - 0x14]
jmp 0x1400e8478
mov edx, 0x58
mov rcx, r14
call fcn.140055210
mov rsi, rax
test rax, rax
je 0x1400e8651
mov rbx, rax
movzx eax, word [rax]
cmp ax, 0x58
jne 0x1400e846f
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x58
je 0x1400e8461
test ax, ax
jne 0x1400e8651
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400e84af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8b80
jmp 0x1400e85ca
mov qword [rsp + 0x90], r15
mov r15, rbx
sub r15, rsi
sar r15, 1
add r15d, r15d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x98]
mov r8, rsi
mov edx, r15d
mov rdi, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400e85b5
cmp rsi, rbx
jae 0x1400e854a
movabs r13, 0x842108421084211
lea r12, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop word [rax + rax]
movzx ecx, word [rdi]
mov rax, r13
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, word [r12 + rcx*2]
mov word [rdi], ax
add rdi, 2
cmp rdi, rbx
jb 0x1400e8510
mov r12, 0xffffffffffffffff
xor r13d, r13d
mov rcx, rbp
call fcn.1400305a4
mov rcx, r14
call fcn.1400e9470
mov rbp, rax
test rax, rax
je 0x1400e8641
cmp r14, qword [rsp + 0x40]
mov eax, pe_nt_image_headers64
mov ecx, 0x4000100
mov qword [rsp + 0x30], r13
cmove eax, ecx
mov edx, 0xc0010000
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400e8614
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x1400e84d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8b80
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400e85df
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbp
call fcn.1400305a4
cmp r14, qword [rsp + 0x40]
jne 0x1400e85f8
lea rcx, [rsp + 0x40]
call fcn.1400ee090
lea r11, [rsp + 0x60]
mov eax, r12d
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov edx, 0x8002
mov rcx, rdi
call fcn.14003d5a4
mov r12d, eax
cmp eax, 0xffffffff
jne 0x1400e85c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8b80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400e85c2
call fcn.1400371cc
mov dword [rax], SafeArrayPutElement
jmp 0x1400e85c2
call fcn.140046aa0
int3