Function at 0x140018250
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [rsp + 0x50]
add r9d, 0xfffff804
mov r8d, dword [rsp + 0x60]
mov esi, ecx
lea r11d, [rax - 0xa92]
add eax, 0xfffff8f1
lea r10d, [r8 - 0x2e87]
xor eax, 0xa43
xor r8d, 0x2e87
cmp r8d, eax
jg 0x140018545
lea eax, [rdx - 0x1589]
cmp r11d, eax
je 0x1400184bc
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x98]
cmp dword [0x140105060], eax
mov rax, qword [rsp + 0x58]
jbe 0x1400182c9
lea rcx, [0x14010a8c0]
mov qword [rax + 0xb8], rcx
jmp 0x1400182e1
mov ecx, dword [rcx + 0xa8]
xor ecx, dword [rax + 0xa0]
xor ecx, 0x67e1
mov dword [rax + 0xa0], ecx
xor r10d, r10d
mov r11d, r10d
nop word [rax + rax]
mov ecx, dword [rax + 0xa0]
mov r8, qword [section..data]
add ecx, 0xf790f
xor dword [0x140105050], ecx
mov edx, dword [rax + 0x88]
xor edx, dword [0x140105110]
mov rcx, qword [0x1401050c8]
sub edx, 0x6dc59
mov r9d, dword [r11 + rcx]
add r11, 4
mov ecx, dword [r8 + 0x1c]
imul r9d, dword [rax + 0x70]
imul ecx, edx
mov dword [r8 + 0x1c], ecx
mov r8d, r9d
movsxd rdx, dword [rax + 0x7c]
mov rcx, qword [0x1401050d8]
shr r8d, 8
mov byte [rdx + rcx], r8b
inc dword [rax + 0x7c]
mov edx, dword [rax + 0xa8]
sub edx, dword [rax + 0x108]
mov ecx, dword [0x14010502c]
add edx, 0x11b2fe
imul ecx, edx
mov rdx, qword [section..data]
mov dword [0x14010502c], ecx
mov ecx, 0x2e
sub ecx, dword [0x140105060]
add dword [rdx + 4], ecx
mov ecx, dword [rax + 0x60]
mov rdx, qword [section..data]
or dword [rdx + 0x94], ecx
mov rcx, qword [section..data]
movsxd rdx, dword [rcx + 0x7c]
mov rcx, qword [rax + 0xc8]
mov byte [rdx + rcx], r9b
mov rcx, qword [section..data]
inc dword [rcx + 0x7c]
mov ecx, dword [rax + 0x1c]
sub dword [rax + 0xc], ecx
mov ecx, 0x2e
sub ecx, dword [rax + 0x50]
add dword [0x140105110], ecx
mov r8, qword [section..data]
mov ecx, dword [0x140105118]
add ecx, 0xfffdf0f9
mov edx, dword [r8 + 0x38]
sub edx, dword [rax + 0x118]
add edx, ecx
mov dword [0x140105118], edx
mov ecx, dword [r8 + 0x108]
xor ecx, 0x1b8702
or dword [r8 + 0x28], ecx
cmp r11, 0xce58
jl 0x1400182f0
lea rcx, [0x140105010]
mov qword [0x1401050f8], rcx
nop
mov rcx, qword [section..data]
mov edx, dword [rcx + 0x28]
xor edx, dword [0x140105118]
xor edx, 0x1b8702
add dword [rax + 0x94], edx
mov rcx, qword [section..data]
mov rdx, qword [rcx + 0xd0]
mov ecx, dword [rax + 0x9c]
xor dword [rdx + r10], ecx
add r10, 4
mov ecx, dword [rax + 0x5c]
sub ecx, dword [0x1401050d0]
xor ecx, 0x22e497
add dword [rax + 0x60], ecx
mov rcx, qword [section..data]
mov edx, dword [rcx + 0x108]
mov ecx, 0x1b875e
sub edx, 0x1b8702
add dword [rax + 0x50], edx
sub ecx, dword [rax + 0x108]
sub ecx, dword [0x140105050]
add dword [rax + 0x100], ecx
mov ecx, dword [0x1401050e8]
add dword [0x1401050ac], ecx
cmp r10, 0x189bcc
jl 0x140018420
lea eax, [rsi + 0x82c]
add rsp, 0x20
pop rsi
ret
mov edx, dword [0x1401050b0]
add edx, dword [0x14010502c]
imul edx, dword [0x14010501c]
mov rax, qword [section..data]
cmp dword [rax + 0x100], edx
je 0x140018545
mov rax, qword [rsp + 0x58]
xor r9d, r11d
mov ecx, dword [rax + 0xa0]
cmp ecx, r9d
jge 0x140018545
mov qword [rsp + 0x30], rbx
sub r9d, ecx
and r10d, 0x185b
mov qword [rsp + 0x38], rdi
sub r10d, 0x16ec
movsxd rdi, r10d
lea ebx, [r9 - 1]
shr ebx, 1
inc ebx
nop word [rax + rax]
mov edx, dword [0x1401050a8]
mov rcx, rdi
add edx, dword [0x1401050d0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
sub rbx, 1
jne 0x140018520
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea eax, [rsi + 0x82c]
add rsp, 0x20
pop rsi
ret