Function at 0x14000be6b
Capabilities:
Create directory
Encode data using xor
Get common file path
Read file on windows
Write file on windows

Disassembly:
jmp 0x14000be6b
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x13d8
call fcn.140001e29
sub rsp, rax
mov rsi, rcx
movaps xmm0, xmmword [str.__rcuvya_tw_v]
lea rax, [rsp + 0x91]
movaps xmmword [rax - 1], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0xf
mov cl, 0x5b
xor cl, 0xaa
mov byte [rax - 1], cl
mov cl, byte [rax]
inc rax
test cl, cl
jne 0x14000bebc
lea rdx, [rsp + 0x1b0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000bf49
lea rcx, [rsp + 0x1b0]
mov edx, 0x5c
call fcn.140006645
mov rdi, rax
inc rdi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov rcx, rdi
call fcn.14000329c
test rax, rax
js 0x14000c43e
mov rbx, rax
cmp rax, 0xf
ja 0x14000bf64
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 0xf
mov rdx, rdi
mov r8, rbx
call fcn.140003585
add rbx, rsp
add rbx, 0x50
jmp 0x14000bfb4
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
jmp 0x14000c38a
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
lea rcx, [r15 + 1]
cmp rax, 0xfff
jb 0x14000bf8c
call fcn.140003f6c
jmp 0x14000bf91
call fcn.140001339
mov r14, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r15
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.140003585
add rbx, r14
mov byte [rbx], 0
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x68], 0x10
jb 0x14000bfcb
mov rbx, qword [rsp + 0x50]
jmp 0x14000bfd0
lea rbx, [rsp + 0x50]
test rax, rax
je 0x14000c061
lea rcx, [rbx + rax]
dec rcx
cmp byte [rcx], 0x2e
jne 0x14000bfea
mov r14, rcx
jmp 0x14000c003
lea rdx, [rax - 1]
test rdx, rdx
je 0x14000c061
lea r14, [rcx - 1]
dec rdx
cmp byte [rcx - 1], 0x2e
mov rcx, r14
jne 0x14000bfee
sub r14, rbx
cmp r14, 0xffffffffffffffff
je 0x14000c061
xorps xmm0, xmm0
movaps xmmword [rsp + 0x3e0], xmm0
movaps xmmword [rsp + 0x3d0], xmm0
cmp rax, r14
cmovb r14, rax
test r14, r14
js 0x14000c43e
cmp r14, 0xf
ja 0x14000c075
lea rcx, [rsp + 0x3d0]
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 0xf
mov rdx, rbx
mov r8, r14
call fcn.140003585
lea r15, [rsp + r14]
add r15, 0x3d0
jmp 0x14000c0cf
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
call fcn.140004fe3
jmp 0x14000c134
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
lea rcx, [r12 + 1]
cmp rax, 0xfff
jb 0x14000c09e
call fcn.140003f6c
jmp 0x14000c0a3
call fcn.140001339
mov r15, rax
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3e0], r14
mov qword [rsp + 0x3e8], r12
mov rcx, rax
mov rdx, rbx
mov r8, r14
call fcn.140003585
add r15, r14
mov byte [r15], 0
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x14000c117
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000c112
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c443
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140005010
movaps xmm0, xmmword [rsp + 0x3d0]
movaps xmm1, xmmword [rsp + 0x3e0]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
lea r9, [rsp + 0x40]
mov qword [r9], 0
lea rcx, [0x1400f6b28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14000c333
cmp qword [rsp + 0x88], 0x10
jb 0x14000c16b
mov r9, qword [rsp + 0x70]
jmp 0x14000c170
lea r9, [rsp + 0x70]
mov r8, qword [rsp + 0x40]
lea rdx, str._ws_s
lea rbx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.140005880
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14000c1ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000c328
lea rdx, str._s_s
lea rcx, [rsp + 0xa0]
lea r8, [rsp + 0x2c0]
mov r9, rdi
call fcn.140005880
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x1b0]
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000c328
mov rdi, rax
mov eax, 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0xa0]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000c31f
mov rbx, rax
lea r14, [rsp + 0x3d0]
lea r15, [rsp + 0x48]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
lea r12, [rsp + 0x4c]
mov rbp, qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
mov r8d, 0x1000
mov r9, r15
call r13
test eax, eax
je 0x14000c2ad
mov r8d, dword [rsp + 0x48]
test r8d, r8d
je 0x14000c2ad
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r9, r12
call rbp
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0x4c]
je 0x14000c266
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call r14
mov rcx, rbx
call r14
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0xa0]
call fcn.14000329c
test rax, rax
js 0x14000c43e
mov rdi, rax
cmp rax, 0xf
ja 0x14000c3e5
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0xa0]
mov rcx, rsi
mov r8, rdi
call fcn.140003585
add rdi, rsi
jmp 0x14000c436
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x14000c38a
mov rcx, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000c385
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c443
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140005010
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x14000c3ce
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000c3c9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c443
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140005010
mov rax, rsi
add rsp, 0x13d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
lea rcx, [r14 + 1]
cmp rax, 0xfff
jb 0x14000c40d
call fcn.140003f6c
jmp 0x14000c412
call fcn.140001339
mov rbx, rax
mov qword [rsi], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea rdx, [rsp + 0xa0]
mov rcx, rax
mov r8, rdi
call fcn.140003585
add rdi, rbx
mov byte [rdi], 0
jmp 0x14000c349
call fcn.140003706
call fcn.140002900
int3