Function at 0x140002cb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xcf0]
sub rsp, 0xdf0
mov rax, qword [0x1401973d0]
xor rax, rsp
mov qword [rbp + 0xce0], rax
mov rdi, rcx
mov qword [rbp - 0x70], rcx
xor r15d, r15d
mov dword [rbp - 0x78], r15d
xor eax, eax
mov qword [rcx], rax
mov eax, 0xc
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x760074
mov dword [rsp + 0x38], 0x7a0079
mov dword [rsp + 0x3c], 0x7c0070
mov dword [rsp + 0x40], 0x6f006e
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x48], 0x20016
mov dword [rsp + 0x4c], 0x44
mov edx, r15d
test eax, eax
je 0x140002d6b
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x34]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x30]
cmp edx, eax
jb 0x140002d50
mov word [rsp + rax*2 + 0x34], r15w
lea rcx, [rsp + 0x34]
call fcn.140125260
mov rsi, rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x14000315d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov rbx, 0xffffffffffffffff
test rsi, rsi
je 0x140002dce
cmp rsi, 0x10000
jae 0x140002dbe
movzx edx, si
mov rcx, rdi
call fcn.14000c690
jmp 0x140002ddd
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x140002dc1
jmp 0x140002dd1
mov r8d, r15d
mov rdx, rsi
mov rcx, rdi
call fcn.14000c910
nop
mov r14d, 1
mov dword [rbp - 0x78], r14d
lea rdx, [0x14016b907]
mov rcx, rdi
call fcn.140009550
test al, al
je 0x14000311f
mov dword [rbp - 0x60], 0x400
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x50], 0x19
mov dword [rsp + 0x54], 0x3007b
lea r12d, [r14 + 2]
mov dword [rsp + 0x58], 0x6e0066
mov dword [rsp + 0x5c], 0x58004f
mov dword [rsp + 0x60], 0x4c004c
lea esi, [r14 + 0x1b]
mov dword [rsp + 0x64], 0x64001c
mov dword [rsp + 0x68], 0x1f0031
mov dword [rsp + 0x6c], 0x350005
mov dword [rsp + 0x70], 0x30036
mov dword [rsp + 0x74], 0x3d0029
mov dword [rsp + 0x78], 0x17002b
mov dword [rsp + 0x7c], 0x220000
mov dword [rbp - 0x80], 0x2e002d
mov dword [rbp - 0x7c], 0x51003c
mov edx, r15d
nop
mov eax, edx
lea rcx, [rsp + 0x54]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x50]
cmp edx, eax
jb 0x140002e90
mov word [rsp + rax*2 + 0x54], r15w
lea r9, [rbp + 0x4e0]
lea r8, [rsp + 0x54]
mov edx, 0x208
lea rcx, [rbp + 0xc0]
call fcn.140011110
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.140125278
test eax, eax
jne 0x140002f06
lea rax, [rbp + 0xc0]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002ef0
lea rdx, [rbp + 0xc0]
jmp 0x140003114
mov qword [rbp - 0x68], r15
lea r9, [rbp - 0x68]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x14015cb30]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x140003012
mov r8d, 0x104
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.1401258bc
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, ebx
lea r8, [rbp - 0x50]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [rax - 1]
mov rax, qword [rdi]
test esi, esi
jle 0x140002fb9
sub r14d, dword [rax - 8]
mov edx, dword [rax - 0xc]
sub edx, esi
or r14d, edx
jge 0x140002f7c
mov edx, esi
mov rcx, rdi
call fcn.14000cad0
mov dword [rsp + 0x28], esi
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp - 0x50]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rdi]
cmp esi, dword [rax - 0xc]
jg 0x140003168
mov dword [rax - 0x10], esi
movsxd rcx, esi
mov rax, qword [rdi]
mov word [rax + rcx*2], r15w
jmp 0x14000311f
lea rdx, [rax - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000311f
cmp dword [rdx + 0x10], 0
jge 0x140002fea
cmp dword [rax - 0xc], 0
jl 0x140003168
mov dword [rax - 0x10], r15d
mov rax, qword [rdi]
mov word [rax], r15w
jmp 0x14000311f
lock xadd dword [rdx + 0x10], ebx
sub ebx, r14d
jg 0x140002ffd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
jmp 0x14000311f
xor r9d, r9d
mov r8d, esi
lea rdx, [rbp + 0x2d0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1400030fc
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, ebx
lea r8, [0x14016b908]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [rax - 1]
mov rax, qword [rdi]
test esi, esi
jle 0x1400030ad
sub r14d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, esi
or r14d, ecx
jge 0x140003070
mov edx, esi
mov rcx, rdi
call fcn.14000cad0
mov dword [rsp + 0x28], esi
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [0x14016b908]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rdi]
cmp esi, dword [rax - 0xc]
jg 0x140003152
mov dword [rax - 0x10], esi
movsxd rcx, esi
mov rax, qword [rdi]
mov word [rax + rcx*2], r15w
jmp 0x1400030fc
lea rdx, [rax - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400030fc
cmp dword [rdx + 0x10], 0
jge 0x1400030d7
cmp dword [rax - 0xc], 0
jl 0x140003152
mov dword [rax - 0x10], r15d
mov rax, qword [rdi]
mov word [rax], r15w
jmp 0x1400030fc
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, r14d
jg 0x1400030ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rbp + 0x2d0]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140003103
lea rdx, [rbp + 0x2d0]
mov r8d, ebx
mov rcx, rdi
call fcn.14000c910
mov rax, rdi
mov rcx, qword [rbp + 0xce0]
xor rcx, rsp
call fcn.14011e030
lea r11, [rsp + 0xdf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000fc90
int3
mov ecx, 0x80004005
call fcn.14000fc90
int3
mov ecx, 0x80070057
call fcn.14000fc90
int3