Function at 0x140001400
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d30]
mov eax, 0x1e30
call fcn.1400177e0
sub rsp, rax
mov rax, qword [0x140025010]
xor rax, rsp
mov qword [rbp + 0x1d20], rax
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x410
call fcn.140005d00
mov edx, 0x208
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, 0x1772
lea rdx, [0x140020a10]
lea rcx, [rbp + 0x5a0]
call fcn.1400085c0
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call fcn.140005d00
mov rcx, qword [0x140027418]
lea rdx, [rbp - 0x80]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.14000b65c
mov rbx, 0xffffffffffffffff
cmp dword [rax], 2
jl 0x1400014f8
call fcn.14000b664
mov rcx, qword [rax]
mov rdi, qword [rcx + 8]
call fcn.14000b664
mov rcx, rbx
nop word [rax + rax]
cmp word [rdi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400014d0
mov r8, qword [rax]
lea r9d, [rcx + rcx]
mov edx, 0x1480
lea rcx, [rbp + 0x5a0]
mov r8, qword [r8 + 8]
call fcn.140001030
mov r8d, 0x1480
lea rdx, [rbp + 0x5a0]
lea rcx, [0x14002ac70]
call fcn.1400085c0
lea r8, [rbp - 0x80]
mov edx, 0x104
lea rcx, [0x14002bee8]
call fcn.14000b5cc
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [0x14002ac74], eax
lea r10, [0x14002b8d0]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [r10 + rax*2], 0
jne 0x140001540
xor edi, edi
test rax, rax
jne 0x14000170a
mov r8d, 0x51
mov eax, reloc.WS2_32.dll_WSACleanup
mov dword [rsp + 0x40], r8d
mov edx, 0x32
mov word [rsp + 0x44], ax
mov ecx, 0x34
mov eax, 0x22
mov word [rsp + 0x46], ax
mov eax, 0xd
mov word [rsp + 0x48], ax
mov eax, 0x3c
mov word [rsp + 0x4a], dx
mov word [rsp + 0x4c], ax
mov eax, 0x35
mov word [rsp + 0x4e], ax
mov eax, 0x7f
mov word [rsp + 0x50], ax
mov eax, 0x29
mov word [rsp + 0x52], cx
mov word [rsp + 0x54], ax
mov eax, 0x7e
mov word [rsp + 0x56], cx
mov ecx, WSACleanup
mov word [rsp + 0x58], cx
mov word [rsp + 0x5a], ax
movzx eax, word [0x1400221a6]
xor ax, r8w
mov word [rsp + 0x5c], dx
mov word [rsp + 0x5e], cx
mov edx, edi
mov word [rsp + 0x60], r8w
mov word [rsp + 0x62], ax
movzx eax, word [str.http]
xor ax, r8w
mov word [rsp + 0x64], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, r8w
mov word [rsp + 0x66], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, r8w
mov word [rsp + 0x68], ax
movzx eax, word [0x1400221ae]
xor ax, r8w
mov word [rsp + 0x6a], ax
movzx eax, word [0x1400221b0]
xor ax, r8w
mov word [rsp + 0x6c], ax
movzx eax, word [0x1400221b2]
xor ax, r8w
mov word [rsp + 0x6e], ax
movzx eax, word [0x1400221b4]
xor ax, r8w
mov word [rsp + 0x70], ax
movzx eax, word [0x1400221b6]
xor ax, r8w
mov word [rsp + 0x72], ax
movzx eax, word [str.Windows]
xor ax, r8w
mov word [rsp + 0x74], ax
movzx eax, word [0x1400221ba]
xor ax, r8w
mov word [rsp + 0x76], ax
movzx eax, word [0x1400221bc]
xor ax, r8w
mov word [rsp + 0x78], ax
movzx eax, word [0x1400221be]
xor ax, r8w
mov word [rsp + 0x7a], ax
movzx eax, word [0x1400221c0]
xor ax, r8w
mov word [rsp + 0x7c], ax
xor eax, eax
mov word [rsp + 0x7e], ax
movzx eax, word [rsp + 0x44]
movzx eax, word [rsp + rdx*2 + 0x44]
mov ecx, dword [rsp + 0x40]
xor cx, ax
mov word [rsp + rdx*2 + 0x44], cx
inc rdx
cmp rdx, 0x1d
jb 0x1400016d2
lea r9, [rbp + 0x190]
mov word [rsp + 0x7e], di
lea r8, [rsp + 0x44]
mov edx, 0x104
mov rcx, r10
call fcn.1400013a0
lea rdx, [0x14002bad8]
inc rbx
cmp word [rdx + rbx*2], di
jne 0x140001711
test rbx, rbx
jne 0x14000172a
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x1f
lea r15, [0x14002aca0]
mov ebx, edi
mov r14d, 0x6b
mov r12d, 3
lea r13d, [rsi - 4]
nop dword [rax + rax]
movzx eax, word [0x1400221b2]
mov dword [rsp + 0x20], r14d
xor ax, r14w
mov word [rsp + 0x24], r12w
mov word [rsp + 0x26], si
mov word [rsp + 0x28], si
mov word [rsp + 0x2a], r13w
mov word [rsp + 0x2c], r14w
mov word [rsp + 0x2e], ax
movzx eax, word [0x1400221b4]
xor ax, r14w
mov word [rsp + 0x30], ax
movzx eax, word [0x1400221b6]
xor ax, r14w
mov word [rsp + 0x32], ax
movzx eax, word [str.Windows]
xor ax, r14w
mov word [rsp + 0x34], ax
xor eax, eax
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x24]
mov rax, rdi
movzx ecx, word [rsp + rax*2 + 0x24]
mov edx, dword [rsp + 0x20]
xor dx, cx
mov word [rsp + rax*2 + 0x24], dx
inc rax
cmp rax, 9
jb 0x1400017c0
mov eax, ebx
lea rdx, [rsp + 0x24]
imul rcx, rax, 0x208
mov r8d, 4
mov word [rsp + 0x36], di
add rcx, r15
call fcn.14000b728
test eax, eax
je 0x14000180e
inc ebx
cmp ebx, 5
jl 0x140001750
xor eax, eax
jmp 0x140001813
mov eax, 1
mov rcx, qword [rbp + 0x1d20]
xor rcx, rsp
call fcn.140004530
lea r11, [rsp + 0x1e30]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret