Function at 0x14010f810
Capabilities:
Check if file exists
Generate random numbers via winapi
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
sub rsp, 0x78
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax - 0x18], r13
xor r13d, r13d
or rbp, 0xffffffffffffffff
mov qword [rax + 8], r13
mov edi, r13d
mov qword [rax - 0x48], r13
mov qword [rax - 0x40], r13
mov qword [rax - 0x38], r13
test rcx, rcx
jne 0x14010f8c2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test eax, eax
jne 0x14010f864
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401160d0
jmp 0x14010fb3a
lea rcx, [rsi + rsi]
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14010f887
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], recvfrom
jmp 0x14010fb3a
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rsp + 0x48], r13
mov r8, rbp
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x14010f8a0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140113720
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14010f904
mov r8, rbp
inc r8
cmp byte [rcx + r8], dil
jne 0x14010f8c5
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140113380
test eax, eax
js 0x14010fb3a
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp word [rcx + rax*2 - 2], 0x2f
je 0x14010f904
lea rcx, [rsp + 0x40]
mov edx, gethostbyaddr
call fcn.140113200
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14010f974
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14010f931
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401160d0
jmp 0x14010fb3a
mov rcx, qword [rsp + 0x40]
call fcn.140116980
mov rdi, rax
test rax, rax
jne 0x14010f954
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], SafeArrayPutElement
jmp 0x14010fb3a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14010f974
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401160d0
jmp 0x14010fb3a
test al, 0x10
jne 0x14010f989
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], SafeArrayPutElement
jmp 0x14010fb3a
mov rdx, qword [str.libarchive_]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xa8], r12
call fcn.140113280
mov rdx, qword [str.XXXXXXXXXX]
lea rcx, [rsp + 0x40]
call fcn.140113280
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
lea r12, [rcx + rax*2]
mov rcx, qword [str.XXXXXXXXXX]
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14010f9d0
add rax, rax
lea rcx, [rsp + 0x90]
mov rsi, r12
mov r9d, 1
xor r8d, r8d
xor edx, edx
sub rsi, rax
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14010fa1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401160d0
jmp 0x14010fb32
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
mov r14, r12
sub r14, rsi
mov r15, r14
sar r15, 1
mov rcx, qword [rsp + 0x90]
lea edx, [r15 + r15]
mov r8, rsi
mov rbx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14010fb1b
lea r8, [r14 + 1]
mov r9, r13
shr r8, 1
cmp rsi, r12
cmova r8, r13
test r8, r8
je 0x14010fabb
movabs r13, 0x842108421084211
lea rbp, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop word [rax + rax]
movzx ecx, word [rbx]
mov rax, r13
inc r9
lea rbx, [rbx + 2]
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, word [rbp + rcx*2]
mov word [rbx - 2], ax
cmp r9, r8
jb 0x14010fa80
or rbp, 0xffffffffffffffff
xor r13d, r13d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
call fcn.140116980
mov rdi, rax
test rax, rax
je 0x14010fba0
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0010000
mov rcx, rax
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14010fb80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14010fa30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401160d0
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
test rcx, rcx
je 0x14010fb64
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x40]
call fcn.1401136f0
mov eax, ebp
add rsp, 0x78
pop rdi
pop rbp
ret
mov edx, 0x8002
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x14010fb28
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010fb28
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], SafeArrayPutElement
jmp 0x14010fb28