Function at 0x140004490
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xf8]
sub rsp, 0x1f0
mov rax, qword [0x140052080]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov edi, r8d
mov esi, edx
mov ebx, ecx
mov edx, 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
xor r14d, r14d
test ebx, ebx
je 0x140004593
mov dword [rsp + 0x20], 0x805e5789
mov dword [rsp + 0x24], 0x4547c642
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x37c
mov eax, dword [rcx + rbx]
mov edi, 0x7e0
test al, 1
jne 0x14000453c
or eax, 1
mov dword [rcx + rbx], eax
mov byte [rbx + rdi + 8], 1
mov rax, qword [rsp + 0x20]
mov qword [rbx + rdi], rax
lea rcx, [0x14003cd24]
call fcn.140014440
nop
lea r9, [rbx + rdi]
cmp byte [r9 + 8], r14b
je 0x140004570
mov r8, r14
mov cl, r8b
and cl, 7
shl cl, 3
movabs rdx, 0x4529a72fe73125d9
shr rdx, cl
xor byte [r8 + r9], dl
inc r8
cmp r8, 8
jb 0x140004549
mov byte [r9 + 8], r14b
xor edx, edx
mov rcx, r9
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x140004ce2
test esi, esi
je 0x1400048e8
mov dword [rsp + 0x20], 0xe7fd1d54
mov dword [rsp + 0x24], 0x6778c1b6
mov dword [rsp + 0x28], 0xeef5001f
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x86c
mov eax, dword [rcx + rdi]
mov ebx, 0x4e8
test al, 1
jne 0x1400045fd
or eax, 1
mov dword [rcx + rdi], eax
mov word [rdi + rbx + 0xc], 0x1d9
movsd xmm0, qword [rsp + 0x20]
movsd qword [rdi + rbx], xmm0
mov eax, dword [rsp + 0x28]
mov dword [rdi + rbx + 8], eax
lea rcx, [0x14003cce8]
call fcn.140014440
nop
add rbx, rdi
movabs rsi, 0x151db3d98b8d6531
cmp byte [rbx + 0xd], r14b
je 0x140004633
mov r8, r14
mov cl, r8b
and cl, 7
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [r8 + rbx], dl
inc r8
cmp r8, 0xd
jb 0x140004613
mov byte [rbx + 0xd], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov rcx, rbx
call fcn.14001f1b0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140011aa8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rcx, [rbp - 0x30]
call fcn.14001f1b0
mov r8, rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140011aa8
nop
mov dword [rsp + 0x20], 0xe7fd1d54
mov dword [rsp + 0x24], 0x6778c1b6
mov word [rsp + 0x28], 0x6511
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x258
mov eax, dword [rcx + rdi]
mov ebx, 0xa50
test al, 1
jne 0x1400046e9
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rdi + rbx + 0xa], 1
movsd xmm0, qword [rsp + 0x20]
movsd qword [rdi + rbx], xmm0
movzx eax, word [rsp + 0x28]
mov word [rdi + rbx + 8], ax
lea rcx, [0x14003cd08]
call fcn.140014440
nop
add rbx, rdi
cmp byte [rbx + 0xa], r14b
je 0x140004715
mov r8, r14
mov cl, r8b
and cl, 7
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [r8 + rbx], dl
inc r8
cmp r8, 0xa
jb 0x1400046f5
mov byte [rbx + 0xa], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov rcx, rbx
call fcn.14001f1b0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140011aa8
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400115ec
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400115ec
cmp qword [rax + 0x18], 0xf
jbe 0x14000476e
mov rax, qword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400023b0
mov ebx, 0x1000
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400047b7
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x1400047b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d20
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], r14b
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400047ff
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x1400047fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d26
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004849
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x140004844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d2c
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004895
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x140004890
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d32
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], r14b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140004ce2
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x140004cdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d1a
jmp 0x140004cdd
test edi, edi
je 0x140004ce2
mov dword [rsp + 0x20], 0xe494cf9d
mov dword [rsp + 0x24], 0xf3b940b0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x314
mov eax, dword [rcx + rdi]
mov ebx, 0x508
test al, 1
jne 0x14000493e
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rdi + rbx + 8], 1
mov rax, qword [rsp + 0x20]
mov qword [rdi + rbx], rax
lea rcx, [0x14003ccd0]
call fcn.140014440
nop
lea r9, [rbx + rdi]
cmp byte [r9 + 8], r14b
je 0x140004972
mov r8, r14
mov cl, r8b
and cl, 7
shl cl, 3
movabs rdx, 0xf3d721dd83fbbdcd
shr rdx, cl
xor byte [r9 + r8], dl
inc r8
cmp r8, 8
jb 0x14000494b
mov byte [r9 + 8], r14b
xor edx, edx
mov rcx, r9
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], 0x1af1bae
mov dword [rsp + 0x24], 0x7916511a
mov dword [rsp + 0x28], 0x8a706e5
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x7cc
mov eax, dword [rcx + rdi]
mov ebx, 0x468
test al, 1
jne 0x140004a03
or eax, 1
mov dword [rcx + rdi], eax
mov word [rdi + rbx + 0xc], 0x175
movsd xmm0, qword [rsp + 0x20]
movsd qword [rdi + rbx], xmm0
mov eax, dword [rsp + 0x28]
mov dword [rdi + rbx + 8], eax
lea rcx, [0x14003cc94]
call fcn.140014440
nop
add rbx, rdi
movabs rsi, 0xb7323756ddf63cb
cmp byte [rbx + 0xd], r14b
je 0x140004a39
mov r8, r14
mov cl, r8b
and cl, 7
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [rbx + r8], dl
inc r8
cmp r8, 0xd
jb 0x140004a19
mov byte [rbx + 0xd], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov rcx, rbx
call fcn.14001f1b0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140011aa8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rcx, [rbp - 0x30]
call fcn.14001f1b0
mov r8, rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.140011aa8
nop
mov dword [rsp + 0x20], 0x1af1bae
mov dword [rsp + 0x24], 0x7916511a
mov word [rsp + 0x28], 0x63eb
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x884
mov eax, dword [rcx + rdi]
mov ebx, 0x338
test al, 1
jne 0x140004aef
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rdi + rbx + 0xa], 1
movsd xmm0, qword [rsp + 0x20]
movsd qword [rdi + rbx], xmm0
movzx eax, word [rsp + 0x28]
mov word [rdi + rbx + 8], ax
lea rcx, [0x14003ccb4]
call fcn.140014440
nop
add rbx, rdi
cmp byte [rbx + 0xa], r14b
je 0x140004b1b
mov r8, r14
mov cl, r8b
and cl, 7
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [rbx + r8], dl
inc r8
cmp r8, 0xa
jb 0x140004afb
mov byte [rbx + 0xa], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov rcx, rbx
call fcn.14001f1b0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140011aa8
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400115ec
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400115ec
cmp qword [rax + 0x18], 0xf
jbe 0x140004b74
mov rax, qword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400023b0
mov ebx, 0x1000
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140004bbd
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x140004bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d38
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], r14b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140004c05
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x140004c00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d3e
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004c4f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x140004c4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d44
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004c9b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x140004c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d4a
call fcn.140014320
movdqa xmm0, xmmword [0x1400496d0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], r14b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140004ce2
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x140004cdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d14
call fcn.140014320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140014300
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140020398
int3
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
nop
call fcn.140020398
int3