Function at 0x1400c8da0
Capabilities:
Check if file exists
Generate random numbers via winapi
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
sub rsp, 0x78
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax - 0x18], r13
xor r13d, r13d
or rbp, 0xffffffffffffffff
mov qword [rax + 8], r13
mov edi, r13d
mov qword [rax - 0x48], r13
mov qword [rax - 0x40], r13
mov qword [rax - 0x38], r13
test rcx, rcx
jne 0x1400c8e52
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov esi, eax
test eax, eax
jne 0x1400c8df4
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400cf660
jmp 0x1400c90ca
lea rcx, [rsi + rsi]
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400c8e17
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
jmp 0x1400c90ca
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov qword [rsp + 0x48], r13
mov r8, rbp
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x1400c8e30
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1400cccb0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1400c8e94
mov r8, rbp
inc r8
cmp byte [rcx + r8], dil
jne 0x1400c8e55
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400cc910
test eax, eax
js 0x1400c90ca
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp word [rcx + rax*2 - 2], 0x2f
je 0x1400c8e94
lea rcx, [rsp + 0x40]
mov edx, 0x2f
call fcn.1400cc790
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400c8f04
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x1400c8ec1
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400cf660
jmp 0x1400c90ca
mov rcx, qword [rsp + 0x40]
call fcn.1400cff10
mov rdi, rax
test rax, rax
jne 0x1400c8ee4
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400c90ca
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400c8f04
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400cf660
jmp 0x1400c90ca
test al, 0x10
jne 0x1400c8f19
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x14
jmp 0x1400c90ca
mov rdx, qword [str.libarchive_]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xa8], r12
call fcn.1400cc810
mov rdx, qword [str.XXXXXXXXXX]
lea rcx, [rsp + 0x40]
call fcn.1400cc810
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
lea r12, [rcx + rax*2]
mov rcx, qword [str.XXXXXXXXXX]
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1400c8f60
add rax, rax
lea rcx, [rsp + 0x90]
mov rsi, r12
mov r9d, 1
xor r8d, r8d
xor edx, edx
sub rsi, rax
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
test eax, eax
jne 0x1400c8faa
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400cf660
jmp 0x1400c90c2
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
mov r14, r12
sub r14, rsi
mov r15, r14
sar r15, 1
mov rcx, qword [rsp + 0x90]
lea edx, [r15 + r15]
mov r8, rsi
mov rbx, rsi
call qword [sym.imp.ADVAPI32.DLL_CryptGenRandom]
test eax, eax
je 0x1400c90ab
lea r8, [r14 + 1]
mov r9, r13
shr r8, 1
cmp rsi, r12
cmova r8, r13
test r8, r8
je 0x1400c904b
movabs r13, 0x842108421084211
lea rbp, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop word [rax + rax]
movzx ecx, word [rbx]
mov rax, r13
inc r9
lea rbx, [rbx + 2]
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, word [rbp + rcx*2]
mov word [rbx - 2], ax
cmp r9, r8
jb 0x1400c9010
or rbp, 0xffffffffffffffff
xor r13d, r13d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
call fcn.1400cff10
mov rdi, rax
test rax, rax
je 0x1400c9130
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0010000
mov rcx, rax
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c9110
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x50
je 0x1400c8fc0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400cf660
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400c90f4
xor edx, edx
call qword [sym.imp.ADVAPI32.DLL_CryptReleaseContext]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x40]
call fcn.1400ccc80
mov eax, ebp
add rsp, 0x78
pop rdi
pop rbp
ret
mov edx, 0x8002
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400c90b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400c90b8
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400c90b8