Function at 0x1800015b0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov eax, dword [rsp + 0xe0]
lea edi, [r8 - 0x869]
lea ecx, [rdi + 0x824]
mov r14d, r8d
mov rbx, rdx
lea esi, [r8 + 0x81]
lea r12d, [r9 - 0x7e2]
lea r10d, [rax + 0x2b]
lea r13d, [rax + 0x155]
mov dword [rsp + 0xc8], r10d
mov eax, dword [rsp + 0xd0]
add eax, 0xfffffc9d
mov dword [rsp + 0xe0], r13d
cmp eax, ecx
jg 0x18000166c
mov eax, dword [rdx + 0xb4]
cmp dword [rdx + 0x108], eax
jbe 0x18000163b
mov rax, qword [section..data]
mov dword [rax + 0x88], 0x6d
mov eax, dword [rdx + 0xf8]
xor eax, dword [0x18022f17c]
xor eax, 0x5cf25
sub dword [0x18022f098], eax
mov rax, qword [section..data]
mov rcx, qword [rdx + 0xe8]
mov qword [rax + 0xd0], rcx
jmp 0x180001789
mov r15d, dword [rdx + 0x70]
mov ebp, esi
xor ebp, 0x824
cmp r15d, ebp
jle 0x18000170c
lea eax, [rsi - 0x824]
mov r13d, esi
mov esi, dword [rsp + 0xe0]
or r12d, r8d
cdqe
and r13d, edi
mov qword [rsp + 0x60], rax
mov r14d, r10d
mov eax, dword [rbx + 0x114]
mov r8, rsi
mov edx, dword [0x18022f024]
and r8, rax
mov ecx, dword [rbx + 0x1c]
add edx, r14d
mov eax, edi
or r8, rax
mov eax, dword [rbx + 0x78]
or rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov ecx, dword [rbx + 0x114]
mov rdx, qword [rsp + 0x60]
xor ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0xfffff948
add r15d, 3
sub eax, r13d
add dword [0x18022f178], eax
cmp r15d, ebp
jg 0x1800016a1
mov r14d, dword [rsp + 0xc0]
mov r13d, dword [rsp + 0xe0]
lea esi, [r14 + 0x81]
mov eax, dword [0x18022f09c]
mov edx, 0x27f3
mov qword [rsp + 0x58], 0x317a
and eax, r13d
mov qword [rsp + 0x50], 0x2e22
add edi, eax
mov qword [rsp + 0x48], 0x2504
mov eax, 0x255a
mov qword [rsp + 0x40], 0x1371
mov ecx, 0x34b6
mov qword [rsp + 0x38], 0x5a8
mov r9d, 0x3815
mov word [rsp + 0x30], ax
mov r8d, 0x2ec1
mov byte [rsp + 0x28], 0x1b
mov qword [rsp + 0x20], 0x18d6
call fcn.180003ea0
mov r10d, dword [rsp + 0xc8]
movsxd rcx, eax
mov qword [0x1803dc9b0], rcx
lea eax, [rdi + 0x824]
cmp r14d, eax
je 0x180001ace
mov eax, dword [0x18022f038]
sub eax, dword [rbx + 0x15c]
add eax, 0x1447
mov dword [0x18022f094], eax
mov eax, 0xb6db59bc
mov ecx, dword [rbx + 0xa4]
xor ecx, dword [0x18022f144]
sub eax, ecx
lea rcx, [0x18010dca0]
add dword [rbx + 0x84], eax
mov rax, qword [section..data]
xor ebp, ebp
mov r11d, ebp
lea r14d, [rbp + 1]
mov qword [rax + 0xc8], rcx
mov rax, qword [0x18022f0d8]
mov r9d, dword [rax + r11]
add r11, 4
imul r9d, dword [0x18022f094]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xdc]
mov edx, r9d
mov eax, dword [0x18022f154]
mov r8d, r9d
dec eax
shr edx, 0x10
add ecx, eax
shr r8d, 8
mov dword [0x18022f154], ecx
movsxd rcx, dword [0x18022f098]
mov rax, qword [rbx + 0xd0]
mov byte [rcx + rax], dl
add dword [0x18022f098], r14d
mov rax, qword [section..data]
movsxd rdx, dword [rbx + 0x88]
mov rcx, qword [rax + 0xd0]
mov byte [rdx + rcx], r8b
add dword [rbx + 0x88], r14d
mov eax, dword [rbx + 0x28]
mov ecx, dword [rbx + 0x78]
sub ecx, 0x11
imul eax, ecx
mov dword [rbx + 0x28], eax
mov eax, dword [rbx + 0xb4]
xor eax, dword [0x18022f0b4]
sub eax, 0x14
add dword [rbx + 0x10], eax
mov eax, dword [0x18022f130]
mov rcx, qword [section..data]
dec eax
add dword [rcx + 0xf8], eax
mov eax, dword [rbx + 0x50]
sub dword [rbx + 0xb4], eax
mov rax, qword [rbx + 0xd0]
movsxd rcx, dword [0x18022f098]
mov byte [rcx + rax], r9b
mov eax, r14d
add dword [0x18022f098], r14d
mov ecx, dword [rbx + 0x10]
xor ecx, dword [rbx + 0x108]
sub eax, ecx
add dword [0x18022f0c4], eax
mov eax, dword [rbx + 0x16c]
xor eax, dword [0x18022f118]
sub eax, 0xfbe87
xor dword [rbx + 0x5c], eax
mov eax, dword [rbx + 0x144]
add eax, 0x40923b0
or dword [rbx + 0x15c], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 4]
add dword [rbx + 0x1c], ecx
mov eax, dword [rbx + 0x16c]
mov ecx, dword [rbx + 0x134]
sub ecx, 0x46
imul eax, ecx
mov dword [rbx + 0x16c], eax
mov eax, dword [rbx + 0x94]
imul eax, dword [rbx + 0x150]
mov dword [rbx + 0x94], eax
cmp r11, 0x11a3f0
jl 0x1800017e6
lea eax, [r13 + 0x21d]
mov dword [rsp + 0x28], eax
lea r8d, [rdi + 0x790]
xor edi, 0x724
lea rax, [0x18022f010]
lea r9d, [rsi - 0x27a]
mov qword [rsp + 0x20], rax
lea edx, [r10 + 0x1b1]
mov ecx, edi
call sym.xxubcoh481gq.dll_Jzt7B
mov r8, qword [section..data]
mov eax, dword [r8 + 0x120]
sub eax, r14d
or dword [r8 + 0xb4], eax
mov eax, dword [0x18022f014]
or dword [rbx + 0x78], eax
mov rdx, qword [section..data]
mov rax, qword [0x18022f0d8]
mov ecx, dword [rdx + 0x108]
mov r8d, dword [rax + rbp]
add rbp, 4
mov eax, dword [0x18022f118]
dec eax
add ecx, eax
mov rax, qword [0x18022f0e0]
mov dword [0x18022f118], ecx
imul r8d, dword [rdx + 0x84]
movsxd rcx, dword [0x18022f098]
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
add dword [0x18022f098], r14d
mov eax, dword [rbx + 0xb4]
add eax, dword [rbx + 0x28]
xor eax, dword [0x18022f0c4]
xor eax, 0x11
mov dword [0x18022f0c4], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x168]
sub ecx, dword [0x18022f0ec]
mov eax, dword [rbx + 0x64]
sub ecx, 0x12c358
add dword [rbx + 0x120], ecx
mov rcx, qword [section..data]
add dword [rcx + 0x78], eax
mov rax, qword [section..data]
movsxd rdx, dword [rbx + 0x88]
mov rcx, qword [rax + 0xd0]
mov byte [rdx + rcx], r8b
add dword [rbx + 0x88], r14d
mov rax, qword [section..data]
mov ecx, dword [rax + 0xf8]
xor ecx, dword [rbx + 0x78]
mov eax, dword [rbx + 0x10c]
sub ecx, 0xa71db
imul eax, ecx
mov dword [rbx + 0x10c], eax
mov rcx, qword [section..data]
mov eax, dword [0x18022f0b4]
add eax, 0xffffffec
add dword [rcx + 0x8c], eax
mov eax, dword [rbx + 0x38]
sub eax, 0x6def4
add dword [rbx + 0x10], eax
mov rcx, qword [section..data]
mov eax, dword [rbx + 0xb4]
sub dword [rcx + 0x150], eax
mov r8, qword [section..data]
mov ecx, dword [0x18022f024]
add ecx, 0x6def4
mov edx, dword [r8 + 0x5c]
sub edx, dword [r8 + 0x38]
add edx, ecx
mov dword [0x18022f024], edx
cmp rbp, 0x171168
jl 0x180001975
mov rbx, qword [rsp + 0xb0]
xor esi, 0xfce
mov eax, esi
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret