Function at 0x140001700
Capabilities:
Encode data using xor
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov dword [rsp + 0x50], 0x2a88
xor ebx, ebx
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x54], 0x37bf
mov dword [rsp + 0x40], 0x3184
mov dword [rsp + 0x4c], 0x365d
mov dword [rsp + 0x48], 0x30f5
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x44]
xor ecx, 0x6a8
cmp eax, ecx
je 0x1400017e9
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x4c]
xor ecx, 0x976
cmp eax, ecx
jg 0x1400017e9
add dword [rsp + 0x44], 0x2c99
xor dword [rsp + 0x44], 0x1ac4
add dword [rsp + 0x48], 0x7e0
xor dword [rsp + 0x54], 0x1a60
add dword [rsp + 0x44], 0xfffff782
xor dword [rsp + 0x44], 0x71d
add dword [rsp + 0x50], 0x357
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x4c]
add edx, 0x4d9
mov r9d, dword [rsp + 0x48]
mov r10d, dword [rsp + 0x40]
sub r9d, 0xc3c
mov rax, qword [section..data]
add r10d, 0x751
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r10d
call fcn.14000f310
mov dword [rsp + 0x4c], eax
xor dword [rsp + 0x4c], 0x130b
mov ecx, dword [rsp + 0x44]
lea rdi, [0x140043010]
mov eax, dword [rsp + 0x48]
add ecx, 0xf68
cmp eax, ecx
je 0x140001912
mov eax, dword [0x1400430c8]
cmp dword [0x140043110], eax
jne 0x140001835
mov rax, qword [section..data]
mov ecx, dword [rax + 0x118]
sub ecx, dword [0x1400430f0]
sub ecx, 0x17465
or dword [0x140043114], ecx
jmp 0x140001854
mov ecx, dword [0x140043138]
mov rdx, qword [section..data]
add ecx, 0x11333f
add ecx, dword [0x140043024]
or dword [rdx + 0xe8], ecx
add dword [rsp + 0x44], 0x5ed
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x54]
sub edx, 0x826
mov r9d, dword [rsp + 0x50]
xor r8d, 0x17f5
mov r11d, dword [rsp + 0x40]
add r9d, 0x316
mov r10d, dword [rsp + 0x40]
xor r11d, 0x7d9
mov eax, dword [rsp + 0x54]
sub r10d, 0x8f
mov rcx, qword [section..data]
xor eax, 0x1c5b
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.140001e00
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x48]
xor ecx, 0x1cf1
mov r8d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
add r8d, 0x316
mov r9, qword [section..data]
mov dword [rsp + 0x20], eax
call fcn.14000e2e0
mov dword [rsp + 0x4c], eax
lea rax, [0x140043140]
add dword [rsp + 0x50], 0xc4b
xor dword [rsp + 0x48], 0x140e
mov qword [0x140043078], rax
jmp 0x1400019f7
mov eax, dword [rsp + 0x4c]
mov ecx, dword [0x140043114]
or ecx, 0x30f5
imul eax, ecx
cmp dword [0x1400430fc], eax
jbe 0x1400019f7
mov rax, qword [section..data]
mov ecx, dword [rax + 0x7c]
movsxd rax, dword [rsp + 0x48]
add ecx, 0x30f5
movsxd r8, dword [rsp + 0x44]
movsxd rdx, dword [rsp + 0x44]
xor r8, rax
xor rdx, r8
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [rsp + 0x4c]
mov eax, dword [0x1400430b8]
xor eax, 0x2c99
add ecx, eax
mov eax, dword [rsp + 0x40]
add eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [0x14004303c]
xor eax, dword [0x140043114]
sub dword [rsp + 0x40], eax
mov ecx, dword [0x140043088]
mov eax, dword [0x140043114]
xor rcx, rax
xor rcx, 0x3a2a
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x4c]
mov edx, dword [0x1400430ec]
sub ecx, dword [0x1400430b4]
sub edx, eax
mov eax, dword [0x140043090]
xor r9d, edx
sub eax, dword [0x1400430c8]
and ecx, 0x2c99
mov r8d, dword [0x140043040]
mov rdx, rdi
add eax, dword [0x14004310c]
add r8d, 0xffffd53e
mov dword [rsp + 0x20], eax
call fcn.14000f250
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x44]
xor ecx, 0x140e
cmp eax, ecx
je 0x140001de5
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
xor ecx, 0x1c74
cmp eax, ecx
jg 0x140001de5
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x4c]
xor ecx, 0x3c9
cmp eax, ecx
jle 0x140001c5d
xor dword [rsp + 0x44], 0x12b
add dword [rsp + 0x44], 0xfffffb57
add dword [rsp + 0x4c], 0xfffff75a
mov rcx, qword [section..data]
nop dword [rax + rax]
mov eax, dword [0x1400430f0]
add eax, 0xffe29c50
add dword [rcx + 0x118], eax
mov rax, qword [0x140043078]
mov r9d, dword [rbx + rax]
add rbx, 4
imul r9d, dword [0x140043050]
mov eax, dword [0x1400430e0]
xor eax, dword [0x1400430f0]
xor eax, dword [0x140043110]
xor eax, 0x1d63b5
mov dword [0x140043110], eax
mov edx, r9d
mov rax, qword [section..data]
shr edx, 0x18
movsxd rcx, dword [rax + 0x54]
mov rax, qword [rax + 0x70]
mov byte [rcx + rax], dl
mov edx, r9d
mov rax, qword [section..data]
shr edx, 0x10
inc dword [rax + 0x54]
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x84]
xor dword [0x140043138], eax
mov eax, dword [rcx + 0xb8]
mov ecx, dword [0x14004304c]
sub eax, 0x16ec40
imul ecx, eax
mov rax, qword [0x140043080]
mov dword [0x14004304c], ecx
movsxd rcx, dword [0x140043064]
mov byte [rcx + rax], dl
inc dword [0x140043064]
mov rdx, qword [section..data]
mov eax, dword [0x140043094]
add eax, 0xffeecca9
mov ecx, dword [rdx + 0x128]
add ecx, dword [0x1400430f8]
add ecx, eax
mov eax, dword [0x140043038]
mov dword [0x140043094], ecx
sub eax, dword [rdx + 0xac]
xor eax, 0x44146
sub dword [rdx + 0x118], eax
mov eax, dword [0x14004304c]
mov edx, dword [0x1400430c8]
add eax, 0xffe913b7
mov r8, qword [section..data]
add edx, eax
mov eax, dword [r8 + 0xac]
imul eax, edx
mov edx, r9d
shr edx, 8
mov dword [r8 + 0xac], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x54]
mov rax, qword [0x140043080]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x54]
mov rax, qword [section..data]
movsxd rdx, dword [0x140043064]
mov rcx, qword [rax + 0x70]
mov eax, 0x281f8c
mov byte [rdx + rcx], r9b
inc dword [0x140043064]
mov rcx, qword [section..data]
sub eax, dword [rcx + 0xb8]
sub eax, dword [0x1400430f8]
add dword [0x140043060], eax
cmp rbx, 0x408
jl 0x140001a60
xor dword [rsp + 0x50], 0x1010
mov ecx, dword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
add ecx, 0xae4
mov r9d, dword [rsp + 0x40]
add edx, 0x3a
mov r10d, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
add r10d, 0xbd5
mov r8, qword [section..data]
xor eax, 0x1b64
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.1400013a0
mov dword [rsp + 0x40], eax
mov rax, qword [section..data]
call qword [rax + 0x60]
mov rcx, qword [section..data]
mov dword [rcx + 0xf4], eax
xor dword [rsp + 0x40], 0x1a86
add dword [rsp + 0x40], 0x326
jmp 0x140001de5
mov eax, dword [rsp + 0x48]
mov rax, qword [section..data]
mov r8d, dword [rax + 0x104]
mov eax, dword [rsp + 0x44]
or r8d, dword [0x1400430c0]
mov r9d, dword [rsp + 0x48]
xor r8d, 0x12ef
imul ecx, eax, 0x2ddf
mov rax, qword [section..data]
mov edx, dword [rax + 0xb4]
mov eax, dword [rsp + 0x40]
xor edx, ecx
xor edx, 0x365d
sub r9d, eax
cmp edx, r8d
jge 0x140001ccf
mov rax, qword [section..data]
mov ecx, dword [rax + 0xac]
mov eax, dword [0x1400430a4]
sub ecx, 0x6e48a
imul eax, ecx
mov dword [0x1400430a4], eax
lea eax, [r9 - 0x556]
mov edx, 0x3be3
mov dword [rsp + 0x54], eax
mov ecx, 0x1f24
mov eax, dword [rsp + 0x44]
xor eax, 0x4a
add dword [rsp + 0x40], eax
call fcn.1400105d0
mov edx, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x54]
mov ecx, dword [0x1400430b4]
mov ebx, dword [0x1400430c4]
sub r8d, dword [0x140043058]
and ebx, 0x884
mov byte [0x140060942], al
or ebx, 0x3679
mov rax, qword [section..data]
sub ecx, dword [rax + 0xbc]
mov eax, dword [rsp + 0x54]
add edx, ecx
mov r10d, dword [rsp + 0x40]
or r9d, eax
imul r10d, dword [0x140043024]
mov ecx, ebx
mov eax, dword [rsp + 0x40]
mov r11d, dword [0x1400430d4]
add r11d, dword [0x14004302c]
sub r10d, eax
mov dword [rsp + 0x30], r10d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r11d
call fcn.140002a40
mov dword [rsp + 0x50], eax
mov rdx, rdi
mov ecx, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x44]
mov rax, qword [section..data]
xor r8d, dword [0x14004310c]
and ecx, dword [rax + 0x3c]
mov eax, dword [rsp + 0x50]
xor r9d, eax
mov ebx, dword [rsp + 0x48]
mov rax, qword [section..data]
and ebx, dword [rax + 0xf8]
mov eax, dword [rsp + 0x54]
mov r11d, dword [rsp + 0x48]
imul r10d, eax, 0x3184
mov eax, dword [rsp + 0x54]
or eax, 0x2ddf
mov dword [rsp + 0x30], eax
xor r11d, r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.140010060
mov dword [rsp + 0x50], eax
mov ecx, dword [0x140043104]
call qword [sym.imp.KERNEL32.dll_ExitProcess]