Function at 0x1400016c0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push r15
mov eax, 0x10ec8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000f250
sub rsp, rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x48], 0xfffffffffd050f80
call rsi
lea rdx, [rsp + 0x48]
xor ecx, ecx
mov rbx, rax
call fcn.140004982
call rsi
sub rbx, rax
cmp rbx, 0x1193
ja 0x140001720
xor eax, eax
add rsp, 0x10ec8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [rsp + 0xec0]
lea rsi, [0x140033020]
call fcn.140002d40
mov rdi, r13
mov ecx, 0x26
rep movsq qword [rdi], qword [rsi]
lea rcx, [0x140033de0]
movzx eax, word [rsi]
mov word [rdi], ax
call fcn.14000fe00
lea rcx, [0x140033dc0]
mov rbx, rax
call fcn.14000fe00
cmp byte [rbx], 0
mov r12, rax
jne 0x1400017c2
mov byte [rax + 0x132], 1
mov rsi, r13
xor r8d, r8d
mov rdx, r12
mov rax, qword [rsp + 0xec0]
lea rdi, [r12 + 8]
and rdi, 0xfffffffffffffff8
mov qword [r12], rax
mov rax, qword [rsp + 0xfea]
mov qword [r12 + 0x12a], rax
mov rax, r12
sub rax, rdi
sub rsi, rax
add eax, 0x132
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
mov byte [rbx], 1
lea rcx, [0x140022a80]
call fcn.14000eb10
cmp byte [r12 + 0x132], 0
je 0x14000180a
movabs r8, 0xf7b7db1bd9327c7
xor eax, eax
nop dword [rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [r12 + rax*2], dx
add rax, 1
cmp rax, 0x99
jne 0x1400017e0
mov byte [r12 + 0x132], 0
xor ebx, ebx
mov rdx, r12
lea rdi, [rsp + 0x50]
xor ecx, ecx
call fcn.140002470
mov rax, rbx
mov ecx, 0x41
lea r15, [rsp + 0x50]
rep stosq qword [rdi], rax
xor r9d, r9d
xor r8d, r8d
mov rbp, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x25
mov qword [rsp + 0x20], r15
lea rdi, [rsp + 0x260]
lea r12, [rsp + 0x260]
call rbp
mov rax, rbx
mov ecx, 0x41
mov r8d, 0x104
rep stosq qword [rdi], rax
mov rdx, r12
lea rdi, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, rbx
mov ecx, 0x41
xor r9d, r9d
rep stosq qword [rdi], rax
lea rbx, [rsp + 0x470]
xor r8d, r8d
mov edx, 0x1a
mov qword [rsp + 0x20], rbx
call rbp
movdqa xmm0, xmmword [0x1402b3020]
mov r8d, 0x3303
lea rcx, [0x140033e20]
mov word [rsp + 0xef4], r8w
movaps xmmword [rsp + 0xec0], xmm0
movdqa xmm0, xmmword [0x1402b3030]
mov dword [rsp + 0xef0], 0x3482d8d
movaps xmmword [rsp + 0xed0], xmm0
movdqa xmm0, xmmword [0x1402b3040]
movaps xmmword [rsp + 0xee0], xmm0
call fcn.14000fe00
lea rcx, [0x140033e00]
mov rsi, rax
call fcn.14000fe00
cmp byte [rsi], 0
mov r14, rax
jne 0x140001957
mov ecx, 0x3303
mov byte [rax + 0x36], 1
xor r8d, r8d
mov rdx, rax
movdqa xmm2, xmmword [rsp + 0xec0]
mov word [rax + 0x34], cx
lea rcx, [0x140022ad0]
movdqa xmm3, xmmword [rsp + 0xed0]
mov dword [rax + 0x30], 0x3482d8d
movdqa xmm4, xmmword [rsp + 0xee0]
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
movups xmmword [rax + 0x20], xmm4
mov byte [rsi], 1
call fcn.14000eb10
cmp byte [r14 + 0x36], 0
je 0x140001994
movabs r8, 0xf5578f1333032df5
xor eax, eax
nop word [rax + rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [r14 + rax*2], dx
add rax, 1
cmp rax, 0x1b
jne 0x140001970
mov byte [r14 + 0x36], 0
mov rdx, r14
mov rcx, rbx
lea rsi, [0x140033160]
mov rdi, r13
call sub.msvcrt.dll_wcscat
mov ecx, 0xd7
rep movsq qword [rdi], qword [rsi]
lea rcx, [0x140033e60]
movzx eax, word [rsi]
mov word [rdi], ax
call fcn.14000fe00
lea rcx, [0x140033e40]
mov qword [rsp + 0x38], rax
call fcn.14000fe00
mov rdx, qword [rsp + 0x38]
mov r14, rax
cmp byte [rdx], 0
jne 0x140001a38
mov byte [rax + 0x6ba], 1
lea rdi, [r14 + 8]
mov rsi, r13
xor r8d, r8d
mov rax, qword [rsp + 0xec0]
and rdi, 0xfffffffffffffff8
mov qword [r14], rax
mov rax, qword [rsp + 0x1572]
mov qword [r14 + 0x6b2], rax
mov rax, r14
sub rax, rdi
sub rsi, rax
add eax, 0x6ba
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
mov byte [rdx], 1
lea rcx, [0x140022b70]
mov rdx, r14
call fcn.14000eb10
cmp byte [r14 + 0x6ba], 0
je 0x140001a79
movabs r8, 0x8165c1cfa9fd3505
xor eax, eax
nop
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [r14 + rax*2], dx
add rax, 1
cmp rax, 0x35d
jne 0x140001a50
mov byte [r14 + 0x6ba], 0
mov qword [rsp + 0x20], rbx
mov r9, rbx
mov r8, rbx
mov rdx, r14
mov ecx, 1
lea r14, [rsp + 0x680]
mov rdi, r14
call fcn.140002470
movdqa xmm0, xmmword [0x1402b3050]
xor eax, eax
mov ecx, 0x41
rep stosq qword [rdi], rax
movabs rdx, 0x7985854c29176fba
lea rcx, [0x140033ea0]
mov qword [rsp + 0xed0], rdx
movaps xmmword [rsp + 0xec0], xmm0
call fcn.14000fe00
lea rcx, [0x140033e80]
mov rdi, rax
call fcn.14000fe00
cmp byte [rdi], 0
mov rsi, rax
jne 0x140001b1e
movdqa xmm5, xmmword [rsp + 0xec0]
mov byte [rax + 0x18], 1
xor r8d, r8d
movabs rdx, 0x7985854c29176fba
mov qword [rax + 0x10], rdx
lea rcx, [0x140022a50]
mov rdx, rax
movups xmmword [rax], xmm5
mov byte [rdi], 1
call fcn.14000eb10
cmp byte [rsi + 0x18], 0
je 0x140001b47
movabs rax, 0x79858529296f6fdf
xor qword [rsi], rax
movabs rdx, 0xebebe1e1414179
xor qword [rsi + 0x10], rax
xor qword [rsi + 8], rdx
mov byte [rsi + 0x18], 0
mov rdx, r15
mov rcx, r14
mov r8, rsi
call fcn.140003510
mov rdx, rbx
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x14000223b
lea r12, [rsp + 0x890]
movdqa xmm0, xmmword [0x1402b3060]
xor eax, eax
mov ecx, 0x41
mov dword [rsp + 0xed8], 0xcf67671a
mov rdi, r12
rep stosq qword [rdi], rax
lea rcx, [0x140033f20]
movabs rdi, 0x6f80f1fc95593ff5
movaps xmmword [rsp + 0xec0], xmm0
mov qword [rsp + 0xed0], rdi
call fcn.14000fe00
lea rcx, [0x140033f00]
mov rsi, rax
call fcn.14000fe00
cmp byte [rsi], 0
mov rbx, rax
jne 0x140001bfd
movdqa xmm2, xmmword [rsp + 0xec0]
mov byte [rax + 0x1c], 1
xor r8d, r8d
mov rdx, rax
mov qword [rax + 0x10], rdi
lea rcx, [0x140022a60]
mov dword [rax + 0x18], 0xcf67671a
movups xmmword [rax], xmm2
mov byte [rsi], 1
call fcn.14000eb10
cmp byte [rbx + 0x1c], 0
je 0x140001c2d
movabs rax, 0x6ff1f195953f3f9d
xor dword [rbx + 0x18], 0xcf67676f
movabs rdx, 0x2727cfcf67676f
xor qword [rbx], rax
xor qword [rbx + 8], rdx
xor qword [rbx + 0x10], rax
mov byte [rbx + 0x1c], 0
mov r8, rbx
mov rdx, r14
mov rcx, r12
movabs r14, 0x999f9fea9ff081ac
call fcn.140003510
mov ebx, dword [0x1400c6b20]
lea rcx, [0x140085f20]
mov edx, ebx
call fcn.1400015c0
movdqa xmm0, xmmword [0x1402b3070]
lea rcx, [0x140033f60]
mov qword [rsp + 0xee0], r14
mov qword [rsp + 0x38], rax
movaps xmmword [rsp + 0xec0], xmm0
movdqa xmm0, xmmword [0x1402b3080]
movaps xmmword [rsp + 0xed0], xmm0
call fcn.14000fe00
lea rcx, [0x140033f40]
mov rdi, rax
call fcn.14000fe00
cmp byte [rdi], 0
mov rsi, rax
jne 0x140001cdf
movdqa xmm3, xmmword [rsp + 0xec0]
mov byte [rax + 0x28], 1
xor r8d, r8d
mov rdx, rax
movdqa xmm4, xmmword [rsp + 0xed0]
mov qword [rax + 0x20], r14
lea rcx, [0x140022a90]
movups xmmword [rax], xmm3
movups xmmword [rax + 0x10], xmm4
mov byte [rdi], 1
call fcn.14000eb10
cmp byte [rsi + 0x28], 0
je 0x140001d1a
movabs r8, 0x2327bd999f9f81c5
xor eax, eax
nop dword [rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [rsi + rax*2], dx
add rax, 1
cmp rax, 0x14
jne 0x140001cf8
mov byte [rsi + 0x28], 0
mov rcx, rsi
call fcn.140002cf0
test al, al
je 0x14000237c
xor eax, eax
lea rdi, [rsp + 0xaa0]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x41
mov edx, 0x1a
lea r14, [rsp + 0xaa0]
movabs rsi, 0xbbfc8fddbffe9767
rep stosq qword [rdi], rax
mov qword [rsp + 0x20], r14
call rbp
movdqa xmm0, xmmword [0x1402b3090]
lea rcx, [0x140033fa0]
mov qword [rsp + 0xed0], rsi
mov dword [rsp + 0xed8], 0x936b6be7
movaps xmmword [rsp + 0xec0], xmm0
call fcn.14000fe00
lea rcx, [0x140033f80]
mov rbx, rax
call fcn.14000fe00
cmp byte [rbx], 0
mov r12, rax
jne 0x140001dd6
movdqa xmm5, xmmword [rsp + 0xec0]
mov byte [rax + 0x1c], 1
xor r8d, r8d
mov rdx, rax
mov qword [rax + 0x10], rsi
lea rcx, [0x140022a70]
mov dword [rax + 0x18], 0x936b6be7
movups xmmword [rax], xmm5
mov byte [rbx], 1
call fcn.14000eb10
cmp byte [r12 + 0x1c], 0
je 0x140001e0f
movabs rax, 0xbb8f8fbfbf97972b
xor qword [r12], rax
movabs rdx, 0x333393936b6bbb
xor qword [r12 + 0x10], rax
xor qword [r12 + 8], rdx
xor dword [r12 + 0x18], 0x936b6bbb
mov byte [r12 + 0x1c], 0
mov rdx, r12
mov rcx, r14
lea r12, [rsp + 0xcb0]
call sub.msvcrt.dll_wcscat
mov rdi, r12
xor eax, eax
mov ecx, 0x41
rep stosq qword [rdi], rax
movdqa xmm0, xmmword [0x1402b30a0]
mov edx, 0x11ed
lea rcx, [0x140033fe0]
mov word [rsp + 0xed0], dx
movaps xmmword [rsp + 0xec0], xmm0
call fcn.14000fe00
lea rcx, [0x140033fc0]
mov rsi, rax
call fcn.14000fe00
cmp byte [rsi], 0
mov rbx, rax
jne 0x140001e9d
movdqa xmm2, xmmword [rsp + 0xec0]
mov byte [rax + 0x12], 1
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140022b80]
movups xmmword [rax], xmm2
mov eax, 0x11ed
mov word [rbx + 0x10], ax
mov byte [rsi], 1
call fcn.14000eb10
cmp byte [rbx + 0x12], 0
je 0x140001ec8
movabs rax, 0xc17575f3f31111ed
xor word [rbx + 0x10], 0x11ed
xor qword [rbx], rax
movabs rax, 0x73730b0b5f5fc1
xor qword [rbx + 8], rax
mov byte [rbx + 0x12], 0
mov r8, rbx
mov rdx, r14
mov rcx, r12
call fcn.140003510
mov ebx, dword [0x1400ca410]
lea rcx, [0x1400c6b40]
mov edx, ebx
call fcn.1400015c0
mov r8d, ebx
mov rcx, r12
mov rdx, rax
call fcn.140004070
mov rcx, r14
call fcn.1400025a0
lea rcx, [0x140034020]
mov byte [rsp + 0x38], al
call fcn.14000fe00
lea rcx, [0x140034000]
mov rbx, rax
call fcn.14000fe00
cmp byte [rbx], 0
mov rbp, rax
jne 0x140001f4e
mov byte [rax + 8], 1
xor r8d, r8d
movabs rax, 0xd9c5c55f2df09d85
mov rdx, rbp
mov qword [rbp], rax
lea rcx, [0x140022b10]
mov byte [rbx], 1
call fcn.14000eb10
cmp byte [rbp + 8], 0
je 0x140001f6e
movq xmm0, qword [rbp]
mov byte [rbp + 8], 0
movq xmm1, qword [0x1402b30b0]
pxor xmm0, xmm1
movq qword [rbp], xmm0
movdqa xmm0, xmmword [0x1402b30c0]
lea rcx, [0x140034060]
movaps xmmword [rsp + 0xec0], xmm0
movdqa xmm0, xmmword [0x1402b30d0]
movaps xmmword [rsp + 0xed0], xmm0
movdqa xmm0, xmmword [0x1402b30e0]
movaps xmmword [rsp + 0xee0], xmm0
call fcn.14000fe00
lea rcx, [0x140034040]
mov rbx, rax
call fcn.14000fe00
cmp byte [rbx], 0
mov r14, rax
jne 0x140002000
movdqa xmm3, xmmword [rsp + 0xec0]
mov byte [rax + 0x30], 1
xor r8d, r8d
mov rdx, rax
movdqa xmm4, xmmword [rsp + 0xed0]
lea rcx, [0x140022ab0]
movdqa xmm5, xmmword [rsp + 0xee0]
movups xmmword [rax], xmm3
movups xmmword [rax + 0x10], xmm4
movups xmmword [rax + 0x20], xmm5
mov byte [rbx], 1
call fcn.14000eb10
cmp byte [r14 + 0x30], 0
je 0x14000203c
movabs r8, 0xf34995d9c52d9dfd
xor eax, eax
nop dword [rax + rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [r14 + rax*2], dx
add rax, 1
cmp rax, 0x18
jne 0x140002018
mov byte [r14 + 0x30], 0
lea rsi, [0x140033820]
mov ecx, 0x67
mov rdi, r13
rep movsq qword [rdi], qword [rsi]
lea rcx, [0x1400340a0]
mov eax, dword [rsi]
mov dword [rdi], eax
call fcn.14000fe00
lea rcx, [0x140034080]
mov r12, rax
call fcn.14000fe00
cmp byte [r12], 0
mov rbx, rax
jne 0x1400020d0
mov byte [rax + 0x33c], 1
mov rsi, r13
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rsp + 0xec0]
lea rdi, [rbx + 8]
and rdi, 0xfffffffffffffff8
mov qword [rbx], rax
mov rax, qword [rsp + 0x11f4]
mov qword [rbx + 0x334], rax
mov rax, rbx
sub rax, rdi
sub rsi, rax
add eax, 0x33c
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
mov byte [r12], 1
lea rcx, [0x140022ae0]
call fcn.14000eb10
cmp byte [rbx + 0x33c], 0
je 0x14000210f
movabs r8, 0xf34995d9c52d9dfd
xor eax, eax
nop dword [rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [rbx + rax*2], dx
add rax, 1
cmp rax, 0x19e
jne 0x1400020e8
mov byte [rbx + 0x33c], 0
lea rcx, [0x1400340e0]
call fcn.14000fe00
lea rcx, [0x1400340c0]
mov rsi, rax
call fcn.14000fe00
cmp byte [rsi], 0
mov r12, rax
je 0x1400021ed
nop word cs:[rax + rax]
cmp byte [r12 + 8], 0
je 0x140002166
movq xmm0, qword [r12]
mov byte [r12 + 8], 0
movq xmm1, qword [0x1402b30f8]
pxor xmm0, xmm1
movq qword [r12], xmm0
mov rcx, r12
mov rdx, rbp
call sub.msvcrt.dll__wcsicmp
mov r12d, eax
test eax, eax
jne 0x140002183
cmp byte [rsp + 0x38], 0
je 0x140001708
xor edx, edx
mov r8d, 0xfffe
mov rcx, r13
call sub.msvcrt.dll_memset
mov r8, rbx
mov rdx, r15
mov rcx, r13
call fcn.140003510
test r12d, r12d
jne 0x140002220
movsxd rbx, dword [0x1402c0044]
lea rcx, [0x1402c0041]
mov rdx, rbx
call fcn.1400015c0
mov r12, rax
mov rcx, r14
call fcn.140002cf0
test al, al
jne 0x140001708
mov rcx, r13
xor r9d, r9d
mov r8d, ebx
mov rdx, r12
call fcn.140004450
mov rcx, rax
call fcn.1400048dd
jmp 0x140001708
mov byte [rax + 8], 1
xor r8d, r8d
mov rax, qword [0x1402b30f0]
mov rdx, r12
lea rcx, [0x140022b20]
mov qword [r12], rax
mov byte [rsi], 1
call fcn.14000eb10
jmp 0x140002140
movsxd rbx, dword [0x1402b0e20]
lea rcx, [0x1400ca420]
mov rdx, rbx
call fcn.1400015c0
mov r12, rax
jmp 0x1400021bf
mov rcx, r12
lea rdx, [rsp + 0xcb0]
call fcn.140003f90
mov rcx, rbx
mov rdx, rax
mov eax, dword [rsp + 0xcb0]
lea r8d, [rax + 1]
mov dword [rsp + 0xcb0], r8d
call fcn.140004070
mov esi, dword [0x140085f00]
lea rcx, [0x140034100]
mov edx, esi
call fcn.1400015c0
xor ecx, ecx
mov r12, rax
call fcn.140002cf0
test al, al
je 0x14000239c
lea rsi, str._Ig
mov ecx, 0x40
mov rdi, r13
rep movsq qword [rdi], qword [rsi]
lea rcx, [0x140033ee0]
movzx eax, word [rsi]
mov word [rdi], ax
call fcn.14000fe00
lea rcx, [0x140033ec0]
mov rbp, rax
call fcn.14000fe00
cmp byte [rbp], 0
mov r12, rax
jne 0x140002325
mov byte [rax + 0x202], 1
mov rsi, r13
xor r8d, r8d
mov rdx, r12
mov rax, qword [rsp + 0xec0]
lea rdi, [r12 + 8]
and rdi, 0xfffffffffffffff8
mov qword [r12], rax
mov rax, qword [rsp + 0x10ba]
mov qword [r12 + 0x1fa], rax
mov rax, r12
sub rax, rdi
lea ecx, [rax + 0x202]
sub rsi, rax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
mov byte [rbp], 1
lea rcx, [0x140022ac0]
call fcn.14000eb10
cmp byte [r12 + 0x202], 0
je 0x14000236a
movabs r8, 0x5d5373a54167492b
xor eax, eax
nop dword [rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor word [r12 + rax*2], dx
add rax, 1
cmp rax, 0x101
jne 0x140002340
mov byte [r12 + 0x202], 0
mov r8, rbx
mov rdx, r12
xor ecx, ecx
call fcn.140002470
jmp 0x140001708
mov rdx, qword [rsp + 0x38]
mov rcx, r12
xor r9d, r9d
mov r8d, ebx
call fcn.140004450
mov rcx, rax
call fcn.1400048dd
jmp 0x140001d2a
mov rcx, r14
xor r9d, r9d
mov r8d, esi
mov rdx, r12
call fcn.140004450
mov rcx, rax
call fcn.1400048dd
jmp 0x14000228f