Function at 0x140046bc0
Capabilities:
Check if file exists
Generate random numbers via winapi
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
sub rsp, 0x78
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax - 0x18], r13
xor r13d, r13d
or rbp, 0xffffffffffffffff
mov qword [rax + 8], r13
mov edi, r13d
mov qword [rax - 0x48], r13
mov qword [rax - 0x40], r13
mov qword [rax - 0x38], r13
test rcx, rcx
jne 0x140046c72
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov esi, eax
test eax, eax
jne 0x140046c14
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.14004d480
jmp 0x140046eea
lea rcx, [rsi + rsi]
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140046c37
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
jmp 0x140046eea
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov qword [rsp + 0x48], r13
mov r8, rbp
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x140046c50
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14004aad0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x140046cb4
mov r8, rbp
inc r8
cmp byte [rcx + r8], dil
jne 0x140046c75
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14004a730
test eax, eax
js 0x140046eea
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp word [rcx + rax*2 - 2], 0x2f
je 0x140046cb4
lea rcx, [rsp + 0x40]
mov edx, 0x2f
call fcn.14004a5b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140046d24
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x140046ce1
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.14004d480
jmp 0x140046eea
mov rcx, qword [rsp + 0x40]
call fcn.14004dd30
mov rdi, rax
test rax, rax
jne 0x140046d04
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x140046eea
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140046d24
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.14004d480
jmp 0x140046eea
test al, 0x10
jne 0x140046d39
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x14
jmp 0x140046eea
mov rdx, qword [str.libarchive_]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xa8], r12
call fcn.14004a630
mov rdx, qword [str.XXXXXXXXXX]
lea rcx, [rsp + 0x40]
call fcn.14004a630
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
lea r12, [rcx + rax*2]
mov rcx, qword [str.XXXXXXXXXX]
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140046d80
add rax, rax
lea rcx, [rsp + 0x90]
mov rsi, r12
mov r9d, 1
xor r8d, r8d
xor edx, edx
sub rsi, rax
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
test eax, eax
jne 0x140046dca
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.14004d480
jmp 0x140046ee2
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
mov r14, r12
sub r14, rsi
mov r15, r14
sar r15, 1
mov rcx, qword [rsp + 0x90]
lea edx, [r15 + r15]
mov r8, rsi
mov rbx, rsi
call qword [sym.imp.ADVAPI32.DLL_CryptGenRandom]
test eax, eax
je 0x140046ecb
lea r8, [r14 + 1]
mov r9, r13
shr r8, 1
cmp rsi, r12
cmova r8, r13
test r8, r8
je 0x140046e6b
movabs r13, 0x842108421084211
lea rbp, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop word [rax + rax]
movzx ecx, word [rbx]
mov rax, r13
inc r9
lea rbx, [rbx + 2]
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, word [rbp + rcx*2]
mov word [rbx - 2], ax
cmp r9, r8
jb 0x140046e30
or rbp, 0xffffffffffffffff
xor r13d, r13d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
call fcn.14004dd30
mov rdi, rax
test rax, rax
je 0x140046f50
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0010000
mov rcx, rax
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140046f30
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x50
je 0x140046de0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.14004d480
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
test rcx, rcx
je 0x140046f14
xor edx, edx
call qword [sym.imp.ADVAPI32.DLL_CryptReleaseContext]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x40]
call fcn.14004aaa0
mov eax, ebp
add rsp, 0x78
pop rdi
pop rbp
ret
mov edx, 0x8002
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140046ed8
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140046ed8
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x140046ed8