Function at 0x14001cf60
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140034040]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rbx, rcx
mov qword [rbp - 0x58], rcx
lea rcx, [rbp - 0x50]
xor edx, edx
mov r8d, 0x20a
xor edi, edi
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x14001d005
lea rcx, [rbp - 0x50]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14001cfd0
cmp word [rbp + rax*2 - 0x52], 0x5c
jne 0x14001cffc
lea rax, [rax*2 - 2]
cmp rax, 0x20a
jae 0x14001d4b5
mov word [rbp + rax - 0x50], di
lea rdx, [rbp - 0x50]
jmp 0x14001d486
mov ecx, 0x20
xor edx, edx
call fcn.140001e70
lea ecx, [rdx + 0x5b]
mov word [rsp + 0x20], ax
lea edx, [rcx - 0x5a]
call fcn.140001e70
lea ecx, [rdx + 0x2c]
mov word [rsp + 0x22], ax
lea edx, [rcx - 0x2b]
call fcn.140001e70
lea ecx, [rdx + 0x5b]
mov word [rsp + 0x24], ax
lea edx, [rcx - 0x5a]
call fcn.140001e70
lea ecx, [rdx + 0x1d]
mov word [rsp + 0x26], ax
lea edx, [rcx - 0x1c]
call fcn.140001e70
lea ecx, [rdx + 0x42]
mov word [rsp + 0x28], ax
lea edx, [rcx - 0x41]
call fcn.140001e70
lea ecx, [rdx + 0x5c]
mov word [rsp + 0x2a], ax
lea edx, [rcx - 0x5b]
call fcn.140001e70
lea ecx, [rdx + 0x63]
mov word [rsp + 0x2c], ax
lea edx, [rcx - 0x62]
call fcn.140001e70
lea ecx, [rdx + 0x65]
mov word [rsp + 0x2e], ax
lea edx, [rcx - 0x64]
call fcn.140001e70
lea ecx, [rdx + 0x5d]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x5c]
call fcn.140001e70
lea ecx, [rdx + 0x5b]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x5a]
call fcn.140001e70
lea ecx, [rdx + 0x16]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x15]
call fcn.140001e70
lea ecx, [rdx + 0x69]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x68]
call fcn.140001e70
lea ecx, [rdx + 0x63]
mov word [rsp + 0x38], ax
lea edx, [rcx - 0x62]
call fcn.140001e70
lea ecx, [rdx + 0x13]
mov word [rsp + 0x3a], ax
lea edx, [rcx - 0x12]
call fcn.140001e70
lea ecx, [rdx + 0x59]
mov word [rsp + 0x3c], ax
lea edx, [rcx - 0x58]
call fcn.140001e70
lea ecx, [rdx + 0x56]
mov word [rsp + 0x3e], ax
lea edx, [rcx - 0x55]
call fcn.140001e70
lea ecx, [rdx + 0x64]
mov word [rsp + 0x40], ax
lea edx, [rcx - 0x63]
call fcn.140001e70
lea ecx, [rdx + 0xf]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0xe]
call fcn.140001e70
lea ecx, [rdx + 0x62]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x61]
call fcn.140001e70
mov word [rsp + 0x46], ax
lea ecx, [rdx + 0x52]
lea edx, [rcx - 0x51]
call fcn.140001e70
lea ecx, [rdx + 0x59]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x58]
call fcn.140001e70
lea ecx, [rdx + 0x5b]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x5a]
call fcn.140001e70
lea ecx, [rdx + 0xa]
mov word [rsp + 0x4c], ax
lea edx, [rcx - 9]
call fcn.140001e70
lea ecx, [rdx + 0x59]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x58]
call fcn.140001e70
lea ecx, [rdx + 0x49]
mov word [rsp + 0x50], ax
lea edx, [rcx - 0x48]
call fcn.140001e70
lea ecx, [rdx + 0x5b]
mov word [rsp + 0x52], ax
lea edx, [rcx - 0x5a]
call fcn.140001e70
lea ecx, [rdx + 0x4e]
mov word [rsp + 0x54], ax
lea edx, [rcx - 0x4d]
call fcn.140001e70
xor ecx, ecx
mov word [rsp + 0x56], ax
lea edx, [rcx + 0x1c]
call fcn.140001e70
lea edx, [rcx + 0x1d]
mov word [rsp + 0x58], ax
movzx ecx, word [0x14002f4f2]
call fcn.140001e70
movzx ecx, word [0x14002f4f4]
mov edx, 0x1e
mov word [rsp + 0x5a], ax
call fcn.140001e70
movzx ecx, word [0x14002f4f6]
mov edx, 0x1f
mov word [rsp + 0x5c], ax
call fcn.140001e70
movzx ecx, word [0x14002f4f8]
mov edx, 0x20
mov word [rsp + 0x5e], ax
call fcn.140001e70
movzx ecx, word [0x14002f4fa]
mov edx, 0x21
mov word [rsp + 0x60], ax
call fcn.140001e70
movzx ecx, word [0x14002f4fc]
mov edx, 0x22
mov word [rsp + 0x62], ax
call fcn.140001e70
movzx ecx, word [0x14002f4fe]
mov edx, 0x23
mov word [rsp + 0x64], ax
call fcn.140001e70
movzx ecx, word [0x14002f500]
mov edx, 0x24
mov word [rsp + 0x66], ax
call fcn.140001e70
movzx ecx, word [0x14002f502]
mov edx, 0x25
mov word [rsp + 0x68], ax
call fcn.140001e70
movzx ecx, word [0x14002f504]
mov edx, 0x26
mov word [rsp + 0x6a], ax
call fcn.140001e70
movzx ecx, word [0x14002f506]
mov edx, 0x27
mov word [rsp + 0x6c], ax
call fcn.140001e70
movzx ecx, word [0x14002f508]
mov edx, 0x28
mov word [rsp + 0x6e], ax
call fcn.140001e70
movzx ecx, word [0x14002f50a]
mov edx, 0x29
mov word [rsp + 0x70], ax
call fcn.140001e70
movzx ecx, word [0x14002f50c]
mov edx, 0x2a
mov word [rsp + 0x72], ax
call fcn.140001e70
movzx ecx, word [0x14002f50e]
mov edx, 0x2b
mov word [rsp + 0x74], ax
call fcn.140001e70
movzx ecx, word [str.SYSTEMCurrentControlSetServices_]
mov edx, 0x2c
mov word [rsp + 0x76], ax
call fcn.140001e70
movzx ecx, word [0x14002f512]
mov edx, 0x2d
mov word [rsp + 0x78], ax
call fcn.140001e70
movzx ecx, word [0x14002f514]
mov edx, 0x2e
mov word [rsp + 0x7a], ax
call fcn.140001e70
movzx ecx, word [0x14002f516]
mov edx, 0x2f
mov word [rsp + 0x7c], ax
call fcn.140001e70
movzx ecx, word [0x14002f518]
mov edx, 0x30
mov word [rsp + 0x7e], ax
call fcn.140001e70
movzx ecx, word [0x14002f51a]
mov edx, 0x31
mov word [rbp - 0x80], ax
call fcn.140001e70
movzx ecx, word [0x14002f51c]
mov edx, 0x32
mov word [rbp - 0x7e], ax
call fcn.140001e70
movzx ecx, word [0x14002f51e]
mov edx, 0x33
mov word [rbp - 0x7c], ax
call fcn.140001e70
movzx ecx, word [0x14002f520]
mov edx, 0x34
mov word [rbp - 0x7a], ax
call fcn.140001e70
movzx ecx, word [0x14002f522]
mov edx, 0x35
mov word [rbp - 0x78], ax
call fcn.140001e70
movzx ecx, word [0x14002f524]
mov edx, 0x36
mov word [rbp - 0x76], ax
call fcn.140001e70
movzx ecx, word [0x14002f526]
mov edx, 0x37
mov word [rbp - 0x74], ax
call fcn.140001e70
movzx ecx, word [0x14002f528]
mov edx, 0x38
mov word [rbp - 0x72], ax
call fcn.140001e70
mov word [rbp - 0x70], ax
mov ecx, 0x133
xor eax, eax
mov word [rbp - 0x6e], ax
nop dword [rax]
movsxd rdx, eax
lea r8, [rsp + 0x20]
lea r8, [r8 + rdx*2]
lea edx, [rcx + rax]
inc eax
xor word [r8], dx
cmp eax, 0x39
jb 0x14001d440
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rsp + 0x20]
mov word [rbp - 0x6e], di
call fcn.14000d3f0
lea rdx, [0x14000d5d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14002d374]
mov rcx, rbx
call fcn.14000cfd0
mov rax, rbx
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400224b0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140022700
int3