Function at 0x1800044f0
Capabilities:
Encode data using xor
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push r13
mov eax, 0x13a8
call fcn.180047250
sub rsp, rax
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x1370], rax
mov rbx, rcx
lea rcx, [rsp + 0xb71]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0xb70], 0
call fcn.18002de40
xor eax, eax
xor r13d, r13d
lea rcx, [rsp + 0x371]
xor edx, edx
mov r8d, 0x7ff
mov dword [rsp + 0x60], r13d
mov word [rsp + 0x50], r13w
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov byte [rsp + 0x370], al
call fcn.18002de40
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x270], r13b
call fcn.18002de40
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x170], r13b
call fcn.18002de40
cmp dword [0x18006bcd4], r13d
je 0x18000489d
xor eax, eax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x13a0], rbp
mov qword [rsp + 0x1390], rdi
mov rdi, rbx
mov ebp, r13d
repne scasb al, byte [rdi]
mov r8d, r13d
not rcx
dec rcx
mov eax, ecx
cdq
and edx, 3
add eax, edx
and eax, 3
cmp eax, edx
jne 0x18000466f
mov qword [rsp + 0x1388], r12
mov rdi, r13
movsxd r12, ecx
test ecx, ecx
je 0x180004667
mov qword [rsp + 0x1398], rsi
nop word [rax + rax]
lea esi, [r8 + 3]
cmp esi, 0x800
jg 0x18000465f
movsxd rax, r8d
movsxd rcx, ebp
lea rdx, [rsp + rax + 0x370]
add rcx, rbx
call fcn.180007260
cmp byte [rdi + rbx + 2], 0x3d
je 0x18000465f
cmp byte [rdi + rbx + 3], 0x3d
je 0x18000465f
add rdi, 4
add ebp, 4
mov r8d, esi
cmp rdi, r12
jne 0x180004620
mov rsi, qword [rsp + 0x1398]
mov r12, qword [rsp + 0x1388]
mov rbp, qword [rsp + 0x13a0]
mov ecx, r13d
cmp byte [rsp + 0x370], cl
je 0x18000469a
lea rax, [rsp + 0x370]
nop dword [rax + rax]
inc rax
inc ecx
cmp byte [rax], r13b
jne 0x180004690
mov rax, r13
movsxd rdx, ecx
test ecx, ecx
jle 0x1800046c0
nop word [rax + rax]
xor byte [rsp + rax + 0x370], 0xef
inc rax
cmp rax, rdx
jl 0x1800046b0
lea rcx, [rsp + 0x370]
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rbx
inc rcx
mov byte [rbx - 1], al
test al, al
jne 0x1800046d0
mov r8, qword [rsp + 0x13c0]
lea r9, [rsp + 0x13c8]
lea rcx, [rsp + 0xb70]
mov edx, 0x800
call fcn.18002d8fc
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x70], r13b
call fcn.18002de40
xor r9d, r9d
lea rdx, [rsp + 0x70]
lea r8d, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x70]
not rcx
cmp byte [rcx + rax - 2], 0x5c
jne 0x18000476b
lea r9, str.log1.txt
lea r8, [rsp + 0x70]
lea rdx, [0x180054158]
lea rcx, [rsp + 0x170]
call fcn.18002c690
jmp 0x18000478b
lea r9, str.log1.txt
lea r8, [rsp + 0x70]
lea rdx, [0x180054160]
lea rcx, [rsp + 0x170]
call fcn.18002c690
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x170]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004895
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x270]
mov r8d, pe_nt_image_headers64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx edx, word [rsp + 0x5c]
movzx ecx, word [rsp + 0x58]
movzx eax, word [rsp + 0x5a]
movzx edi, word [rsp + 0x56]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
lea r10, [rsp + 0xb70]
mov qword [rsp + 0x48], r10
lea r10, [rsp + 0x270]
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rdx, str._04d__02d__02d__02d:_02d:_02d_t_s_t_s_r_n
lea rcx, [rsp + 0x370]
mov dword [rsp + 0x20], edi
call fcn.18002c690
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x370]
lea r9, [rsp + 0x60]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x370]
mov qword [rsp + 0x20], r13
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x1390]
mov rcx, qword [rsp + 0x1370]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x13a8
pop r13
pop rbx
ret