Function at 0x180001b60
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x180009040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r13, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
lea rdx, [rbp - 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
lea rax, [rbp - 0x40]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x180001bd4
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x180002159
cmp rbx, 7
ja 0x180001c23
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x68], r15w
jmp 0x180001ccf
mov rax, rbx
or rax, 7
cmp rax, r14
jbe 0x180001c72
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x180001ca2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000215f
mov rcx, rax
call fcn.1800042e0
test rax, rax
je 0x180002115
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180001caa
mov r14, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x18000215f
add rcx, rcx
jne 0x180001c3d
mov rsi, r15
jmp 0x180001caa
call fcn.1800042e0
mov rsi, rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r15w
mov rax, qword [str.__tX]
mov qword [rsp + 0x30], rax
cmp word [0x18000642e], 0
je 0x180001e26
cmp dword [0x180009090], 2
jl 0x180001dbf
movdqa xmm6, xmmword [0x1800064e0]
movdqa xmm4, xmm6
punpckldq xmm4, xmm6
movdqa xmm2, xmm6
punpckhdq xmm2, xmm6
movdqa xmm5, xmm4
pmuldq xmm5, xmmword [0x180006530]
movdqa xmm0, xmm2
pmuldq xmm0, xmmword [0x180006530]
shufps xmm5, xmm0, 0xdd
psrad xmm5, 5
pmuldq xmm4, xmmword [0x180006550]
pmuldq xmm2, xmmword [0x180006550]
shufps xmm4, xmm2, 0xdd
psrad xmm4, 5
movdqa xmm1, xmm4
psrld xmm1, 0x1f
paddd xmm1, xmm4
pmulld xmm1, xmmword [0x180006560]
movdqa xmm0, xmm6
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movdqa xmm0, xmm5
psrld xmm0, 0x1f
paddd xmm0, xmm5
pmulld xmm0, xmmword [0x180006500]
psubd xmm6, xmm0
pshufhw xmm0, xmm6, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm3, xmm2
paddw xmm3, xmmword [0x180006520]
movq xmm0, qword [rsp + 0x30]
xorps xmm3, xmm0
movq qword [rsp + 0x30], xmm3
jmp 0x180001e26
lea r10, [rsp + 0x30]
mov r9d, r15d
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x35
movzx r8d, r9w
sub r8w, cx
add r8w, 0x29
add r8w, r8w
mov eax, 0x44d72045
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x77
sub r8w, cx
xor word [r10], r8w
inc r9d
lea r10, [r10 + 2]
cmp r9d, 4
jl 0x180001dd0
lea rax, [rsp + 0x30]
mov rsi, rdi
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x180001e30
mov r14, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x180001e83
lea rax, [r14 + rsi]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 7
cmova rbx, qword [rsp + 0x68]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rsi]
mov word [rbx + rax*2], r15w
jmp 0x180001e9a
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.180003f90
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
mov rcx, rdx
sar rcx, 0xb
mov rax, rcx
shr rax, 0x3f
add rcx, rax
lea r9, [rbp - 0x4e]
movabs r10, 0xcccccccccccccccd
jns 0x180001f20
neg rcx
nop dword [rax]
nop dword [rax + rax]
sub r9, 2
mov rax, r10
mul rcx
shr rdx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov rcx, rdx
test rdx, rdx
jne 0x180001ee0
add r9, 0xfffffffffffffffe
mov word [r9], 0x2d
jmp 0x180001f51
sub r9, 2
mov rax, r10
mul rcx
shr rdx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov rcx, rdx
test rdx, rdx
jne 0x180001f20
lea r8, [rbp - 0x4e]
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180004150
nop
lea r9, [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x60]
cmp r15, 7
cmova r9, rsi
mov r12, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, r12
mov r14, qword [rsp + 0x58]
cmp r14, rax
ja 0x180001fc9
lea rax, [r14 + r12]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 7
cmova rbx, qword [rsp + 0x68]
lea rcx, [rbx + r12*2]
lea r8, [r14 + r14]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + r12]
xor r14d, r14d
mov word [rbx + rax*2], r14w
jmp 0x180001fe8
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.180003f90
mov r15, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
cmp r15, 7
jbe 0x180002026
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18000201e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000201e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.18000468c
movsd xmm0, qword [str.1.Z]
movzx eax, word [0x1800063c8]
movsd qword [rsp + 0x30], xmm0
mov ecx, 0x2e
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x54
xor word [rsp + 0x34], 0x56
xor word [rsp + 0x36], 0x58
xor ax, 0x5a
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x30]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180002065
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1800020b8
lea rax, [rsi + rdi]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 7
cmova rbx, qword [rsp + 0x68]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r14w
jmp 0x1800020cf
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.180003f90
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.1800018a0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x180002121
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000211c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000211c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000468c
mov rax, r13
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1800042c0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180001740
int3
call fcn.1800016a0
int3